Detections
Analytics
CentOS 9 : httpd-2.4.53-11.el9
critical Nessus Plugin ID 191162
Language:
Synopsis
The remote CentOS host is missing one or more security updates for httpd.Description
The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the httpd-2.4.53-11.el9 build changelog.- out-of-bounds read/write of zero byte (CVE-2006-20001)
- Possible request smuggling (CVE-2022-36760)
- HTTP response splitting (CVE-2022-37436)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the CentOS 9 Stream httpd package.See Also
https://kojihub.stream.centos.org/koji/buildinfo?buildID=29905
Plugin Details
Severity: Critical
ID: 191162
File Name: centos9_httpd-2_4_53-11.nasl
Version: 1.1
Type: local
Agent: unix
Family: CentOS Local Security Checks
Published: 2/29/2024
Updated: 4/26/2024
Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.5
CVSS v2
Risk Factor: High
Base Score: 7.6
Temporal Score: 5.6
Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2022-36760
CVSS v3
Risk Factor: Critical
Base Score: 9
Temporal Score: 7.8
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:centos:centos:httpd-filesystem, cpe:/a:centos:centos:9, p-cpe:/a:centos:centos:httpd, p-cpe:/a:centos:centos:mod_ldap, p-cpe:/a:centos:centos:httpd-manual, p-cpe:/a:centos:centos:httpd-tools, p-cpe:/a:centos:centos:mod_session, p-cpe:/a:centos:centos:mod_ssl, p-cpe:/a:centos:centos:mod_lua, p-cpe:/a:centos:centos:httpd-core, p-cpe:/a:centos:centos:httpd-devel, p-cpe:/a:centos:centos:mod_proxy_html
Required KB Items: Host/local_checks_enabled, Host/CentOS/release, Host/CentOS/rpm-list, Host/cpu
Exploit Ease: No known exploits are available
Patch Publication Date: 1/31/2023
Vulnerability Publication Date: 1/10/2023