CVE-2024-47252: Apache HTTP Server: mod_ssl error log variable escaping
Insufficient escaping of user-supplied data in modssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/apache2to a version that resolves this vulnerability.Fixed in 2.4.67-1~deb11u1Fixed in 2.4.67-1~deb12u2Fixed in 2.4.67-1~deb13u2Fixed in 2.4.67-1 - Upgrade
Upgrade
Apache HTTP Server (mod_ssl)to a version that resolves this vulnerability.Fixed in 2.4.63Patch CVE-2024-47252 - Configuration
Avoid logging mod_ssl-provided variables such as SSL_TLS_SNI via CustomLog with the "%{varname}x" or "%{varname}c" format, since neither mod_log_config nor mod_ssl performs escaping for these variables in affected configurations (CVE-2024-47252).
Apache httpd mod_log_config (CustomLog) CustomLog format strings using "%{varname}x" or "%{varname}c" for mod_ssl variables (e.g., SSL_TLS_SNI) = Do not use %{varname}x/%{varname}c directly with client-controlled mod_ssl variables in CustomLog; use a logging format that does not output unsanitized client-provided data
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47252?
CVE-2024-47252 has been classified as a moderate severity vulnerability.
How do I fix CVE-2024-47252?
To fix CVE-2024-47252, upgrade to Apache HTTP Server version 2.4.64 or later, which includes patches for this vulnerability.
What impact does CVE-2024-47252 have on my Apache server?
CVE-2024-47252 allows untrusted SSL/TLS clients to manipulate log files, potentially leading to misleading information in logs.
What versions of Apache HTTP Server are affected by CVE-2024-47252?
CVE-2024-47252 affects Apache HTTP Server versions 2.4.63 and earlier.
Is CVE-2024-47252 related to SSL/TLS security?
Yes, CVE-2024-47252 involves insufficient escaping of user-supplied data in the context of SSL/TLS clients.