ALSA-2024:4726 - Important: httpd security update
Summary
ALSA-2024:4726: Important: httpd security update. Affects httpd versions < 2.4.57-11.el9_4. Fixed in 2.4.57-11.el9_4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The httpd package provides the Apache HTTP Server, a powerful, efficient, and extensible web server. It is widely used to serve web content and handle HTTP requests.
Vulnerability Detail
This security update addresses multiple vulnerabilities in the httpd package:
- CVE-2024-38475: Improper escaping of output in mod_rewrite
- CVE-2024-38474: Substitution encoding issue in mod_rewrite
- CVE-2024-38477: Null pointer dereference in mod_proxy
- CVE-2024-39573: Potential SSRF in mod_rewrite
- CVE-2024-38473: Encoding problem in mod_proxy
These vulnerabilities could allow an attacker to execute arbitrary code, bypass security restrictions, or perform server-side request forgery (SSRF) attacks.
How To Fix
Minimum fixed version
2.4.57-11.el9_4
This is the first release that contains the fix.
sudo dnf update httpdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities at this time.
Conclusion
In conclusion, it is crucial to update the httpd package to address these vulnerabilities and ensure the security of your web server. By updating to version 2.4.57-11.el9_4 or later, you can mitigate the risk of potential attacks.
See every vulnerability recorded for httpd →
FAQ
These vulnerabilities could allow an attacker to execute arbitrary code, bypass security restrictions, or perform server-side request forgery (SSRF) attacks.
There are no known exploits for these vulnerabilities at this time.
Yes, it is recommended to restart the httpd service after applying the update to ensure the changes take effect.
Yes, these vulnerabilities can be exploited remotely by sending specially crafted requests to the affected server.
The CVSS scores for these vulnerabilities have not been provided in the available information.
Related vulnerabilities
Recent vulnerabilities recorded for httpd.
