Homepage

Information Exposure The advisory has been revoked - it doesn't affect any version of package apache2  (opens in a new tab)

Threat Intelligence

EPSS
9.63% (95th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIANUNSTABLE-APACHE2-599048
  • published19 Aug 2020
  • disclosed22 Aug 2012
Report a new vulnerability Found a mistake?

Introduced: 22 Aug 2012

CVE-2012-3502  (opens in a new tab)
CWE-200  (opens in a new tab)

Amendment

The Debian security team deemed this advisory irrelevant for Debian:unstable.

NVD Description

Note: Versions mentioned in the description apply only to the upstream apache2 package and not the apache2 package as distributed by Debian.

The proxy functionality in (1) mod_proxy_ajp.c in the mod_proxy_ajp module and (2) mod_proxy_http.c in the mod_proxy_http module in the Apache HTTP Server 2.4.x before 2.4.3 does not properly determine the situations that require closing a back-end connection, which allows remote attackers to obtain sensitive information in opportunistic circumstances by reading a response that was intended for a different client.

References