Skip to content
OpenAdvisories
Critical 1 exploited CVE RHSA-2024:4820 3 CVEs

Red Hat Security Advisory: httpd:2.4 security update

Published Sep 13, 2024 · Updated Sep 21, 2026

Ecosystem: Red Hat

Fixed packages 22

ReleasePackageFixed in
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream httpd 0:2.4.37-21.module+el8.2.0+22128+68c62a5c.8
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream httpd-debuginfo 0:2.4.37-21.module+el8.2.0+22128+68c62a5c.8
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream httpd-debugsource 0:2.4.37-21.module+el8.2.0+22128+68c62a5c.8
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream httpd-devel 0:2.4.37-21.module+el8.2.0+22128+68c62a5c.8
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream httpd-filesystem 0:2.4.37-21.module+el8.2.0+22128+68c62a5c.8
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream httpd-manual 0:2.4.37-21.module+el8.2.0+22128+68c62a5c.8
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream httpd-tools 0:2.4.37-21.module+el8.2.0+22128+68c62a5c.8
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream httpd-tools-debuginfo 0:2.4.37-21.module+el8.2.0+22128+68c62a5c.8
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream mod_http2 0:1.11.3-3.module+el8.2.0+22123+cf5a147c.4
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream mod_http2-debuginfo 0:1.11.3-3.module+el8.2.0+22123+cf5a147c.4
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream mod_http2-debugsource 0:1.11.3-3.module+el8.2.0+22123+cf5a147c.4
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream mod_ldap 0:2.4.37-21.module+el8.2.0+22128+68c62a5c.8
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream mod_ldap-debuginfo 0:2.4.37-21.module+el8.2.0+22128+68c62a5c.8
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream mod_md 1:2.0.8-7.module+el8.2.0+5531+7e4d69a2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream mod_md-debuginfo 1:2.0.8-7.module+el8.2.0+5531+7e4d69a2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream mod_md-debugsource 1:2.0.8-7.module+el8.2.0+5531+7e4d69a2
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream mod_proxy_html 1:2.4.37-21.module+el8.2.0+22128+68c62a5c.8
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream mod_proxy_html-debuginfo 1:2.4.37-21.module+el8.2.0+22128+68c62a5c.8
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream mod_session 0:2.4.37-21.module+el8.2.0+22128+68c62a5c.8
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream mod_session-debuginfo 0:2.4.37-21.module+el8.2.0+22128+68c62a5c.8
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream mod_ssl 1:2.4.37-21.module+el8.2.0+22128+68c62a5c.8
Red Hat · RHEL 8.2 AUS rhel_aus:8.2::appstream mod_ssl-debuginfo 1:2.4.37-21.module+el8.2.0+22128+68c62a5c.8

Vulnerabilities 3

  • Critical 9.1
    CVE-2024-38475 Exploited Public exploit Scanner template EPSS 100%

    Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.

    Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code…

    Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
    KEV May 1, 2025
  • High 8.1
    CVE-2024-38474

    Apache HTTP Server weakness with encoded question marks in backreferences

    Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be exec…

    Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
  • High 7.5
    CVE-2024-38477

    Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request

    null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request. Users are recommended to upgrade to version 2.4.60, which fixes this issue.

    Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2295013
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2295014
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2295016
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4820.json
  • report
    https://access.redhat.com/security/cve/CVE-2024-38474
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-38474
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-38474
  • article
    https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2024-38474
  • report
    https://access.redhat.com/security/cve/CVE-2024-38475
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-38475
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-38475
  • article
    https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2024-38475
  • article
    https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  • report
    https://access.redhat.com/security/cve/CVE-2024-38477
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-38477
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-38477
  • article
    https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2024-38477