Summary
It was discovered that the Apache HTTP Server incorrectly handled certain
handlers configured via AddType. A remote attacker could possibly use this
issue to obtain source code.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | apache2 | 2.4.41-4ubuntu3.21 |
| Ubuntu · 22.04 LTS 22.04:LTS | apache2 | 2.4.52-1ubuntu4.12 |
| Ubuntu · 24.04 LTS 24.04:LTS | apache2 | 2.4.58-1ubuntu8.4 |
Vulnerabilities 1
-
Medium 5.3CVE-2024-40725 Public exploit
Apache HTTP Server: source code disclosure with handlers configured via AddType
A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result …
References
-
report
https://ubuntu.com/security/CVE-2024-40725