Information Exposure The advisory has been revoked - it doesn't affect any version of package apache2 (opens in a new tab)

Threat Intelligence

9.63% (95^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk IDSNYK-UBUNTU1204-APACHE2-644162
published10 Sept 2020
disclosed22 Aug 2012

Report a new vulnerability Found a mistake?

Introduced: 22 Aug 2012

CVE-2012-3502 (opens in a new tab) CWE-200 (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:12.04.

NVD Description

Note: Versions mentioned in the description apply only to the upstream apache2 package and not the apache2 package as distributed by Ubuntu.

The proxy functionality in (1) mod_proxy_ajp.c in the mod_proxy_ajp module and (2) mod_proxy_http.c in the mod_proxy_http module in the Apache HTTP Server 2.4.x before 2.4.3 does not properly determine the situations that require closing a back-end connection, which allows remote attackers to obtain sensitive information in opportunistic circumstances by reading a response that was intended for a different client.