Bug 2176211 (CVE-2023-27522)

Summary:	CVE-2023-27522 httpd: mod_proxy_uwsgi HTTP response splitting
Product:	[Other] Security Response	Reporter:	Mauro Matteo Cascella <mcascell>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	asoldano, bbaranow, bdettelb, bmaxwell, brian.stansberry, caswilli, cdewolf, chazlett, csutherl, darran.lofthouse, dkreling, dosoudil, fjuma, hhorak, ivassile, iweiss, jburrell, jclere, jkoehler, jorton, kaycoth, kyoshida, lgao, luhliari, micjohns, mosmerov, msochure, msvehla, mturk, nbhumkar, nwallace, pablomiguelcj, peholase, pjindal, plodge, pmackay, rstancel, ryan.brothers, smaestri, sthirugn, szappis, tom.jenkinson, xili, zac.carius
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	httpd 2.4.56	Doc Type:	If docs needed, set a value
Doc Text:	An HTTP Response Smuggling vulnerability was found in the Apache HTTP Server via mod_proxy_uwsgi. This security issue occurs when special characters in the origin response header can truncate or split the response forwarded to the client.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-08-15 21:54:16 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2176723, 2176724, 2176720
Bug Blocks:	2176202

Description Mauro Matteo Cascella 2023-03-07 16:22:49 UTC

HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special characters in the origin response header can truncate/split the response forwarded to the client.

References:
https://httpd.apache.org/security/vulnerabilities_24.html
https://www.openwall.com/lists/oss-security/2023/03/07/2

Comment 2 Sandipan Roy 2023-03-09 04:15:37 UTC

Created httpd tracking bugs for this issue:

Affects: fedora-all [bug 2176720]

Comment 4 ryan.brothers 2023-05-09 14:51:10 UTC

Is there a timeline for when this will be patched in RHEL9?

Comment 5 Luboš Uhliarik 2023-05-25 15:38:14 UTC

We will probably fix it in the next RHEL-9 release.(In reply to ryan.brothers from comment #4)
> Is there a timeline for when this will be patched in RHEL9?

We will probably fix it in the next RHEL-9 release.

Comment 6 pablomiguelcj 2023-05-26 13:22:37 UTC

Hy,
for RHEL-8 there a RHSA to address the CVE-2023-27522 ?
thks

Comment 12 errata-xmlrpc 2023-08-15 17:37:15 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Core Services

Via RHSA-2023:4628 https://access.redhat.com/errata/RHSA-2023:4628

Comment 13 errata-xmlrpc 2023-08-15 17:40:49 UTC

This issue has been addressed in the following products:

  JBoss Core Services on RHEL 7
  JBoss Core Services for RHEL 8

Via RHSA-2023:4629 https://access.redhat.com/errata/RHSA-2023:4629

Comment 14 Product Security DevOps Team 2023-08-15 21:54:12 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-27522