mod_proxy_cluster: A vulnerability was found in mod_proxy_cluster
CVE-2024-10306 is fixed in mod_proxy_cluster on 1 platform, first by RHSA-2025:9466, released February 28, 2025. It is not reported as exploited. Patch Radar priority: Routine.
A vulnerability was found in mod_proxy_cluster. The issue is that the <Directory> directive should be replaced by the <Location> directive as the former does not restrict IP/host access as `Require ip IP_ADDRESS` would suggest. This means that anyone with access to the host might send MCMP requests that may result in adding/removing/updating nodes for the balancing. However, this host should not be accessible to the public network as it does not serve the general traffic.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| mod_proxy_cluster · RHEL 10 | 1.3.22-1.el10_0.2 | RHSA-2025:9466 | Feb 28, 2025 |
| mod_proxy_cluster · RHEL 9 | 0:1.3.22-1.el9_6.1 | RHSA-2025:9434 | Jun 24, 2025 |
| mod_proxy_cluster · almalinux 10 | 1.3.22-1.el10_0.2 | ALSA-2025:9466 | Jun 24, 2025 |
| mod_proxy_cluster · almalinux 9 | 1.3.22-1.el9_6.1 | ALSA-2025:9434 | Jun 24, 2025 |
| mod_proxy_cluster · ol 10 | 0:1.3.21-1.el10 | mod_proxy_cluster 0:1.3.21-1.el10 | Jun 9, 2025 |
| mod_proxy_cluster · ol 9 | 0:1.3.22-1.el9_6.1 | ELSA-2025-9434 | Jun 24, 2025 |
| mod_proxy_cluster · rocky 10 | 0:1.3.22-1.el10_0.2 | RLSA-2025:9466 | Oct 3, 2025 |
| mod_proxy_cluster · rocky 9 | 0:1.3.22-1.el9_6.1 | RLSA-2025:9434 | Oct 4, 2025 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.