Configuration in mod_proxy_cluster - CVE-2024-10306

Vulnerability identifier: #VU112127

CSH Severity: Medium

CVSS v4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-10306

CWE-ID: CWE-16

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The issue may allow a remote attacker to gain unauthorized access to the module.

The issue exists due to the <Directory> cannot be used to restricted IP/host access, as described in the documentation.  A remote attacker can gain unauthorized access to the application. 

mod_proxy_cluster
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
cluster (Red Hat package)

Update your module configuration and replace the <Directory> directive with <Location> directive.

cluster (Red Hat package) - addressed in versions 1.3.22-1.el9_4.1, 1.3.22-1.el9_6.1, 1.3.22-1.el10_0.2

• https://bugzilla.redhat.com/show_bug.cgi?id=2321302

• Incorrect configuration in mod_proxy_cluster
• Red Hat Enterprise Linux 9 update for mod_proxy_cluster
• Red Hat Enterprise Linux 10 update for mod_proxy_cluster
• Red Hat Enterprise Linux 9 update for mod_proxy_cluster