CVE-2011-3639
NoneCVSS
—
EPSS
49.7%
Published
Nov 30, 2011
CISA due date
—
The record
The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers by using the HTTP/0.9 protocol with a malformed URI containing an initial @ (at sign) character. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | apache2 | 0 | 2.2.18-1 |
| Debian:12 | apache2 | 0 | 2.2.18-1 |
| Debian:13 | apache2 | 0 | 2.2.18-1 |
| Debian:5.0 | apache2 | 0 | 2.2.9-10+lenny12 |
| Debian:6.0 | apache2 | 0 | 2.2.16-6+squeeze6 |
| Red Hat:enterprise_linux:5::client | httpd | 0 | 0:2.2.3-63.el5_8.1 |
| Red Hat:enterprise_linux:5::client | httpd-debuginfo | 0 | 0:2.2.3-63.el5_8.1 |
| Red Hat:enterprise_linux:5::client | httpd-devel | 0 | 0:2.2.3-63.el5_8.1 |
| Red Hat:enterprise_linux:5::client | httpd-manual | 0 | 0:2.2.3-63.el5_8.1 |
| Red Hat:enterprise_linux:5::client | mod_ssl | 0 | 1:2.2.3-63.el5_8.1 |
| Red Hat:enterprise_linux:5::client_workstation | httpd | 0 | 0:2.2.3-63.el5_8.1 |
| Red Hat:enterprise_linux:5::client_workstation | httpd-debuginfo | 0 | 0:2.2.3-63.el5_8.1 |
| Red Hat:enterprise_linux:5::client_workstation | httpd-devel | 0 | 0:2.2.3-63.el5_8.1 |
| Red Hat:enterprise_linux:5::client_workstation | httpd-manual | 0 | 0:2.2.3-63.el5_8.1 |
| Red Hat:enterprise_linux:5::client_workstation | mod_ssl | 0 | 1:2.2.3-63.el5_8.1 |
| Red Hat:enterprise_linux:5::server | httpd | 0 | 0:2.2.3-63.el5_8.1 |
| Red Hat:enterprise_linux:5::server | httpd-debuginfo | 0 | 0:2.2.3-63.el5_8.1 |
| Red Hat:enterprise_linux:5::server | httpd-devel | 0 | 0:2.2.3-63.el5_8.1 |
| Red Hat:enterprise_linux:5::server | httpd-manual | 0 | 0:2.2.3-63.el5_8.1 |
| Red Hat:enterprise_linux:5::server | mod_ssl | 0 | 1:2.2.3-63.el5_8.1 |
| Red Hat:enterprise_linux:6::client | httpd | 0 | 0:2.2.15-15.el6_2.1 |
| Red Hat:enterprise_linux:6::client | httpd-debuginfo | 0 | 0:2.2.15-15.el6_2.1 |
| Red Hat:enterprise_linux:6::client | httpd-devel | 0 | 0:2.2.15-15.el6_2.1 |
| Red Hat:enterprise_linux:6::client | httpd-manual | 0 | 0:2.2.15-15.el6_2.1 |
| Red Hat:enterprise_linux:6::client | httpd-tools | 0 | 0:2.2.15-15.el6_2.1 |
| Red Hat:enterprise_linux:6::client | mod_ssl | 0 | 1:2.2.15-15.el6_2.1 |
| Red Hat:enterprise_linux:6::computenode | httpd | 0 | 0:2.2.15-15.el6_2.1 |
| Red Hat:enterprise_linux:6::computenode | httpd-debuginfo | 0 | 0:2.2.15-15.el6_2.1 |
| Red Hat:enterprise_linux:6::computenode | httpd-devel | 0 | 0:2.2.15-15.el6_2.1 |
| Red Hat:enterprise_linux:6::computenode | httpd-manual | 0 | 0:2.2.15-15.el6_2.1 |
| Red Hat:enterprise_linux:6::computenode | httpd-tools | 0 | 0:2.2.15-15.el6_2.1 |
| Red Hat:enterprise_linux:6::computenode | mod_ssl | 0 | 1:2.2.15-15.el6_2.1 |
| Red Hat:enterprise_linux:6::server | httpd | 0 | 0:2.2.15-15.el6_2.1 |
| Red Hat:enterprise_linux:6::server | httpd-debuginfo | 0 | 0:2.2.15-15.el6_2.1 |
| Red Hat:enterprise_linux:6::server | httpd-devel | 0 | 0:2.2.15-15.el6_2.1 |
| Red Hat:enterprise_linux:6::server | httpd-manual | 0 | 0:2.2.15-15.el6_2.1 |
| Red Hat:enterprise_linux:6::server | httpd-tools | 0 | 0:2.2.15-15.el6_2.1 |
| Red Hat:enterprise_linux:6::server | mod_ssl | 0 | 1:2.2.15-15.el6_2.1 |
| Red Hat:enterprise_linux:6::workstation | httpd | 0 | 0:2.2.15-15.el6_2.1 |
| Red Hat:enterprise_linux:6::workstation | httpd-debuginfo | 0 | 0:2.2.15-15.el6_2.1 |
| Red Hat:enterprise_linux:6::workstation | httpd-devel | 0 | 0:2.2.15-15.el6_2.1 |
| Red Hat:enterprise_linux:6::workstation | httpd-manual | 0 | 0:2.2.15-15.el6_2.1 |
| Red Hat:enterprise_linux:6::workstation | httpd-tools | 0 | 0:2.2.15-15.el6_2.1 |
| Red Hat:enterprise_linux:6::workstation | mod_ssl | 0 | 1:2.2.15-15.el6_2.1 |
Related vulnerabilities
- CVE-2017-9798 Apache httpd allows remote attackers to read secret data from process memory if the Limit… Also affects apache2
- CVE-2016-0736 In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its… Also affects apache2
- CVE-2016-2161 In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can… Also affects apache2
- CVE-2016-8743 Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the… Also affects apache2
- CVE-2017-7659 A maliciously constructed HTTP/2 request could cause mod_http2 in Apache HTTP Server… Also affects apache2
- CVE-2017-9788 In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in… Also affects apache2
- CVE-2017-7679 In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte… Also affects apache2
- CVE-2017-7668 The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug… Also affects apache2