The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4431-1 advisory.

  - Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server:
    through 2.4.57. (CVE-2023-31122)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4430-1 advisory.

  - Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server:
    through 2.4.57. (CVE-2023-31122)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server:
    through 2.4.57. (CVE-2023-31122)

  - When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory     resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A     client could send new requests and resets, keeping the connection busy and open and causing the memory     footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run     out of memory before that. This was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid     Reset Exploit) with their own test client. During 'normal' HTTP/2 use, the probability to hit this bug is     very low. The kept memory would not become noticeable before the connection closes or times out. Users are     recommended to upgrade to version 2.4.58, which fixes the issue. (CVE-2023-45802)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server:
    through 2.4.57. (CVE-2023-31122)

  - When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory     resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A     client could send new requests and resets, keeping the connection busy and open and causing the memory     footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run     out of memory before that. This was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid     Reset Exploit) with their own test client. During 'normal' HTTP/2 use, the probability to hit this bug is     very low. The kept memory would not become noticeable before the connection closes or times out. Users are     recommended to upgrade to version 2.4.58, which fixes the issue. (CVE-2023-45802)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2278 advisory.

    The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

    Security Fix(es):

    * httpd: mod_macro: out-of-bounds read vulnerability (CVE-2023-31122)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-2278 advisory.

    - Resolves: RHEL-14447 - httpd: mod_macro: out-of-bounds read       vulnerability (CVE-2023-31122)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-3121 advisory.

    - Resolves: RHEL-14448 - httpd: mod_macro: out-of-bounds read       vulnerability (CVE-2023-31122)
    - Resolves: RHEL-29817 - httpd:2.4/mod_http2: httpd: CONTINUATION frames       DoS (CVE-2024-27316)
    - Resolves: RHEL-13367 - httpd:2.4/mod_http2: reset requests exhaust memory       (incomplete fix of CVE-2023-44487)(CVE-2023-45802)
    - Resolves: #2177748 - CVE-2023-25690 httpd:2.4/httpd: HTTP request splitting       with mod_rewrite and mod_proxy
    - Resolves: #2035030 - CVE-2021-44224 httpd:2.4/httpd: possible NULL dereference       or SSRF in forward proxy configurations
    - Resolves: #1966728 - CVE-2021-33193 httpd:2.4/mod_http2: httpd:
      Request splitting via HTTP/2 method injection and mod_proxy
    - Resolves: #1869077 - CVE-2020-11993 httpd:2.4/mod_http2: httpd:
      mod_http2 concurrent pool usage
    - Resolves: #1869073 - CVE-2020-9490 httpd:2.4/mod_http2: httpd:
      Push diary crash on specifically crafted HTTP/2 header
    - Resolves: #1747289 - CVE-2019-10082 httpd:2.4/mod_http2: httpd:
      read-after-free in h2 connection shutdown
    - Resolves: #1696099 - CVE-2019-0197 httpd:2.4/mod_http2: httpd:
      mod_http2: possible crash on late upgrade
    - Resolves: #1696094 - CVE-2019-0196 httpd:2.4/mod_http2: httpd:
      mod_http2: read-after-free on a string compare
    - Resolves: #1677591 - CVE-2018-17189 httpd:2.4/mod_http2: httpd:
      mod_http2: DoS via slow, unneeded request bodies
    - Resolves: #1744999 - CVE-2019-9511 httpd:2.4/mod_http2: HTTP/2: large amount       of data request leads to denial of service
    - Resolves: #1745086 - CVE-2019-9516 httpd:2.4/mod_http2: HTTP/2: 0-length       headers leads to denial of service
    - Resolves: #1745154 - CVE-2019-9517 httpd:2.4/mod_http2: HTTP/2: request for       large response leads to denial of service
    - Resolves: #1633401 - CVE-2018-11763 mod_http2: httpd:  DoS for HTTP/2       connections by continuous SETTINGS
    - update to 1.10.16 (CVE-2018-1302)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:3121 advisory.

    * httpd: mod_macro: out-of-bounds read vulnerability (CVE-2023-31122)

    * mod_http2: reset requests exhaust memory (incomplete fix of CVE-2023-44487) (CVE-2023-45802)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0217 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2023-31122:
    A flaw was found in the mod_macro module of httpd. When processing a very long macro, the null byte     terminator will not be added, leading to an out-of-bounds read, resulting in a crash.

    CVE-2023-45802:
    A flaw was found in mod_http2. When a HTTP/2 stream is reset (RST frame) by a client, there is a time     window were the request's memory resources were not reclaimed immediately. Instead, de-allocation was     deferred to connection close. A client could send new requests and resets, keeping the connection busy and     open, causing the memory footprint to keep on growing. On connection close, all resources are reclaimed     but the process might run out of memory before connection close.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the f923205f-6e66-11ee-85eb-84a93843eb75 advisory.

  - mod_macro buffer over-read: Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue     affects Apache HTTP Server: through 2.4.57. Acknowledgements: finder: David Shoon (github/davidshoon)     (CVE-2023-31122)

  - Apache HTTP Server: DoS in HTTP/2 with initial windows size 0: An attacker, opening a HTTP/2 connection     with an initial window size of 0, was able to block handling of that connection indefinitely in Apache     HTTP Server. This could be used to exhaust worker resources in the server, similar to the well known slow     loris attack pattern. This has been fixed in version 2.4.58, so that such connection are terminated     properly after the configured connection timeout. This issue affects Apache HTTP Server: from 2.4.55     through 2.4.57. Users are recommended to upgrade to version 2.4.58, which fixes the issue.
    Acknowledgements: (CVE-2023-43622)

  - Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST: When a HTTP/2 stream was reset     (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed     immediately. Instead, de-allocation was deferred to connection close. A client could send new requests and     resets, keeping the connection busy and open and causing the memory footprint to keep on growing. On     connection close, all resources were reclaimed, but the process might run out of memory before that. This     was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid Reset Exploit) with their own     test client. During normal HTTP/2 use, the probability to hit this bug is very low. The kept memory     would not become noticeable before the connection closes or times out. Users are recommended to upgrade to     version 2.4.58, which fixes the issue. Acknowledgements: (CVE-2023-45802)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of httpd installed on the remote host is prior to 2.4.58-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2322 advisory.

    Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server:
    through 2.4.57. (CVE-2023-31122)

    A flaw was found in httpd. This flaw allows an attacker opening an HTTP/2 connection with an initial     window size of 0 to block handling of that connection indefinitely in the Apache HTTP Server. This     vulnerability can exhaust worker resources in the server, similar to the well-known slow loris attack     pattern. (CVE-2023-43622)

    DescriptionA flaw was found in mod_http2. When a HTTP/2 stream is reset (RST frame) by a client, there is     a time window were the request's memory resources were not reclaimed immediately. Instead, de-allocation     was deferred to connection close. A client could send new requests and resets, keeping the connection busy     and open, causing the memory footprint to keep on growing. On connection close, all resources are     reclaimed but the process might run out of memory before connection close.

    StatementDuring normal HTTP/2 use, the probability of encountering this issue is very low. The kept     memory would not become noticeable before the connection closes or times out.

    MitigationMitigation for this issue is either not available or the currently available options don't meet     the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread     installation base or stability. (CVE-2023-45802)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5662 advisory.

  - Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server:
    through 2.4.57. (CVE-2023-31122)

  - Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators     to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58. (CVE-2023-38709)

  - An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of     that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the     server, similar to the well known slow loris attack pattern. This has been fixed in version 2.4.58, so     that such connection are terminated properly after the configured connection timeout. This issue affects     Apache HTTP Server: from 2.4.55 through 2.4.57. Users are recommended to upgrade to version 2.4.58, which     fixes the issue. (CVE-2023-43622)

  - When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory     resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A     client could send new requests and resets, keeping the connection busy and open and causing the memory     footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run     out of memory before that. This was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid     Reset Exploit) with their own test client. During normal HTTP/2 use, the probability to hit this bug is     very low. The kept memory would not become noticeable before the connection closes or times out. Users are     recommended to upgrade to version 2.4.58, which fixes the issue. (CVE-2023-45802)

  - HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject     malicious response headers into backend applications to cause an HTTP desynchronization attack. Users are     recommended to upgrade to version 2.4.59, which fixes this issue. (CVE-2024-24795)

  - HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an     informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.
    (CVE-2024-27316)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 7.02, has httpd packages installed that are affected by multiple vulnerabilities:

  - Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure,     SSRF or local script execution via backend applications whose response headers are malicious or     exploitable. Users are recommended to upgrade to version 2.4.60, which fixes this issue. (CVE-2024-38476)

  - Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server:
    through 2.4.57. (CVE-2023-31122)

  - An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of     that connection indefinitely in Apache HTTP Server. This could be used to exhaust worker resources in the     server, similar to the well known slow loris attack pattern. This has been fixed in version 2.4.58, so     that such connection are terminated properly after the configured connection timeout. This issue affects     Apache HTTP Server: from 2.4.55 through 2.4.57. Users are recommended to upgrade to version 2.4.58, which     fixes the issue. (CVE-2023-43622)

  - When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory     resources were not reclaimed immediately. Instead, de-allocation was deferred to connection close. A     client could send new requests and resets, keeping the connection busy and open and causing the memory     footprint to keep on growing. On connection close, all resources were reclaimed, but the process might run     out of memory before that. This was found by the reporter during testing of CVE-2023-44487 (HTTP/2 Rapid     Reset Exploit) with their own test client. During normal HTTP/2 use, the probability to hit this bug is     very low. The kept memory would not become noticeable before the connection closes or times out. Users are     recommended to upgrade to version 2.4.58, which fixes the issue. (CVE-2023-45802)

  - Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference,     leading to a crash of the server process, degrading performance. (CVE-2024-36387)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
185595	SUSE SLES15 Security Update : apache2 (SUSE-SU-2023:4431-1)	Nessus	SuSE Local Security Checks	2023/11/14	2024/4/11	high
185599	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : apache2 (SUSE-SU-2023:4430-1)	Nessus	SuSE Local Security Checks	2023/11/14	2024/4/11	high
188833	EulerOS 2.0 SP9 : httpd (EulerOS-SA-2023-3334)	Nessus	Huawei Local Security Checks	2024/1/16	2024/1/16	high
188851	EulerOS 2.0 SP10 : httpd (EulerOS-SA-2024-1061)	Nessus	Huawei Local Security Checks	2024/1/16	2024/1/16	high
192355	EulerOS Virtualization 2.11.1 : httpd (EulerOS-SA-2024-1400)	Nessus	Huawei Local Security Checks	2024/3/21	2024/3/21	high
194812	RHEL 9 : httpd (RHSA-2024:2278)	Nessus	Red Hat Local Security Checks	2024/4/30	2024/11/7	high
195034	Oracle Linux 9 : httpd (ELSA-2024-2278)	Nessus	Oracle Linux Local Security Checks	2024/5/6	2025/9/9	high
198007	Oracle Linux 8 : httpd:2.4 (ELSA-2024-3121)	Nessus	Oracle Linux Local Security Checks	2024/5/28	2025/9/9	high
200577	Rocky Linux 8 : httpd:2.4 (RLSA-2024:3121)	Nessus	Rocky Linux Local Security Checks	2024/6/14	2024/6/14	high
238741	TencentOS Server 3: httpd:2.4 (TSSA-2024:0217)	Nessus	Tencent Local Security Checks	2025/6/16	2025/12/4	high
183404	FreeBSD : Apache httpd -- Multiple vulnerabilities (f923205f-6e66-11ee-85eb-84a93843eb75)	Nessus	FreeBSD Local Security Checks	2023/10/19	2024/4/11	high
184280	Amazon Linux 2 : httpd (ALAS-2023-2322)	Nessus	Amazon Linux Local Security Checks	2023/11/2	2024/12/11	high
193369	Debian dsa-5662 : apache2 - security update	Nessus	Debian Local Security Checks	2024/4/16	2024/7/12	high
242800	NewStart CGSL MAIN 7.02 : httpd Multiple Vulnerabilities (NS-SA-2025-0132)	Nessus	NewStart CGSL Local Security Checks	2025/7/25	2025/7/25	critical

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

critical