Red Hat Security Advisory

RHSA-2024:6468

httpd:2.4 security update

Released 2024-09-09 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream AUS (v.8.6) httpd-2.4.37-47.module+el8.6.0+22231+3e699de3.10.src::httpd:2.4, httpd-2.4.37-47.module+el8.6.0+22231+3e699de3.10.x86_64::httpd:2.4, httpd-devel-2.4.37-47.module+el8.6.0+22231+3e699de3.10.x86_64::httpd:2.4 +11
Red Hat Enterprise Linux AppStream E4S (v.8.6) httpd-2.4.37-47.module+el8.6.0+22231+3e699de3.10.aarch64::httpd:2.4, httpd-2.4.37-47.module+el8.6.0+22231+3e699de3.10.ppc64le::httpd:2.4, httpd-2.4.37-47.module+el8.6.0+22231+3e699de3.10.s390x::httpd:2.4 +38
Red Hat Enterprise Linux AppStream TUS (v.8.6) httpd-2.4.37-47.module+el8.6.0+22231+3e699de3.10.src::httpd:2.4, httpd-2.4.37-47.module+el8.6.0+22231+3e699de3.10.x86_64::httpd:2.4, httpd-devel-2.4.37-47.module+el8.6.0+22231+3e699de3.10.x86_64::httpd:2.4 +11

Fixes 1 record

TI-2024-25717 CVE-2024-38476 · GHSA-fpq9-w5cw-5hf8

Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect

HIGH 77

Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.41611 Published 2024-07-01 Fixed CWE-829