Apache HTTP Server Buffer Over-Read Vulnerability via Outbound OCSP Requests

A buffer over-read vulnerability has been identified in Apache HTTP Server in versions 2.4.0 prior to 2.4.67. This vulnerability occurs in the mod_ssl component when the server makes outbound OCSP requests to an attacker-controlled OCSP server. The flaw can be exploited to read memory beyond the intended bounds, potentially leading to information disclosure or a crash of the server process.

Impact

Exploitation of this vulnerability causes a buffer over-read, which can lead to memory corruption, information disclosure, or a crash of the Apache HTTP Server process.

Remediation

Users are advised to upgrade to Apache HTTP Server version 2.4.68, which addresses this vulnerability.