[Debian] High CVE: CVE-2023-31122/CVE-2023-38709/.../CVE-2024-24795/CVE-2024-27316 apache2 : multiple CVEs

[Yue Tao]

CVE-2023-31122: https://nvd.nist.gov/vuln/detail/CVE-2023-31122

Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57.

CVE-2023-38709: https://nvd.nist.gov/vuln/detail/CVE-2023-38709

Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58.

CVE-2023-43622: https://nvd.nist.gov/vuln/detail/CVE-2023-43622

An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known "slow loris" attack pattern. This has been fixed in version 2.4.58, so that such connection are terminated properly after the configured connection timeout. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.57. Users are recommended to upgrade to version 2.4.58, which fixes the issue.

CVE-2023-45802: https://nvd.nist.gov/vuln/detail/CVE-2023-45802

When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run out of memory before that. This was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with their own test client. During "normal" HTTP/2 use, the probability to hit this bug is very low. The kept memory would not become noticeable before the connection closes or times out. Users are recommended to upgrade to version 2.4.58, which fixes the issue.

CVE-2024-24795: https://nvd.nist.gov/vuln/detail/CVE-2024-24795

HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack. Users are recommended to upgrade to version 2.4.59, which fixes this issue.

CVE-2024-27316: https://nvd.nist.gov/vuln/detail/CVE-2024-27316

HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.

Base Score: High

Reference:

['apache2_2.4.56-1~deb11u1_amd64.deb===>apache2_2.4.59-1~deb11u1_amd64.deb', 'apache2-bin_2.4.56-1~deb11u1_amd64.deb===>apache2-bin_2.4.59-1~deb11u1_amd64.deb', 'apache2-data_2.4.56-1~deb11u1_all.deb===>apache2-data_2.4.59-1~deb11u1_all.deb', 'apache2-utils_2.4.56-1~deb11u1_amd64.deb===>apache2-utils_2.4.59-1~deb11u1_amd64.deb']
https://security-tracker.debian.org/tracker/DSA-5662-1

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/c/starlingx/tools/+/917288

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/starlingx/tools/+/917288
Committed: https://opendev.org/starlingx/tools/commit/7c759a476492537b9714512c00bc544083bce213
Submitter: "Zuul (22348)"
Branch: master

commit 7c759a476492537b9714512c00bc544083bce213
Author: Wentao Zhang <email address hidden>
Date: Mon Apr 22 19:21:07 2024 -0700

    Debian: apache2 : fix multiple CVEs

    Upgrade apache2 to 2.4.59-1~deb11u1
    Upgrade apache2-bin to 2.4.59-1~deb11u1
    Upgrade apache2-data to 2.4.59-1~deb11u1
    Upgrade apache2-utils to 2.4.59-1~deb11u1

    Refer to:
    CVE-2023-31122: https://nvd.nist.gov/vuln/detail/CVE-2023-31122
    CVE-2023-38709: https://nvd.nist.gov/vuln/detail/CVE-2023-38709
    CVE-2023-43622: https://nvd.nist.gov/vuln/detail/CVE-2023-43622
    CVE-2023-45802: https://nvd.nist.gov/vuln/detail/CVE-2023-45802
    CVE-2024-24795: https://nvd.nist.gov/vuln/detail/CVE-2024-24795
    CVE-2024-27316: https://nvd.nist.gov/vuln/detail/CVE-2024-27316
    https://security-tracker.debian.org/tracker/DSA-5662-1

    Test Plan:
    Pass: downloader
    Pass: build-pkgs --clean --all
    Pass: build-image
    Pass: boot

    Closes-bug: #2063187

    Change-Id: I6a9b350bf11236a2dbea8954d24585bcee9fcb88
    Signed-off-by: Wentao Zhang <email address hidden>