{"id":"CVE-2014-8109","aliases":["CLSA-2025-1752126532","DEBIAN-CVE-2014-8109","EUVD-2014-7956","GHSA-5m8h-wgcr-7x2w","MGASA-2015-0011","SUSE-SU-2015:0974-1","openSUSE-SU-2024:10268-1"],"status":"published","title":"mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not...","description":"mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.22016,"percentile":0.97679,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2014-12-29T23:00:00Z","modified":"2026-10-23T15:47:35Z","fixes":[{"ecosystem":"Debian:12","package":"apache2","fixed_in":["2.4.10-9"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"apache2","fixed_in":["2.4.10-9"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"apache2","fixed_in":["2.4.10-9"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"apache","fixed_in":["2.4.7-5.5.mga4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-99.0.5.el7.centos.1.tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-99.0.5.el7.centos.1.tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-99.0.5.el7.centos.1.tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-99.0.5.el7.centos.1.tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-99.0.5.el7.centos.1.tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-99.0.5.el7.centos.1.tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.6-99.0.5.el7.centos.1.tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-99.0.5.el7.centos.1.tuxcare.els5"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.10-9"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.10-9"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.10-9"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"apache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-5.5.mga4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.10-12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.10-12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.10-12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-4.1"}]}],"bundled":48}],"products":[{"vendor":"apache","product":"http_server"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"oracle","product":"enterprise_manager_ops_center"}],"references":[{"url":"https://github.com/apache/httpd/commit/3f1693d558d0758f829c8b53993f1749ddf6ffcb","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1174077","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","advisory","fix","report"]},{"url":"http://www.ubuntu.com/usn/USN-2523-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2014/11/28/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.securityfocus.com/bid/73040","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Broken Link","Mailing List","article","web"]},{"url":"http://advisories.mageia.org/MGASA-2015-0011.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://issues.apache.org/bugzilla/show_bug.cgi?id=57204","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Vendor Advisory","advisory","report"]},{"url":"https://support.apple.com/kb/HT205031","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Broken Link","Mailing List","article","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159352.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://support.apple.com/HT205219","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8109"},{"url":"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E"},{"url":"https://github.com/advisories/GHSA-5m8h-wgcr-7x2w"},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2025-1752126532.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-8109","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0011.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14916","tags":["report"]},{"url":"http://www.cvedetails.com/cve/CVE-2014-8109/","tags":["advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-12/msg00108.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150974-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/792309","tags":["report"]},{"url":"https://bugzilla.suse.com/871310","tags":["report"]},{"url":"https://bugzilla.suse.com/899836","tags":["report"]},{"url":"https://bugzilla.suse.com/909715","tags":["report"]},{"url":"https://bugzilla.suse.com/918352","tags":["report"]},{"url":"https://bugzilla.suse.com/923090","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3581","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0228","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-3094","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-3095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-3555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-3560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-3720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-0408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-0425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-0434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-1452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-1623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3368","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0117","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0226","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3583","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4979","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-8109","description":"mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory.","status":"published","published":"2014-12-29T23:00:00Z","modified":"2024-08-06T13:10:50.068Z","updated_at":"2026-11-02T14:33:43.206348Z"}],"euvd":[{"id":"EUVD-2014-7956","description":"mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory.","status":"published","published":"2014-12-29T23:00:00Z","modified":"2024-08-06T13:10:50Z","updated_at":"2026-11-03T01:56:52.951821Z"}],"ghsa":[{"id":"GHSA-5m8h-wgcr-7x2w","title":"mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not...","description":"mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory.","status":"published","published":"2022-05-13T01:09:46Z","modified":"2023-02-20T05:05:45Z","cwes":["CWE-863"],"updated_at":"2026-11-02T14:54:10.77374Z"}],"nvd":[{"id":"CVE-2014-8109","description":"mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory.","status":"published","published":"2014-12-29T23:59:00.053Z","modified":"2026-06-17T00:16:17.597Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:02:57.680258Z"}],"osv":[{"id":"CLSA-2025-1752126532","title":"httpd: Fix of 2 CVEs","description":"- CVE-2014-8109: mod_lua: fix LuaAuthzProvider argument handling issue\n- CVE-2019-10092: mod_proxy: fix limited cross-site scripting in mod_proxy error page","status":"published","published":"2025-07-10T05:48:57Z","modified":"2026-06-01T00:33:17.94668228Z","updated_at":"2026-11-02T15:43:42.025438Z"},{"id":"CVE-2014-8109","description":"mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory.","status":"published","published":"2014-12-29T23:59:00Z","modified":"2026-04-16T06:20:13.511070847Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-8109","description":"mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory.","status":"published","published":"2014-12-29T23:59:00.053Z","modified":"2026-10-23T15:47:35.592222336Z","updated_at":"2026-11-02T15:45:26.442161Z"},{"id":"MGASA-2015-0011","title":"Updated apache packages fix CVE-2014-8109","description":"Updated apache packages fix security vulnerability:\n\nmod_lua.c in the mod_lua module in the Apache HTTP Server through 2.4.10 does\nnot support an httpd configuration in which the same Lua authorization\nprovider is used with different arguments within different contexts, which\nallows remote attackers to bypass intended access restrictions in\nopportunistic circumstances by leveraging multiple Require directives, as\ndemonstrated by a configuration that specifies authorization for one group to\naccess a certain directory, and authorization for a second group to access a\nsecond directory (CVE-2014-8109).\n","status":"published","published":"2015-01-07T16:32:10Z","modified":"2026-04-16T06:25:13.324798206Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10268-1","title":"apache2-2.4.23-4.1 on GA media","description":"These are all security issues fixed in the apache2-2.4.23-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:25:01.364403Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"SUSE-SU-2015:0974-1","title":"Security update for apache2","description":"Apache2 updated to fix four security issues and one non-security bug.\n\nThe following vulnerabilities have been fixed:\n\n- mod_headers rules could be bypassed via chunked requests. Adds 'MergeTrailers'\n  directive to restore legacy behavior. (bsc#871310, CVE-2013-5704)\n- An empty value in Content-Type could lead to a crash through a null pointer\n  dereference and a denial of service. (bsc#899836, CVE-2014-3581)\n- Remote attackers could bypass intended access restrictions in mod_lua\n  LuaAuthzProvider when multiple Require directives with different arguments\n  are used. (bsc#909715, CVE-2014-8109)\n- Remote attackers could cause a denial of service (child-process crash) by\n  sending a crafted WebSocket Ping frame after a Lua script has called the\n  wsupgrade function. (bsc#918352, CVE-2015-0228)\n\nThe following non-security issues have been fixed:\n\n- The Apache2 systemd service file was changed to fix situation where apache wouldn't\n  start at boot when using an encrypted certificate because the user wasn't prompted\n  for password during boot. (bsc#792309)\n\nAdditionally, mod_imagemap is now included by default in the package. (bsc#923090)\n","status":"published","published":"2015-04-10T12:24:10Z","modified":"2026-02-04T03:39:11.904546Z","updated_at":"2026-11-02T15:53:41.276824Z"}]}}