CVE-2015-3185

描述

The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an authorization setting rather than an authentication setting, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging the presence of a module that relies on the 2.2 API behavior.

如何修補 CVE-2015-3185

要修補 CVE-2015-3185,請將受影響套件升級到下列已修補版本。

• Debian/apache2—升級至 2.4.16-1 或更新版本

CVE-2015-3185 正在被利用嗎?

中等 — EPSS 為 18.8%,可持續追蹤但非最高優先。

受影響套件(1)

• from 0, < 2.4.16-1

參考連結(1)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2015-3185