REDHAT-BUG-2374580: Medium severity Apache HTTP Server vulnerability
In some modssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Only configurations using \"SSLEngine optional\" to enable TLS upgrades are affected. Upstream recommends users to upgrade to version 2.4.64, which removes support for TLS upgrade.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache HTTP Server (mod_ssl)to a version that resolves this vulnerability.Fixed in 2.4.64 - Configuration
Do not use "SSLEngine optional". Only configurations using "SSLEngine optional" to enable TLS upgrades are affected by the HTTP desynchronisation issue; use a configuration that does not allow TLS upgrades (or remove TLS upgrade support) so the affected behavior is not enabled.
Apache HTTP Server (mod_ssl) SSLEngine = optional
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2374580?
The severity of REDHAT-BUG-2374580 is considered critical due to the potential for man-in-the-middle attacks.
How do I fix REDHAT-BUG-2374580?
To fix REDHAT-BUG-2374580, disable the 'SSLEngine optional' setting in your Apache HTTP Server configuration.
Which versions of Apache HTTP Server are affected by REDHAT-BUG-2374580?
Apache HTTP Server versions up to and including 2.4.63 are affected by REDHAT-BUG-2374580.
What type of attack does REDHAT-BUG-2374580 enable?
REDHAT-BUG-2374580 enables an HTTP desynchronization attack that can hijack an HTTP session.
Are all configurations of Apache HTTP Server vulnerable to REDHAT-BUG-2374580?
No, only configurations using 'SSLEngine optional' to enable TLS upgrades are vulnerable to REDHAT-BUG-2374580.