Re: [users@httpd] question on CVE-2023-36760

sing AJP for sure? > > Thanks, > Pashia > > From: Otis Dewitt - NOAA Affiliate > Sent: Tuesday, February 7, 2023 9:46 AM > To: users@httpd.apache.org > Subject: Re: [users@httpd] question on CVE-2023-36760 > > > *External Email: Use caution responding, opening

RE: [users@httpd] question on CVE-2023-36760

Thank you for responding. I’m wondering though, how do I confirm it is using AJP or not using AJP for sure? Thanks, Pashia From: Otis Dewitt - NOAA Affiliate Sent: Tuesday, February 7, 2023 9:46 AM To: users@httpd.apache.org Subject: Re: [users@httpd] question on CVE-2023-36760 *External

Re: [users@httpd] question on CVE-2023-36760

If you are not using "*Apache JServ Protocol (AJP)" *then the CVE does not pertain to your Apache server. On Mon, Feb 6, 2023 at 5:46 PM Thao, Pashia wrote: > PWEB server is running a version of Apache affected. > > > > Our prod web server is running a version of the Apache affected by by > CVE-

[users@httpd] question on CVE-2023-36760

PWEB server is running a version of Apache affected. Our prod web server is running a version of the Apache affected by by CVE-2023-36760, which is a critical vulnerability affecting versions of Apache server <= 2.4.54