Important: httpd security update
Summary
RLSA-2024:4726: Important: httpd security update. Affects httpd versions < 0:2.4.57-11.el9_4. Fixed in 0:2.4.57-11.el9_4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. It is widely used to serve web content and handle HTTP requests. The vulnerability affects the httpd package in Rocky Linux 9.
Vulnerability Detail
The vulnerability in the httpd package includes multiple security issues:
-
Improper escaping of output in mod_rewrite (CVE-2024-38475): This vulnerability allows an attacker to inject malicious code or execute arbitrary commands through crafted HTTP requests.
-
Substitution encoding issue in mod_rewrite (CVE-2024-38474): This vulnerability allows an attacker to bypass security restrictions and perform unauthorized actions.
-
Null pointer dereference in mod_proxy (CVE-2024-38477): This vulnerability can lead to a denial-of-service (DoS) attack by causing the web server to crash.
-
Potential SSRF in mod_rewrite (CVE-2024-39573): This vulnerability allows an attacker to make the web server perform requests to internal or external resources, potentially leading to information disclosure or further attacks.
-
Encoding problem in mod_proxy (CVE-2024-38473): This vulnerability allows an attacker to manipulate the encoding of requests and potentially bypass security measures.
These vulnerabilities have a CVSS score of 9.1, indicating a high severity level.
How To Fix
Minimum fixed version
0:2.4.57-11.el9_4
This is the first release that contains the fix.
sudo dnf update httpdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities at the moment.
Conclusion
The httpd package in Rocky Linux 9 is affected by multiple vulnerabilities, including improper escaping of output, substitution encoding issue, null pointer dereference, potential SSRF, and encoding problem. These vulnerabilities can have severe consequences, such as code injection, unauthorized actions, denial-of-service attacks, and information disclosure. It is crucial to update the httpd package to version 2.4.57-11.el9_4 or later to mitigate these risks.
See every vulnerability recorded for httpd →
FAQ
These vulnerabilities can lead to various security issues, including code injection, unauthorized actions, denial-of-service attacks, and potential information disclosure.
If you are using the httpd package in Rocky Linux 9, and your version is earlier than 2.4.57-11.el9_4, then your system is affected.
There are no known exploits in the wild at the moment. However, it is crucial to update to the latest version to mitigate the risk.
Yes, these vulnerabilities can be exploited remotely by sending crafted HTTP requests to the affected server.
For more details about these vulnerabilities, including the impact, CVSS score, and acknowledgments, refer to the CVE pages listed in the References section.
References
Related vulnerabilities
Recent vulnerabilities recorded for httpd.
