Threats tagged 'ghsa-2qfr-q5v6-m43q'

CVE-2024-47252 is a vulnerability in Apache HTTP Server's mod_ssl module (version 2.4.63 and earlier) where insufficient escaping of user-supplied data allows an untrusted SSL/TLS client to insert escape characters into log files under certain logging configurations. Specifically, when CustomLog uses "%{varname}x" or "%{varname}c" to log variables such as SSL_TLS_SNI provided by mod_ssl, no escaping is performed, leading to potential log injection.