CVE-2024-47252: Apache HTTP Server: mod_ssl error log variable escaping
Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%{varname}x" or "%{varname}c" to log variables provided by mod_ssl such as SSL_TLS_SNI, no escaping is performed by either mod_log_config or mod_ssl and unsanitized data provided by the client may appear in log files.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47252?
CVE-2024-47252 has been classified as a moderate severity vulnerability.
How do I fix CVE-2024-47252?
To fix CVE-2024-47252, upgrade to Apache HTTP Server version 2.4.64 or later, which includes patches for this vulnerability.
What impact does CVE-2024-47252 have on my Apache server?
CVE-2024-47252 allows untrusted SSL/TLS clients to manipulate log files, potentially leading to misleading information in logs.
What versions of Apache HTTP Server are affected by CVE-2024-47252?
CVE-2024-47252 affects Apache HTTP Server versions 2.4.63 and earlier.
Is CVE-2024-47252 related to SSL/TLS security?
Yes, CVE-2024-47252 involves insufficient escaping of user-supplied data in the context of SSL/TLS clients.