A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker. Users are recommended to upgrade to version 2.4.67, which fixes this issue.
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache HTTP Server | 0 |
Updated severity to MEDIUM, marked exploit as available, and noted active exploitation.
Updated description with more technical detail, changed severity to HIGH, set CVSS estimate to 7.5, and noted that no exploit is available.
Initial creation
