CVE-2014-8109
published 2014-12-29CVE-2014-8109: mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua…
PriorityP339medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
22.02%
97.4th percentile
mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | httpd | — | — |
| apple | os_x_server_v5.0.3 | — | — |
| apple | os_x_yosemite_v10.10.5_and_security_update_2015-006 | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | apache2 | < apache2 2.4.10-9 (bookworm) | apache2 2.4.10-9 (bookworm) |
| fedoraproject | fedora | — | — |
| oracle | enterprise_manager_ops_center | < 12.1.4 | 12.1.4 |
| oracle | enterprise_manager_ops_center | — | — |
| oracle | enterprise_manager_ops_center | — | — |
| oracle | enterprise_manager_ops_center | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv5.0MEDIUM
vendor_ubuntu5.0MEDIUM
vendor_apache4.3LOW
vendor_debian4.3MEDIUM
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-5m8h-wgcr-7x2w: mod_lua
ghsa_unreviewed·2022-05-13
CVE-2014-8109 [MEDIUM] CWE-863 GHSA-5m8h-wgcr-7x2w: mod_lua
mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory.
OSV
apache2 vulnerabilities
osv·2015-03-10·CVSS 5.0
CVE-2013-5704 [MEDIUM] apache2 vulnerabilities
apache2 vulnerabilities
Martin Holst Swende discovered that the mod_headers module allowed HTTP
trailers to replace HTTP headers during request processing. A remote
attacker could possibly use this issue to bypass RequestHeaders directives.
(CVE-2013-5704)
Mark Montague discovered that the mod_cache module incorrectly handled
empty HTTP Content-Type headers. A remote attacker could use this issue to
cause the server to stop responding, leading to a denial of service. This
issue only affected Ubuntu 14.04 LTS and Ubuntu 14.10. (CVE-2014-3581)
Teguh P. Alko discovered that the mod_proxy_fcgi module incorrectly
handled long response headers. A remote attacker could use this issue to
cause the server to stop responding, leading to a denial of service. This
issue only affected Ubuntu 14.10.
OSV
CVE-2014-8109: mod_lua
osv·2014-12-29·CVSS 4.3
CVE-2014-8109 [MEDIUM] CVE-2014-8109: mod_lua
mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory.
Ubuntu
Apache HTTP Server vulnerabilities
vendor_ubuntu·2015-03-10·CVSS 5.0
CVE-2013-5704 [MEDIUM] Apache HTTP Server vulnerabilities
Title: Apache HTTP Server vulnerabilities
Summary: Several security issues were fixed in the Apache HTTP Server.
Martin Holst Swende discovered that the mod_headers module allowed HTTP
trailers to replace HTTP headers during request processing. A remote
attacker could possibly use this issue to bypass RequestHeaders directives.
(CVE-2013-5704)
Mark Montague discovered that the mod_cache module incorrectly handled
empty HTTP Content-Type headers. A remote attacker could use this issue to
cause the server to stop responding, leading to a denial of service. This
issue only affected Ubuntu 14.04 LTS and Ubuntu 14.10. (CVE-2014-3581)
Teguh P. Alko discovered that the mod_proxy_fcgi module incorrectly
handled long response headers. A remote attacker could use this issue to
cause the server t
Red Hat
httpd: LuaAuthzProvider argument handling issue
vendor_redhat·2014-11-12·CVSS 4.3
CVE-2014-8109 [MEDIUM] httpd: LuaAuthzProvider argument handling issue
httpd: LuaAuthzProvider argument handling issue
mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory.
Package: httpd (Red Hat Directory Server 8) - Not affected
Package: httpd (Red Hat Enterprise Linux 5) - Not affected
Package: httpd (Red Hat Enterprise Linux 6) - Not affected
Package: httpd (R
Debian
CVE-2014-8109: apache2 - mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x throug...
vendor_debian·2014·CVSS 4.3
CVE-2014-8109 [MEDIUM] CVE-2014-8109: apache2 - mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x throug...
mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory.
Scope: local
bookworm: resolved (fixed in 2.4.10-9)
bullseye: resolved (fixed in 2.4.10-9)
forky: resolved (fixed in 2.4.10-9)
sid: resolved (fixed in 2.4.10-9)
trixie: resolved (fixed in 2.4.10-9)
Apple
CVE-2014-8109: OS X Server v5.0.3
vendor_apple·CVSS 4.3
CVE-2014-8109 [MEDIUM] CVE-2014-8109: OS X Server v5.0.3
Apple Security Update: About the security content of OS X Server v5.0.3
Product: OS X Server v5.0.3
CVE: CVE-2014-8109
Component: CVE-2014-8109
Apple
CVE-2014-8109: OS X Yosemite v10.10.5 and Security Update 2015-006
vendor_apple·CVSS 4.3
CVE-2014-8109 [MEDIUM] CVE-2014-8109: OS X Yosemite v10.10.5 and Security Update 2015-006
Apple Security Update: About the security content of OS X Yosemite v10.10.5 and Security Update 2015-006
Product: OS X Yosemite v10.10.5 and Security Update 2015-006
CVE: CVE-2014-8109
Component: CVE-2014-8109
Apache
Apache httpd: CVE-2014-8109
vendor_apache·CVSS 4.3
CVE-2014-8109 [LOW] Apache httpd: CVE-2014-8109
Apache httpd: CVE-2014-8109
Fix handling of the Require line in mod_lau when a LuaAuthzProvider is used in multiple Require directives with different arguments. This could lead to different authentication rules than expected. Reported to security team 2014-11-09 Issue public 2014-11-09 Update 2.4.12 released 2015-01-30 Affects 2.4.10, 2.4.9, 2.4.7, 2.4.6, 2.4.4, 2.4.3, 2.4.2, 2.4.1
Severity: low
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2014-8109 httpd: LuaAuthzProvider argument handling issue
bugzilla·2014-12-15·CVSS 4.3
CVE-2014-8109 [MEDIUM] CVE-2014-8109 httpd: LuaAuthzProvider argument handling issue
CVE-2014-8109 httpd: LuaAuthzProvider argument handling issue
If an authorization script for LuaAuthzProvider were provided in the configuration multiple times, only the arguments of the last specification were used when invoking the script. This could lead to scripts being invoked with unexpected arguments.
Further details are available in the thread of the original report and bug:
http://www.openwall.com/lists/oss-security/2014/11/28/5
https://issues.apache.org/bugzilla/show_bug.cgi?id=57204
Upstream fix:
https://github.com/apache/httpd/commit/3f1693d558d0758f829c8b53993f1749ddf6ffcb
This affects Apache HTTP Server versions 2.3 and later (such as what is shipped in Red Hat Enterprise Linux 7), as mod_lua is not available in earlier releases. Note that support for LuaAuthzProvider
Bugzilla
CVE-2014-8109 httpd: LuaAuthzProvider argument handling issue [fedora-all]
bugzilla·2014-12-15·CVSS 4.3
CVE-2014-8109 [MEDIUM] CVE-2014-8109 httpd: LuaAuthzProvider argument handling issue [fedora-all]
CVE-2014-8109 httpd: LuaAuthzProvider argument handling issue [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fed
http://advisories.mageia.org/MGASA-2015-0011.htmlhttp://lists.apple.com/archives/security-announce/2015/Aug/msg00001.htmlhttp://lists.apple.com/archives/security-announce/2015/Sep/msg00004.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-June/159352.htmlhttp://www.openwall.com/lists/oss-security/2014/11/28/5http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlhttp://www.securityfocus.com/bid/73040http://www.ubuntu.com/usn/USN-2523-1https://bugzilla.redhat.com/show_bug.cgi?id=1174077https://github.com/apache/httpd/commit/3f1693d558d0758f829c8b53993f1749ddf6ffcbhttps://issues.apache.org/bugzilla/show_bug.cgi?id=57204https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttps://support.apple.com/HT205219https://support.apple.com/kb/HT205031http://advisories.mageia.org/MGASA-2015-0011.htmlhttp://lists.apple.com/archives/security-announce/2015/Aug/msg00001.htmlhttp://lists.apple.com/archives/security-announce/2015/Sep/msg00004.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-June/159352.htmlhttp://www.openwall.com/lists/oss-security/2014/11/28/5http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlhttp://www.securityfocus.com/bid/73040http://www.ubuntu.com/usn/USN-2523-1https://bugzilla.redhat.com/show_bug.cgi?id=1174077https://github.com/apache/httpd/commit/3f1693d558d0758f829c8b53993f1749ddf6ffcbhttps://issues.apache.org/bugzilla/show_bug.cgi?id=57204https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttps://support.apple.com/HT205219https://support.apple.com/kb/HT205031
2014-12-29
Published