ALSA-2024:5138 - Important: httpd security update
Summary
ALSA-2024:5138: Important: httpd security update. Affects httpd versions < 2.4.57-11.el9_4.1. Fixed in 2.4.57-11.el9_4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. It is widely used for hosting websites and web applications. The vulnerability affects the httpd package in AlmaLinux 9.
Vulnerability Detail
The vulnerability (CVE-2024-38476) in the httpd package allows for security issues via backend applications whose response headers are malicious or exploitable. This vulnerability can be exploited by attackers to execute arbitrary code or launch other malicious activities. The impact of this vulnerability can be severe, potentially leading to unauthorized access, data breaches, or disruption of services.
How To Fix
Minimum fixed version
2.4.57-11.el9_4.1
This is the first release that contains the fix.
sudo dnf update httpdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The httpd package in AlmaLinux 9 is vulnerable to a security issue (CVE-2024-38476) that can be exploited by attackers to execute arbitrary code or perform other malicious activities. It is crucial to update the httpd package to version 2.4.57-11.el9_4.1 or later to mitigate the risk of unauthorized access, data breaches, or service disruption.
See every vulnerability recorded for httpd →
FAQ
The vulnerability allows attackers to exploit backend applications and execute arbitrary code or perform other malicious activities. This can lead to unauthorized access, data breaches, or disruption of services.
You can check the installed version of the httpd package on your AlmaLinux 9 system. If it is earlier than version 2.4.57-11.el9_4.1, your system is affected and should be updated.
No specific workarounds have been provided for this vulnerability. It is recommended to update the httpd package to the fixed version.
There is no specific information about active exploits at the moment. However, it is crucial to apply the security update as soon as possible to mitigate the risk.
You can find more information about this vulnerability, including the impact, CVSS score, and related details, on the CVE page: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38476
Related vulnerabilities
Recent vulnerabilities recorded for httpd.
