| Package | Affected versions | Patched versions |
|---|---|---|
| http server | ≥ 2.4.20, < 2.4.46 | 2.4.46 |
| communications element manager | ≥ 8.2.0, ≤ 8.2.2 | |
| communications session report manager | ≥ 8.2.0, ≤ 8.2.2 | |
| communications session route manager | ≥ 8.2.0, ≤ 8.2.2 | |
| enterprise manager ops center | = 12.4.0.0 | |
| hyperion infrastructure technology | = 11.1.2.4 | |
| instantis enterprisetrack | = 17.1= 17.2= 17.3 | |
| zfs storage appliance kit | = 8.8 | |
| openstack | = 16.1 | |
| openstack for ibm power | = 16.1 | |
| software collections | = 1.0 |
Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via "H2Push off" will mitigate this vulnerability for unpatched servers.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free