CVE-2013-5704: apache http_server

Modified

AliasesRHSA-2015:1249UBUNTU-CVE-2013-5704DEBIAN-CVE-2013-5704

Published 15-04-2014Last modified 06-08-2024

Vulnerability summary

CVE-2013-5704 is a medium (CVSS 5.0) vulnerability in apache http_server. EPSS estimates a 57.99% chance of exploitation in the next 30 days, higher than 99% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Routine

Not severe (CVSS 5, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.0/10

010

Medium · v2.0 (NVD)

EPSS score

57.99%

0%100%

Critical · +5.35 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 9 · Related 3

DLA-71-1 OPENSUSE-SU-2024:10268-1 RHSA-2014:1972 RHSA-2015:0325 RHSA-2015:2659 RHSA-2015:2660+3 more

Timeline

15-04-2014
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."

CVSS metrics

1 score · 1 source · 1 version

v2.05.0

EPSS trend

Probability

57.99%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

Increase +5.35 pp

From 52.64% on 05-10-2026

05-10-202604-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

referenceUnverified
Exploit Reference (martin.swende.se)
Maturity: unknown

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Redhat13 products

enterprise_linux_desktop6.0 | 7.0
enterprise_linux_eus7.3 | 7.4 | 7.5 | 7.6 | 7.7
enterprise_linux_server6.0 | 7.0
enterprise_linux_server_aus7.3 | 7.4 | 7.6 | 7.7
enterprise_linux_server_tus7.3 | 7.6 | 7.7

Show all 13

Oracle4 products

enterprise_manager_ops_center< 12.1.4 | 12.1.4 | 12.2.0 | 12.2.1 | 12.3.0
http_server10.1.3.5.0 | 11.1.1.7.0 | 12.1.2.0 | 12.1.3.0
linuxEOL6
solarisEOL11.2

Apple2 products

mac_os_x< 10.10.4
mac_os_x_server< 5.0.3

Apache1 product

http_serverEOL2.2.0 | 2.2.2 | 2.2.3 | 2.2.4 | 2.2.5 | 2.2.6 | 2.2.8 | 2.2.9 | 2.2.10 | 2.2.11 | 2.2.12 | 2.2.13 | 2.2.14 | 2.2.15 | 2.2.16 | 2.2.17 | 2.2.18 | 2.2.19 | 2.2.20 | 2.2.21 | 2.2.22 | 2.2.23 | 2.2.24 | 2.2.25 | 2.2.26 | 2.2.27 | 2.4.1 | 2.4.2 | 2.4.3 | 2.4.4 | 2.4.6 | 2.4.7 | 2.4.9 | 2.4.10

Canonical1 product

ubuntu_linuxEOL10.04 | 12.04 | 14.04 | 14.10

Debian1 product

apache2< 2.4.10-2

Ubuntu1 product

apache2< 2.4.7-1ubuntu4.4

7 vendors · 23 products

References

68 links

marc.info?l=bugtraq&m=144493176821532&w=2Vendor AdvisoryX Refsource HPIssue TrackingMailing ListThird Party Advisory
www.oracle.com/technetwork/topics/security/cpujul2015-2367936.htmlX Refsource CONFIRMThird Party Advisory
support.apple.com/HT204659X Refsource CONFIRMThird Party Advisory
svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGESX Refsource CONFIRMRelease NotesVendor AdvisoryREPORT
security.gentoo.org/glsa/201504-03Vendor AdvisoryX Refsource GENTOOThird Party Advisory
rhn.redhat.com/errata/RHSA-2015-1249.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
rhn.redhat.com/errata/RHSA-2016-0061.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
rhn.redhat.com/errata/RHSA-2015-0325.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlX Refsource CONFIRMThird Party Advisory
www.mandriva.com/security/advisories?name=MDVSA-2014:174Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory

Show all 68 references

www.ubuntu.com/usn/USN-2523-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
www.oracle.com/technetwork/topics/security/cpujan2016-2367955.htmlX Refsource CONFIRMThird Party Advisory
rhn.redhat.com/errata/RHSA-2016-0062.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
marc.info?l=bugtraq&m=143403519711434&w=2Vendor AdvisoryX Refsource HPIssue TrackingMailing ListThird Party Advisory
www.oracle.com/technetwork/topics/security/cpujan2015-1972971.htmlX Refsource CONFIRMThird Party Advisory
h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246X Refsource CONFIRMThird Party Advisory
rhn.redhat.com/errata/RHSA-2015-2661.htmlVendor AdvisoryX Refsource REDHATBroken LinkThird Party Advisory
lists.apple.com/archives/security-announce/2015/Apr/msg00001.htmlVendor AdvisoryX Refsource APPLEMailing ListThird Party Advisory
svn.apache.org/viewvc/…X Refsource CONFIRMPatchVendor Advisory
access.redhat.com/errata/RHSA-2015:2659Vendor AdvisoryX Refsource REDHATThird Party Advisory
svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.cX Refsource CONFIRMPatchVendor Advisory
www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.htmlX Refsource CONFIRMThird Party Advisory
access.redhat.com/errata/RHSA-2015:2660Vendor AdvisoryX Refsource REDHATThird Party Advisory
httpd.apache.org/security/vulnerabilities_24.htmlX Refsource CONFIRMVendor Advisory
martin.swende.se/blog/HTTPChunked.htmlX Refsource MISCBroken LinkExploitThird Party AdvisoryREPORT
lists.apple.com/archives/security-announce/2015/Sep/msg00004.htmlVendor AdvisoryX Refsource APPLEMailing ListThird Party Advisory
support.apple.com/HT205219X Refsource CONFIRMThird Party Advisory
www.securityfocus.com/bid/66550VDB EntryX Refsource BIDThird Party Advisory
marc.info?l=apache-httpd-dev&m=139636309822854&w=2Mailing ListX Refsource MLISTThird Party AdvisoryREPORT
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
access.redhat.com/errata/RHSA-2015:1249Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=922844REPORT
bugzilla.redhat.com/show_bug.cgi?id=963146REPORT
bugzilla.redhat.com/show_bug.cgi?id=987590REPORT
bugzilla.redhat.com/show_bug.cgi?id=1045477REPORT
bugzilla.redhat.com/show_bug.cgi?id=1057695REPORT
bugzilla.redhat.com/show_bug.cgi?id=1069625REPORT
bugzilla.redhat.com/show_bug.cgi?id=1082903REPORT
bugzilla.redhat.com/show_bug.cgi?id=1125269REPORT
bugzilla.redhat.com/show_bug.cgi?id=1149703REPORT
bugzilla.redhat.com/show_bug.cgi?id=1149906REPORT
bugzilla.redhat.com/show_bug.cgi?id=1161328REPORT
bugzilla.redhat.com/show_bug.cgi?id=1162268REPORT
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1249.jsonAdvisory
access.redhat.com/security/cve/CVE-2013-5704REPORT
www.cve.org/CVERecord?id=CVE-2013-5704AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2013-5704Advisory
ubuntu.com/security/CVE-2013-5704REPORT
ubuntu.com/security/notices/USN-2523-1Advisory
security-tracker.debian.org/tracker/CVE-2013-5704Advisory