Headline
Ubuntu Security Notice USN-6885-1
Ubuntu Security Notice 6885-1 - Marc Stern discovered that the Apache HTTP Server incorrectly handled serving WebSocket protocol upgrades over HTTP/2 connections. A remote attacker could possibly use this issue to cause the server to crash, resulting in a denial of service. Orange Tsai discovered that the Apache HTTP Server mod_proxy module incorrectly sent certain request URLs with incorrect encodings to backends. A remote attacker could possibly use this issue to bypass authentication.
==========================================================================Ubuntu Security Notice USN-6885-1July 08, 2024apache2 vulnerabilities==========================================================================A security issue affects these releases of Ubuntu and its derivatives:- Ubuntu 24.04 LTS- Ubuntu 23.10- Ubuntu 22.04 LTS- Ubuntu 20.04 LTSSummary:Several security issues were fixed in Apache HTTP Server.Software Description:- apache2: Apache HTTP serverDetails:Marc Stern discovered that the Apache HTTP Server incorrectly handledserving WebSocket protocol upgrades over HTTP/2 connections. A remoteattacker could possibly use this issue to cause the server to crash,resulting in a denial of service. (CVE-2024-36387)Orange Tsai discovered that the Apache HTTP Server mod_proxy moduleincorrectly sent certain request URLs with incorrect encodings to backends.A remote attacker could possibly use this issue to bypass authentication.(CVE-2024-38473)Orange Tsai discovered that the Apache HTTP Server mod_rewrite moduleincorrectly handled certain substitutions. A remote attacker could possiblyuse this issue to execute scripts in directories not directly reachableby any URL, or cause a denial of service. Some environments may requireusing the new UnsafeAllow3F flag to handle unsafe substitutions.(CVE-2024-38474, CVE-2024-38475, CVE-2024-39573)Orange Tsai discovered that the Apache HTTP Server incorrectly handledcertain response headers. A remote attacker could possibly use this issueto obtain sensitive information, execute local scripts, or perform SSRFattacks. (CVE-2024-38476)Orange Tsai discovered that the Apache HTTP Server mod_proxy moduleincorrectly handled certain requests. A remote attacker could possibly usethis issue to cause the server to crash, resulting in a denial of service.(CVE-2024-38477)It was discovered that the Apache HTTP Server incorrectly handled certainhandlers configured via AddType. A remote attacker could possibly use thisissue to obtain source code. (CVE-2024-39884)Update instructions:The problem can be corrected by updating your system to the followingpackage versions:Ubuntu 24.04 LTS apache2 2.4.58-1ubuntu8.2Ubuntu 23.10 apache2 2.4.57-2ubuntu2.5Ubuntu 22.04 LTS apache2 2.4.52-1ubuntu4.10Ubuntu 20.04 LTS apache2 2.4.41-4ubuntu3.19In general, a standard system update will make all the necessary changes.References: https://ubuntu.com/security/notices/USN-6885-1 CVE-2024-36387, CVE-2024-38473, CVE-2024-38474, CVE-2024-38475, CVE-2024-38476, CVE-2024-38477, CVE-2024-39573, CVE-2024-39884Package Information: https://launchpad.net/ubuntu/+source/apache2/2.4.58-1ubuntu8.2 https://launchpad.net/ubuntu/+source/apache2/2.4.57-2ubuntu2.5 https://launchpad.net/ubuntu/+source/apache2/2.4.52-1ubuntu4.10 https://launchpad.net/ubuntu/+source/apache2/2.4.41-4ubuntu3.19Related news
Red Hat Security Advisory 2024-8680-03 - An update for mod_http2 is now available for Red Hat Enterprise Linux 9. Issues addressed include denial of service and null pointer vulnerabilities.
Apple Security Advisory 10-28-2024-3 - macOS Sequoia 15.1 addresses bypass, information leakage, out of bounds access, out of bounds read, out of bounds write, and use-after-free vulnerabilities.
Debian Linux Security Advisory 5729-2 - The fixes for CVE-2024-38474 and CVE-2024-39884 introduced two regressions in mod_rewrite and mod_proxy.
Gentoo Linux Security Advisory 202409-31 - Multiple vulnerabilities have been found in Apache HTTPD, the worst of which could result in denial of service. Versions greater than or equal to 2.4.62 are affected.
Red Hat Security Advisory 2024-7101-03 - An update for httpd is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support.
Ubuntu Security Notice 6885-3 - USN-6885-1 fixed several vulnerabilities in Apache. This update provides the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. Orange Tsai discovered that the Apache HTTP Server mod_rewrite module incorrectly handled certain substitutions. A remote attacker could possibly use this issue to execute scripts in directories not directly reachable by any URL, or cause a denial of service. Some environments may require using the new UnsafeAllow3F flag to handle unsafe substitutions.
Red Hat Security Advisory 2024-6584-03 - An update for httpd is now available for Red Hat Enterprise Linux 7.7 Advanced Update Support.
Red Hat Security Advisory 2024-5832-03 - An update for httpd is now available for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions.
Red Hat Security Advisory 2024-5812-03 - An update for httpd is now available for Red Hat Enterprise Linux 9.2 Extended Update Support.
Red Hat Security Advisory 2024-5193-03 - An update for the httpd:2.4 module is now available for Red Hat Enterprise Linux 8.
Red Hat Security Advisory 2024-5001-03 - An update for httpd is now available for Red Hat Enterprise Linux 9.2 Extended Update Support. Issues addressed include a server-side request forgery vulnerability.
Red Hat Security Advisory 2024-4943-03 - An update for httpd is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support.
Red Hat Security Advisory 2024-4938-03 - An update for httpd is now available for Red Hat Enterprise Linux 7.7 Advanced Update Support. Issues addressed include a null pointer vulnerability.
Red Hat Security Advisory 2024-4830-03 - An update for the httpd:2.4 module is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.4 Telecommunications Update Service. Issues addressed include a null pointer vulnerability.
Red Hat Security Advisory 2024-4827-03 - An update for the httpd:2.4 module is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.6 Telecommunications Update Service. Issues addressed include a null pointer vulnerability.
Red Hat Security Advisory 2024-4820-03 - An update for the httpd:2.4 module is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support. Issues addressed include a null pointer vulnerability.
Debian Linux Security Advisory 5729-1 - Multiple vulnerabilities have been discovered in the Apache HTTP server, which may result in authentication bypass, execution of scripts in directories not directly reachable by any URL, server-side request forgery or denial of service.
Ubuntu Security Notice 6885-2 - USN-6885-1 fixed vulnerabilities in Apache HTTP Server. One of the security fixes introduced a regression when proxying requests to a HTTP/2 server. This update fixes the problem. Marc Stern discovered that the Apache HTTP Server incorrectly handled serving WebSocket protocol upgrades over HTTP/2 connections. A remote attacker could possibly use this issue to cause the server to crash, resulting in a denial of service. Orange Tsai discovered that the Apache HTTP Server mod_proxy module incorrectly sent certain request URLs with incorrect encodings to backends. A remote attacker could possibly use this issue to bypass authentication. Orange Tsai discovered that the Apache HTTP Server mod_rewrite module incorrectly handled certain substitutions. A remote attacker could possibly use this issue to execute scripts in directories not directly reachable by any URL, or cause a denial of service. Some environments may require using the new UnsafeAllow3F flag to h...