Red Hat Security Advisory

RHSA-2024:5001

httpd security update

Released 2024-08-06 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream EUS (v.9.2) httpd-2.4.53-11.el9_2.10, httpd-core-2.4.53-11.el9_2.10, httpd-devel-2.4.53-11.el9_2.10 +8

Fixes 2 records

TI-2024-26505 CVE-2024-39573 · GHSA-2wcw-rcf9-qm36

Apache HTTP Server: mod_rewrite proxy handler substitution

HIGH 65

Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to cause unsafe RewriteRules to unexpectedly setup URL's to be handled by mod_proxy.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.35447 Published 2024-07-01 Partial fix CWE-20

TI-2024-25714 CVE-2024-38473 · GHSA-hrh5-4ffc-228q

Apache HTTP Server proxy encoding problem

MEDIUM 59

Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.25878 Published 2024-07-01 Partial fix CWE-116