CVE-2024-24795: apache http server +6 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2024-24795

CVSS 6.3 · Medium EPSS 2,9%

Kerentanan Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') pada apache http server, debian linux +5 lainnya. Skor CVSS 3.1 6.3 (Medium) menurut CISA ADP.

Deskripsi (NVD)

HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack. Users are recommended to upgrade to version 2.4.59, which fixes this issue.

Rincian

Terbit di NVD: 4 April 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 6.3 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
EPSS (30 hari): 2,9% peluang dieksploitasi; lebih tinggi dari 86,4% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
apache	http server	Versi 2.4.0 hingga sebelum 2.4.59
debian	debian linux	Versi 10.0
fedoraproject	fedora	Versi 38
fedoraproject	fedora	Versi 39
fedoraproject	fedora	Versi 40
netapp	ontap	Versi 9
netapp	ontap tools	Versi 10
broadcom	fabric operating system	Semua versi
apple	macos	Semua versi sebelum 14.6

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://httpd.apache.org/security/vulnerabilities_24.html release notes · advisory vendor
https://lists.debian.org/debian-lts-announce/2024/05/msg00013.html mailing list · advisory pihak ketiga
https://lists.debian.org/debian-lts-announce/2024/05/msg00014.html mailing list · advisory pihak ketiga
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I2N2NZEX3MR64IW... advisory pihak ketiga
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LX5U34KYGDYPRH3... advisory pihak ketiga
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WNV4SZAPVS43DZW... advisory pihak ketiga
https://security.netapp.com/advisory/ntap-20240415-0013/ advisory pihak ketiga
https://support.apple.com/kb/HT214119 advisory pihak ketiga
http://seclists.org/fulldisclosure/2024/Jul/18 mailing list
http://www.openwall.com/lists/oss-security/2024/04/04/5 mailing list

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.