Debian alert DLA-4629-1 (apache2)

From:
             
 
rouca@debian.org
To:
             
 
<debian-lts-announce@lists.debian.org>
Subject:
             
 
[SECURITY] [DLA 4629-1] apache2 security update
Date:
             
 
Fri, 12 Jun 2026 19:31:12 +0200
Message-ID:
             
 
<f1b81f83fbfe5d8300b1c209e2d4c846@debian.org>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4629-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                   Bastien Roucariès
June 12, 2026                                 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : apache2
Version        : 2.4.67-1~deb11u3
CVE ID         : CVE-2026-29167 CVE-2026-29170 CVE-2026-34355 CVE-2026-34356 
                 CVE-2026-42535 CVE-2026-42536 CVE-2026-43951 CVE-2026-44119 
                 CVE-2026-44185 CVE-2026-44186 CVE-2026-44631 CVE-2026-48913
Debian Bug     : 1139340

Multiple vulnerabilities have been discovered in the Apache HTTP server,
which may result in remote code execution, privilege escalation, denial
of service or information disclosure.

For Debian 11 bullseye, these problems have been fixed in version
2.4.67-1~deb11u3.

We recommend that you upgrade your apache2 packages.

For the detailed security status of apache2 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/apache2

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEXQGHuUCiRbrXsPVqADoaLapBCF8FAmosQmAACgkQADoaLapB
CF8x/w//ZV98derLd0weTwz9DmmY0Ijiw5mzAwiENSi34JR2piGOrpQqDLL/R5YY
nrmEiB1YfPHHG2AxzwT8/cRgJuPu5RMII6U5iqPKwTW89cxgJz/7AEbeQXOkrG/g
5DXOQFI02OIYq3hgeok6Jw68CfMidOViDqmjK515elKgwMCXoMkUa6PorUFUTvIe
YTvSKS5MDGKPTuW0hDBqwP3wYonvdvAT1dO09yaL0gws/4PReG2yqJmVTA37c1C0
2fl/Bn+VqHvtubFq7JiJeofbiv0qE91iorbl3fs0lCN1xxLzMa2aMfDbuMhezXUX
juHZ1iVH4IIXS+kpPt4xHVnGyRvH++/EJFQxeOjF75Qh9nsH5z6McTOOZk1y6vMC
UT3z+5RMyZnTqfqe5WwyEBcqfP8MvPG5QRz7BTPwGhGfiRv0QjjJFbZzH6IZQcAa
al7QWko7SE9uO2h2z8IXJUF5xSWLGmQ0nxcbE9JjalCCCok+0cM1mZmiNEI6IYww
RDaRi2VA1MJRcHXx3OG6hUmiBAfvxydvc/XHGApT3C7IOvlQlFxiLxj1Mx56RE+e
38fdfhEc1A2azxn65q/hF6K6bVBmBhwvQUNIFSsjKed3vv3n+ro4NQ6qR+sRaZkD
g0hoXmIqkfDvPJmxqXo3LuIleHhKM5OYgzXS3QOHZWCHIBW/7yw=
=6PgF
-----END PGP SIGNATURE-----