Apache vulnerability CVE-2023-43622 CVE-2023-45802 CVE-2023-31122 in License Server 11.17.2.0 44000

book

Article ID: CTX583758

calendar_today

Updated On:

Description

Apache 2.4.57 contains vulnerabilities and is used in the License Server version 11.17.2.0 build 44000. Security scans may raise the following CVEs:

Environment

Citrix is not responsible for and does not endorse or accept any responsibility for the contents or your use of these third party Web sites. Citrix is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement by Citrix of the linked Web site. It is your responsibility to take precautions to ensure that whatever Web site you use is free of viruses or other harmful items.

Resolution

No action is required.

Citrix License Server does not contain the affected modules: mod_macro and does not use HTTP/2 and is therefore not affected. The next version of the Citrix licensing server would have a newer Apache version as well.

Customers may also wish to upgrade to build 45000 which utilizes Apache 2.4.58, but this is not necessary to mitigate the CVE issues as the previous version was not impacted.

https://docs.citrix.com/en-us/licensing/current-release/about

 

Problem Cause

Security software flagged License Server 11.17.2.0 build 44000 as vulnerable due to the use of Apache 2.4.57

Issue/Introduction

The Citrix License Server is not affected by the reported vulnerabilities as it does not use the affected modules and protocol

Additional Information

Build 45000 details (Citrix Docs): https://docs.citrix.com/en-us/licensing/current-release/about
Powered by Wolken Software