CVE-2009-1890
Fixed in a distro release EPSS 16%
The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests.
Products: apache http_server, fedoraproject fedora, debian_linux, canonical ubuntu_linux, redhat enterprise_linux_desktop, redhat enterprise_linux_eus, redhat enterprise_linux_server, redhat enterprise_linux_server_aus, redhat enterprise_linux_workstation
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | apache2 | 2.2.11-7 |
| Debian 13 | apache2 | 2.2.11-7 |
| Debian 14 | apache2 | 2.2.11-7 |
| Debian 4.0 | apache2 | 2.2.3-4+etch9 |
| Debian 5.0 | apache2 | 2.2.9-10+lenny4 |
| Red Hat Enterprise Linux 5 | httpd | 0:2.2.3-22.el5_3.2 |
| Red Hat Enterprise Linux 5 | httpd-debuginfo | 0:2.2.3-22.el5_3.2 |
| Red Hat Enterprise Linux 5 | httpd-devel | 0:2.2.3-22.el5_3.2 |
| Red Hat Enterprise Linux 5 | httpd-manual | 0:2.2.3-22.el5_3.2 |
| Red Hat Enterprise Linux 5 | mod_ssl | 1:2.2.3-22.el5_3.2 |
| Red Hat jboss enterprise web server 1 | httpd | 0:2.2.10-10.ep5.el5 |
| Red Hat jboss enterprise web server 1 | httpd-devel | 0:2.2.10-10.ep5.el5 |
| Red Hat jboss enterprise web server 1 | httpd-manual | 0:2.2.10-10.ep5.el5 |
| Red Hat jboss enterprise web server 1 | httpd22 | 0:2.2.10-23.1.ep5.el4 |
| Red Hat jboss enterprise web server 1 | httpd22-apr | 0:2.2.10-23.1.ep5.el4 |
| Red Hat jboss enterprise web server 1 | httpd22-apr-devel | 0:2.2.10-23.1.ep5.el4 |
| Red Hat jboss enterprise web server 1 | httpd22-apr-util | 0:2.2.10-23.1.ep5.el4 |
| Red Hat jboss enterprise web server 1 | httpd22-apr-util-devel | 0:2.2.10-23.1.ep5.el4 |
| Red Hat jboss enterprise web server 1 | httpd22-debuginfo | 0:2.2.10-23.1.ep5.el4 |
| Red Hat jboss enterprise web server 1 | httpd22-devel | 0:2.2.10-23.1.ep5.el4 |
| Red Hat jboss enterprise web server 1 | mod_ssl | 1:2.2.10-10.ep5.el5 |
| Red Hat jboss enterprise web server 1 | mod_ssl22 | 1:2.2.10-23.1.ep5.el4 |
| Red Hat rhel application stack 2 | httpd | 0:2.2.11-3.el5s2 |
| Red Hat rhel application stack 2 | httpd-debuginfo | 0:2.2.11-3.el5s2 |
| Red Hat rhel application stack 2 | httpd-devel | 0:2.2.11-3.el5s2 |
| Red Hat rhel application stack 2 | httpd-manual | 0:2.2.11-3.el5s2 |
| Red Hat rhel application stack 2 | mod_ssl | 1:2.2.11-3.el5s2 |
| openSUSE Tumbleweed | apache2 | 2.4.23-4.1 |