According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject     malicious response headers into backend applications to cause an HTTP desynchronization attack.Users are     recommended to upgrade to version 2.4.59, which fixes this issue.(CVE-2024-24795)

    Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators     to split HTTP responses.This issue affects Apache HTTP Server: through 2.4.58.(CVE-2023-38709)

    HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an     informative HTTP 413 response. If a client does not stop sending headers, this leads to memory     exhaustion.(CVE-2024-27316)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization httpd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of httpd installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-24795 advisory.

  - HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject     malicious response headers into backend applications to cause an HTTP desynchronization attack. Users are     recommended to upgrade to version 2.4.59, which fixes this issue. (CVE-2024-24795)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:3861-1 advisory.

    - CVE-2024-24795: Fixed HTTP Response Splitting in multiple modules (bsc#1222332)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of httpd installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-24795 advisory.

  - HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject     malicious response headers into backend applications to cause an HTTP desynchronization attack. Users are     recommended to upgrade to version 2.4.59, which fixes this issue. (CVE-2024-24795)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1963-1 advisory.

    - CVE-2023-38709: Fixed HTTP response splitting (bsc#1222330).
    - CVE-2024-24795: Fixed HTTP response splitting in multiple modules (bsc#1222332).
    - CVE-2024-27316: Fixed HTTP/2 CONTINUATION frames can be utilized for DoS attacks (bsc#1221401).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1788-1 advisory.

    - CVE-2023-38709: Fixed faulty input validation inside the HTTP response splitting code (bsc#1222330).
    - CVE-2024-24795: Fixed handling of malicious HTTP splitting response headers in multiple modules     (bsc#1222332).
    - CVE-2024-27316: Fixed HTTP/2 CONTINUATION frames that could have been utilized for DoS attacks     (bsc#1221401).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6729-1 advisory.

    Orange Tsai discovered that the Apache HTTP Server incorrectly handled validating certain input. A remote     attacker could possibly use this issue to perform HTTP request splitting attacks. (CVE-2023-38709)

    Keran Mu and Jianjun Chen discovered that the Apache HTTP Server incorrectly handled validating certain     input. A remote attacker could possibly use this issue to perform HTTP request splitting attacks.
    (CVE-2024-24795)

    Bartek Nowotarski discovered that the Apache HTTP Server HTTP/2 module incorrectly handled endless     continuation frames. A remote attacker could possibly use this issue to cause the server to consume     resources, leading to a denial of service. (CVE-2024-27316)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS. host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6729-3 advisory.

    USN-6729-1 fixed vulnerabilities in Apache HTTP Server. This update provides the corresponding updates for     Ubuntu 24.04 LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-d0dccd6b96 advisory.

    This update includes `httpd` version **2.4.59**, fixing various security issues and bugs. See     https://downloads.apache.org/httpd/CHANGES_2.4.59 for complete details of the changes in this release.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
206518	EulerOS Virtualization 2.12.1 : httpd (EulerOS-SA-2024-2307)	Nessus	Huawei Local Security Checks	9/3/2024	9/3/2024	high
205665	CBL Mariner 2.0 Security Update: httpd (CVE-2024-24795)	Nessus	MarinerOS Local Security Checks	8/16/2024	2/10/2025	medium
210113	SUSE SLES15: apache2-mod_uwsgi / uwsgi / uwsgi-emperor_pg / uwsgi-emperor_zeromq / etc (SUSE-SU-2024:3861-1)	Nessus	SuSE Local Security Checks	11/2/2024	6/26/2026	medium
215248	Azure Linux 3.0 Security Update: httpd (CVE-2024-24795)	Nessus	Azure Linux Local Security Checks	2/10/2025	9/15/2025	medium
200297	SUSE SLED15: apache2 / apache2-devel / apache2-event / apache2-manual / etc (SUSE-SU-2024:1963-1)	Nessus	SuSE Local Security Checks	6/11/2024	6/26/2026	high
197946	SUSE SLES15: apache2 / apache2-devel / apache2-doc / apache2-prefork / etc (SUSE-SU-2024:1788-1)	Nessus	SuSE Local Security Checks	5/28/2024	6/26/2026	high
193232	Ubuntu 20.04 LTS / 22.04 LTS / 23.10 : Apache HTTP Server vulnerabilities (USN-6729-1)	Nessus	Ubuntu Local Security Checks	4/11/2024	8/27/2024	high
194728	Ubuntu 24.04 LTS. : Apache HTTP Server vulnerabilities (USN-6729-3)	Nessus	Ubuntu Local Security Checks	4/29/2024	10/29/2024	high
194937	Fedora 39 : httpd (2024-d0dccd6b96)	Nessus	Fedora Local Security Checks	5/2/2024	11/14/2024	high

Detections

Analytics

Plugins Search

high

medium

medium

medium

high

high

high

high

high