REDHAT-BUG-2374571: Medium severity Apache HTTP Server vulnerability
Insufficient escaping of user-supplied data in modssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with \"%{varname}x\" or \"%{varname}c\" to log variables provided by modssl such as SSLTLSSNI, no escaping is performed by either modlogconfig or modssl and unsanitized data provided by the client may appear in log files.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2374571?
The severity of REDHAT-BUG-2374571 is considered high due to potential risks associated with insufficient data escaping in logging.
How do I fix REDHAT-BUG-2374571?
To fix REDHAT-BUG-2374571, upgrade to Apache HTTP Server version 2.4.64 or later, where the issue has been addressed.
What configurations are affected by REDHAT-BUG-2374571?
REDHAT-BUG-2374571 affects configurations using CustomLog with the "%{varname}x" or "%{varname}c" directives in Apache HTTP Server.
Who should be concerned about REDHAT-BUG-2374571?
Administrators using Apache HTTP Server versions 2.4.63 and earlier should be concerned about REDHAT-BUG-2374571.
What risk does REDHAT-BUG-2374571 pose?
REDHAT-BUG-2374571 poses a risk of exposing sensitive data through improperly logged information due to untrusted SSL/TLS client inputs.