Common Vulnerabilities and Exposures assigned an identifier CVE-2010-2068 to
the following vulnerability:
mod_proxy_http.c in mod_proxy_http in the Apache HTTP Server 2.2.9 through
2.2.15, 2.3.4-alpha, and 2.3.5-alpha on Windows, NetWare, and OS/2, in
certain configurations involving proxy worker pools, does not properly
detect timeouts, which allows remote attackers to obtain a potentially
sensitive response intended for a different client in opportunistic
circumstances via a normal HTTP request.
More information from upstream changeset :
Only affects mod_proxy_http.c on Windows, Netware and OS2 platforms.
Is only triggered by proxy pools configured for timeouts shorter than the
backend server response delay.
Only affects httpd versions 2.2.9 through 2.2.15, 2.3.4-alpha, 2.3.5-alpha.
Note that versions prior to 2.2.9 were not affected, including 1.3 and 2.0,
as the proxy worker pool feature was not yet introduced.
The straightforward workaround to disable mod_proxy_http's reuse of backend
connection pipelines is to set the following global directive;
SetEnv proxy-nokeepalive 1
This workaround bypasses all ProxyPass/ProxySet pool options which trigger
connection pipelines, allowing them to remain in the configuration file
until the patched module can be deployed.
This issue affects the versions of the httpd package, as shipped
with JBoss Enterprise Web Server v1.0.1 for Microsoft Windows
Other versions of the httpd package, as shipped within various
Red Hat products are NOT affected by this issue.
This issue has been addressed in following products:
JBoss Enterprise Web Server 1.0
Via RHSA-2011:0896 https://rhn.redhat.com/errata/RHSA-2011-0896.html