From nobody Sat Mar 11 09:13:01 2023 X-Original-To: dev-commits-ports-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4PYcdn3tV8z3xPXb; Sat, 11 Mar 2023 09:13:01 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4PYcdn3LMrz43VX; Sat, 11 Mar 2023 09:13:01 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1678525981; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=OKrHor5UtcmXdWDmobcGzM6f0+2AjfssHrbhnQyGGkI=; b=MQJ2nyyKwlQwssdBYsvKTG1jRVGKTWMmqARIIA5WzJVbfnJ9pT/rgmH4xZdmho8Q8mFdBH t5GXvo9V5is3+6cJibRvrL0+uP3EDGa50htZNzmtIRMOaorb/4xHtBPab+0wBTNcO9AKau gKFwGlRvDgE+JU6hF6aniUIqw9CiOB+ynGlh4WvlKKoK/lIx/A2ZNT9OEHBJNBvfWgn6d1 GeDOYWGKsbujw9pEjiwYfBJfdlj8A6iOX9lcwGeed9/L1zVkbp2Wks9ogE7Y2SzYKUJ0o1 krMJ/8WkfjlDCmNShWLvWyH8mAZV2lPGnJzHxfzjxcS2Kv4WdwzT35c8xbBzYg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1678525981; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=OKrHor5UtcmXdWDmobcGzM6f0+2AjfssHrbhnQyGGkI=; b=vk/0b9l7lwWQRIf8/yxMZEVzc27ht1gAnPNa9L0t6N5wDMN0cBuXK+63lTFseXi90nrRi7 T8hteFt0i9W2ZgDYz4qipH1Er5U0zaR/K6uCuDpivf+Cm9uz2WDr3Smao3h4TWMRAG5yni Zs/x+jXRfnzfMYmtdGZmMSYgdC2ZhvVPUWiNyyVzTpRQ+9nYiwOQBqPSMcDLOhv4pIYTm6 pl086zHR6F1ufaeicJFQGBC4UK6aR//xdulQTKqMo8cukKOuj8+O8qnzC5YC19kA6SydDO J2ntI6Rcey7bc/RD8FBGfT9KRSTFwTEVNu+uoAlJTwc+EqbB7psuF0C8hU66Aw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1678525981; a=rsa-sha256; cv=none; b=tJSXfo691WPMRJw1q3FJCeFWoz0GoCG6sR5Gu+3g9tSmAKvdCZR9sHpAEa+xO5T4jeig5X 4HoJRPZSsZZu1CShUcnV1N1YubqQC7S3EhA2c4fC3gz+SqB3CV4WyHjotiDk6/R05DyaWn PbANnbCmmHrofPpDMSSnjRfxXiG99PXcoDlNfpvlxaXcfNHMy88sE6cYPECesL8DsZZhs1 I6+r5eiBRZsLmWZkjfZaSVfOH0pVSOu24jsjNFf55fTmlqxqq30rifv6nZBqX1i2INJbYb CvwvYc54Q5ycee6QvSwcRJGl0TGxOSAqTKNlgcK3Xd7crxq3mvXS6aCqc0S7pw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4PYcdn264TzPQt; Sat, 11 Mar 2023 09:13:01 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 32B9D1lk046844; Sat, 11 Mar 2023 09:13:01 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 32B9D1Z2046843; Sat, 11 Mar 2023 09:13:01 GMT (envelope-from git) Date: Sat, 11 Mar 2023 09:13:01 GMT Message-Id: <202303110913.32B9D1Z2046843@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Jochen Neumeister Subject: git: 5b8077cf7686 - main - security/vuxml: Document Apache httpd vulnerabilities List-Id: Commit messages for all branches of the ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-ports-all@freebsd.org X-BeenThere: dev-commits-ports-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: joneum X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 5b8077cf76862715de1c5015386ff297f1415f8e Auto-Submitted: auto-generated X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by joneum: URL: https://cgit.FreeBSD.org/ports/commit/?id=5b8077cf76862715de1c5015386ff297f1415f8e commit 5b8077cf76862715de1c5015386ff297f1415f8e Author: Jochen Neumeister AuthorDate: 2023-03-11 09:11:57 +0000 Commit: Jochen Neumeister CommitDate: 2023-03-11 09:12:55 +0000 security/vuxml: Document Apache httpd vulnerabilities Sponsored by: Netzkommune GmbH --- security/vuxml/vuln/2023.xml | 45 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) diff --git a/security/vuxml/vuln/2023.xml b/security/vuxml/vuln/2023.xml index f472d06003cb..632fba0a9f9c 100644 --- a/security/vuxml/vuln/2023.xml +++ b/security/vuxml/vuln/2023.xml @@ -1,3 +1,48 @@ + + Apache httpd -- Multiple vulnerabilities + + + apache24 + 2.4.56 + + + + +

The Apache httpd project reports:

+
+
    +
  • CVE-2023-27522: Apache HTTP Server: mod_proxy_uwsgi + HTTP response splitting (cve.mitre.org). + HTTP Response Smuggling vulnerability in Apache HTTP Server + via mod_proxy_uwsgi. This issue affects Apache HTTP Server: + from 2.4.30 through 2.4.55. + Special characters in the origin response header can + truncate/split the response forwarded to the client.
    • +
  • CVE-2023-25690: HTTP request splitting with mod_rewrite + and mod_proxy (cve.mitre.org). + Some mod_proxy configurations on Apache HTTP Server versions + 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. + Configurations are affected when mod_proxy is enabled along + with some form of RewriteRule or ProxyPassMatch in which a + non-specific pattern matches some portion of the user-supplied + request-target (URL) data and is then re-inserted into the + proxied request-target using variable substitution. +
    • +
+
+ + + + CVE-2023-25690 + CVE-2023-27522 + https://downloads.apache.org/httpd/CHANGES_2.4.56 + + + 2023-03-08 + 2023-03-11 + + + chromium -- multiple vulnerabilities