Most recent entries from all

ALSA-2024:4720 — Important: httpd:2.4 security update

Affected: AlmaLinux:8: httpd, AlmaLinux:8: httpd-devel, AlmaLinux:8: httpd-filesystem, AlmaLinux:8: httpd-manual, AlmaLinux:8: httpd-tools, AlmaLinux:8: mod_http2, AlmaLinux:8: mod_ldap, AlmaLinux:8: mod_md, AlmaLinux:8: mod_proxy_html, AlmaLinux:8: mod_session and 1 more

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

* httpd: Encoding problem in mod_proxy (CVE-2024-38473) * httpd: Substitution encoding issue in mod_rewrite (CVE-2024-38474) * httpd: Improper escaping of output in mod_rewrite (CVE-2024-38475) * httpd: NULL pointer dereference in mod_proxy (CVE-2024-38477) * httpd: Potential SSRF in mod_rewrite (CVE-2024-39573)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-05195

BELL-CVE-2024-38477

Affected: Alpaquita:23: apache2, Alpaquita:stream: apache2

BIT-apache-2024-38477 — Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request

Affected: Bitnami: apache

null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request. Users are recommended to upgrade to version 2.4.60, which fixes this issue.

certfr-2024-avi-0533 — De multiples vulnérabilités ont été découvertes dans Apache HTTP Server. Certaines d'entre elles permettent à un attaqu…

certfr-2024-avi-0533

cnvd-2024-36389

ESSA-2024:0620 — httpd: security fixes equal to RHSA-2024:4943

httpd: security fixes equal to RHSA-2024:4943

EUVD-2026-258616

fkie_cve-2024-38477

GHSA-phjg-7fch-3c2f

jvndb-2026-003907

Multiple vulnerabilities have been found in JP1. CVE-2024-38473, CVE-2024-38477

OESA-2024-1852 — httpd security update

Affected: openEuler:22.03-LTS-SP3: httpd

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fix(es): Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI. Users are recommended to upgrade to version 2.4.60, which fixes this issue. Some RewriteRules that capture and substitute unsafely will now fail unless rewrite flag "UnsafeAllow3F" is specified.(CVE-2024-38474) null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request. Users are recommended to upgrade to version 2.4.60, which fixes this issue.(CVE-2024-38477)

RHSA-2024:4719 — Red Hat Security Advisory: httpd:2.4 security update

httpd: Substitution encoding issue in mod_rewrite httpd: Improper escaping of output in mod_rewrite httpd: NULL pointer dereference in mod_proxy

SUSE-SU-2024:2405-1 — Security update for apache2

Security update for apache2

UBUNTU-CVE-2024-38477

Affected: Ubuntu:Pro:14.04:LTS: apache2, Ubuntu:Pro:16.04:LTS: apache2, Ubuntu:Pro:18.04:LTS: apache2, Ubuntu:20.04:LTS: apache2, Ubuntu:22.04:LTS: apache2, Ubuntu:24.04:LTS: apache2

WID-SEC-W-2024-1504 — Apache HTTP Server: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apache HTTP Server ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Sicherheitsmaßnahmen zu umgehen oder vertrauliche Informationen offenzulegen.