medium
advisory
Apache HTTP Server: Multiple vulnerabilities
Multiple undisclosed vulnerabilities have been identified in Apache HTTP Server versions prior to 2.4.70, necessitating an immediate upgrade to the latest version.
Triage facts
Revision 1- Applicability
- HTTP Server (< 2.4.70)
- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 9, 16:12 UTC
- Source quality
- A1Likely
The Apache Software Foundation has released version 2.4.70 of the Apache HTTP Server to address multiple security vulnerabilities. The vendor has not disclosed specific details regarding the vulnerability classes or impact at this time. Administrators are advised to update to the latest version as documented in the official changelog.
Recommendation
- Inventory all internal and internet-facing assets running Apache HTTP Server.
- Upgrade all instances of Apache HTTP Server to version 2.4.70 or later immediately.
- Monitor the Apache HTTP Server official changelog for future technical disclosures regarding the vulnerabilities addressed in this release.
Mitigations
Upgrade Apache HTTP Server to version 2.4.70 or later
immediate
IT Operations
Apache HTTP Server (< 2.4.70)