Skip to content
Heist/ feed
Medium

Mod_proxy_cluster: mod_proxy_cluster unauthorized mcmp requests

Type: advisorySource: Official CVE List1 source record

A vulnerability was found in mod_proxy_cluster. The issue is that the directive should be replaced by the directive as the former does not restrict IP/host access as `Require ip IP_ADDRESS` would suggest. This means that anyone with access to the host might send MCMP requests that may result in adding/removing/updating nodes for the balancing. However, this host should not be accessible to the public network as it does not serve the general traffic.

Announced Source revision 1
Original source ↗

CVE-2024-10306

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2024-10306

Red Hat Enterprise Linux 10

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat Enterprise Linux 10

Source reference: /containers/cna/affected/2/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat Enterprise Linux 9

Source reference: /containers/cna/affected/3/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat Enterprise Linux 9

Source reference: /containers/cna/affected/4/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat Enterprise Linux 9.4 Extended Update Support

Source reference: /containers/cna/affected/5/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat JBoss Core Services 2.4.62

Source reference: /containers/cna/affected/6/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Red Hat JBoss Core Services

Source reference: /containers/cna/affected/7/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "versions": [
      {
        "status": "affected",
        "version": "1.3.17",
        "lessThan": "1.3.21.Final",
        "versionType": "semver"
      }
    ],
    "packageName": "mod_proxy_cluster",
    "collectionURL": "https://github.com/modcluster/mod_proxy_cluster",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:10.0"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 10",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:1.3.21-1.el10",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "mod_proxy_cluster",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:10.0"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 10",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:1.3.22-1.el10_0.2",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "mod_proxy_cluster",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:enterprise_linux:9::appstream"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 9",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:1.3.22-1.el9_5.2",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "mod_proxy_cluster",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:enterprise_linux:9::appstream"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 9",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:1.3.22-1.el9_6.1",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "mod_proxy_cluster",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:rhel_eus:9.4::appstream"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
    "versions": [
      {
        "status": "unaffected",
        "version": "0:1.3.22-1.el9_4.1",
        "lessThan": "*",
        "versionType": "rpm"
      }
    ],
    "packageName": "mod_proxy_cluster",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "affected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_core_services:1.0"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Core Services 2.4.62",
    "packageName": "mod_proxy_cluster",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:/a:redhat:jboss_core_services:1"
    ],
    "vendor": "Red Hat",
    "product": "Red Hat JBoss Core Services",
    "packageName": "jbcs-httpd24-mod_proxy_cluster",
    "collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2024-10306

Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event
#49280 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement