Are we having fun yet?

[Eoler]

Yes, but not in parallel: https://www.wiz.io/blog/cve-2026-119618 ... nerability

[tab-kh]

As for Debian 13, just update your packages. Either via SSH-Konsole or via the Keyhelp panel. My servers now all show Apache 2.4.71.

[l_fish]

For those with other Debian versions running: see https://security-tracker.debian.org/tra ... 026-119618

Ubuntu does not have any information for that CVE, yet.

Temporary mitigation is to disable http2:

Code: Select all

a2dismod proxy_http2 http2 && systemctl restart apache2.service

[tab-kh]

Debian 12 got Apache Version 2.4.71-1 (2.4.71-1~deb12u1) on another server without Keyhelp.

[l_fish]

Debian 12 got Apache Version 2.4.71-1 (2.4.71-1~deb12u1) on another server without Keyhelp.

According to Debian security tracker 2.4.71-1~deb12u1 is vulnerable, see link in my last post.

[Tiresias]

Strange.
According to apt listchanges from today 3 p.m. it is fixed

apache2 (2.4.71-1~deb12u1) bookworm-security; urgency=medium

* New upstream release (Closes: #1153732, CVE-2026-119618, CVE-2026-106023,
CVE-2026-109163, CVE-2026-42356, CVE-2026-42528, CVE-2026-46729,
CVE-2026-47360, CVE-2026-48005, CVE-2026-56153, CVE-2026-56154,
CVE-2026-56449, CVE-2026-57941, CVE-2026-58415, CVE-2026-59685,
CVE-2026-59797, CVE-2026-63045, CVE-2026-63292, CVE-2026-63686,
CVE-2026-63718, CVE-2026-73636, CVE-2026-73637, CVE-2026-79768,
CVE-2026-93546)
* Unfuzz patches

[superjogi]

Ok, ich hab es den fix auch deployed. Gibt doch ein paar debian 12 hier.

[tab-kh]

Makes IMO not any sense, to have 3 Apache packages with the same Apache version and only 2 of them fix the vulnerabilities, while all 3 of them are available via apt since today. Maybe an error in the security tracker.

[Eoler]

Ubuntu does not have any information for that CVE, yet.

Ubuntu LTS patched last night: https://ubuntu.com/security/CVE-2026-119618

[l_fish]

Makes IMO not any sense, to have 3 Apache packages with the same Apache version and only 2 of them fix the vulnerabilities, while all 3 of them are available via apt since today. Maybe an error in the security tracker.

Yes, the security tracker marks the same package version as fixed now. So this was a mistake at the security tracker obviously.