Apache HTTP Server: Mehrere Schwachstellen ermöglichen HTTP Response Splitting
WID-SEC-2023-0583 · first 08.03.2023 · updated 11.09.2026 · CVSS 9,8
What it is about
Apache ist ein Webserver für verschiedene Plattformen. Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apache HTTP Server ausnutzen, um einen Response Splitting Angriff durchzuführen.
Under what conditions?
Over the network and without logging in. This is the most dangerous combination: attackers can scan reachable devices automatically.
What can happen in the worst case
An attacker could use the vulnerability to
- einen Response Splitting Angriff durchzuführen
Am I affected?
Affected according to the BSI:
- Debian Linux
- IBM Tivoli Monitoring 6.3.0.7
- Amazon Linux 2
- IBM Rational ClearQuest
- Red Hat Enterprise Linux
- Fedora Linux
- Ubuntu Linux
- SUSE Linux
- IBM HTTP Server 8.5
- Oracle Linux
- IBM Security Access Manager for Enterprise Single Sign-On 8.2.1
- IBM Security Access Manager for Enterprise Single Sign-On 8.2.2
and 13 more
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Apache HTTP Server 2.4.56
- Dell NetWorker 19.9.0.1
- IBM Rational Build Forge 8.0.0.24
Is the vulnerability already being exploited?
- According to a CISA advisory, used by actors from North Korea: North Korea Cyber Group Conducts Global Espionage Campaign to Advance Regime’s Military and Nuclear Programs (07/2024)
Information and sources
- Original BSI advisory (WID)
- Apache HTTP Server 2.4 vulnerabilities vom 2023-03-07 httpd.apache.org
- Fedora Security Advisory FEDORA-2023-7D14CDEC4A vom 2023-03-09 bodhi.fedoraproject.org
- Fedora Security Advisory FEDORA-2023-54DAE7B78A vom 2023-03-09 bodhi.fedoraproject.org
- Fedora Security Advisory FEDORA-2023-7DF48F618B vom 2023-03-09 bodhi.fedoraproject.org
- Ubuntu Security Notice USN-5942-1 vom 2023-03-09 ubuntu.com
- IBM Security Bulletin 6963650 vom 2023-03-15 www.ibm.com
- SUSE Security Update SUSE-SU-2023:0764-1 vom 2023-03-16 lists.suse.com
- SUSE Security Update SUSE-SU-2023:0799-1 vom 2023-03-17 lists.suse.com
- Debian Security Advisory DSA-5376 vom 2023-03-20 lists.debian.org
- SUSE Security Update SUSE-SU-2023:0803-1 vom 2023-03-20 lists.suse.com
- IBM Security Bulletin 6964752 vom 2023-03-21 www.ibm.com
- Amazon Linux Security Advisory ALAS-2023-1989 vom 2023-03-22 alas.aws.amazon.com
- Ubuntu Security Notice USN-5942-2 vom 2023-03-22 ubuntu.com
- Amazon Linux Security Advisory ALAS-2023-1711 vom 2023-03-23 alas.aws.amazon.com
- SUSE Security Update SUSE-SU-2023:1573-1 vom 2023-03-24 lists.suse.com
- IBM Security Bulletin 6966602 vom 2023-03-28 www.ibm.com
- IBM Security Bulletin 6966866 vom 2023-03-29 www.ibm.com
- SUSE Security Update SUSE-SU-2023:1658-1 vom 2023-03-29 lists.suse.com
- Red Hat Security Advisory RHSA-2023:1547 vom 2023-04-04 access.redhat.com
- Red Hat Security Advisory RHSA-2023:1596 vom 2023-04-04 access.redhat.com
- Red Hat Security Advisory RHSA-2023:1593 vom 2023-04-04 access.redhat.com
- Red Hat Security Advisory RHSA-2023:1597 vom 2023-04-04 access.redhat.com
- Oracle Linux Security Advisory ELSA-2023-1593 vom 2023-04-05 linux.oracle.com
- Red Hat Security Advisory RHSA-2023:1670 vom 2023-04-07 access.redhat.com
- Red Hat Security Advisory RHSA-2023:1672 vom 2023-04-08 access.redhat.com
and 30 more sources in the original advisory
CVE: CVE-2023-25690, CVE-2023-27522
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.