Summary
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.
Security Fix(es):
* httpd: Security issues via?backend applications whose response headers are malicious or exploitable (CVE-2024-38476)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 13
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | httpd | 2.4.37-65.module_el8.10.0+3874+c2064c23.2 |
| AlmaLinux · 8 | httpd-devel | 2.4.37-65.module_el8.10.0+3874+c2064c23.2 |
| AlmaLinux · 8 | httpd-filesystem | 2.4.37-65.module_el8.10.0+3874+c2064c23.2 |
| AlmaLinux · 8 | httpd-manual | 2.4.37-65.module_el8.10.0+3874+c2064c23.2 |
| AlmaLinux · 8 | httpd-tools | 2.4.37-65.module_el8.10.0+3874+c2064c23.2 |
| AlmaLinux · 8 | mod_http2 | 1.15.7-10.module_el8.10.0+3832+564e7653 |
| AlmaLinux · 8 | mod_http2 | 1.15.7-10.module_el8.10.0+3872+9b8ab21e |
| AlmaLinux · 8 | mod_ldap | 2.4.37-65.module_el8.10.0+3874+c2064c23.2 |
| AlmaLinux · 8 | mod_md | 1:2.0.8-8.module_el8.6.0+2872+fe0ff7aa |
| AlmaLinux · 8 | mod_md | 1:2.0.8-8.module_el8.6.0+3031+fb177b09 |
| AlmaLinux · 8 | mod_proxy_html | 1:2.4.37-65.module_el8.10.0+3874+c2064c23.2 |
| AlmaLinux · 8 | mod_session | 2.4.37-65.module_el8.10.0+3874+c2064c23.2 |
| AlmaLinux · 8 | mod_ssl | 1:2.4.37-65.module_el8.10.0+3874+c2064c23.2 |
Vulnerabilities 1
-
Critical 9.8
Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect
Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable. Users are recommended to upgrade to version 2…