Detections
Analytics

Echo: apache2: security update to 2.4.67-1~deb11u3

medium Tenable Self-Hosted Container Security Plugin ID 460084

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - A cross-site scripting vulnerability exists in mod_proxy_ftp's HTML directory list generation in Apache
 HTTP Server 2.4.67 and earlier when listing FTP directory contents either via forward or reverse proxy
 configuration. Users are recommended to upgrade to version 2.4.68, which fixes this issue.
 (CVE-2026-29170)

Solution

Update the apache2 library and its related packages to version 2.4.67-1~deb11u3 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-29170

Plugin Details

Severity: Medium

ID: 460084

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 9.53

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2026-29170

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/9/2026

Vulnerability Publication Date: 6/8/2026

Reference Information

CVE: CVE-2026-29170

IAVA: 2026-A-0558