Vulnerability-Lookup

ESSA-2024:0620

Vulnerability from csaf_opensuse - Published: 2024-09-17 10:09 - Updated: 2026-09-20 10:51

Summary

httpd: security fixes equal to RHSA-2024:4943

Severity

Moderate

Notes

Title of the patch: httpd: security fixes equal to RHSA-2024:4943

Description of the patch: This security update provides a functional equivalent of RHSA-2024:4943. The original RedHat(R) advisory is available from the RedHat web site at https://access.redhat.com/errata/RHSA-2024:4943

Patchnames: ESSA-2024:0620

CVE-2024-38474

8.2 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: SUSE Liberty Linux 7 LTSS:httpd-0:2.4.6-99.el7_9.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7 LTSS:httpd-devel-0:2.4.6-99.el7_9.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7 LTSS:httpd-manual-0:2.4.6-99.el7_9.3.noarch	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7 LTSS:httpd-tools-0:2.4.6-99.el7_9.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7 LTSS:mod_ldap-0:2.4.6-99.el7_9.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7 LTSS:mod_proxy_html-1:2.4.6-99.el7_9.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7 LTSS:mod_session-0:2.4.6-99.el7_9.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Liberty Linux 7 LTSS:mod_ssl-1:2.4.6-99.el7_9.3.x86_64	—	Vendor Fix

Threats

Impact important

CVE-2024-38475

8.2 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Affected products

Recommended 8 products, the same list as for CVE-2024-38474

Threats

Impact important

CVE-2024-38477

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 8 products, the same list as for CVE-2024-38474

Threats

Impact important

References

13 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/e…	self
https://lists.suse.com/pipermail/suse-liberty-lin…	self
https://lists.suse.com/pipermail/suse-liberty-lin…	self
https://www.suse.com/security/cve/CVE-2024-38474/	self
https://www.suse.com/security/cve/CVE-2024-38475/	self
https://www.suse.com/security/cve/CVE-2024-38477/	self
https://www.suse.com/security/cve/CVE-2024-38474	external
https://bugzilla.suse.com/1227278	external
https://www.suse.com/security/cve/CVE-2024-38475	external
https://bugzilla.suse.com/1227268	external
https://www.suse.com/security/cve/CVE-2024-38477	external
https://bugzilla.suse.com/1227270	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "httpd: security fixes equal to RHSA-2024:4943",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This security update provides a functional equivalent of RHSA-2024:4943. The original RedHat(R) advisory is available from the RedHat web site at https://access.redhat.com/errata/RHSA-2024:4943",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "ESSA-2024:0620",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/essa-2024_0620.json"
      },
      {
        "category": "self",
        "summary": "URL for ESSA-2024:0620",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2024-September/000036.html"
      },
      {
        "category": "self",
        "summary": "E-Mail link for ESSA-2024:0620",
        "url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2024-September/000036.html"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-38474 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-38474/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-38475 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-38475/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-38477 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-38477/"
      }
    ],
    "title": "httpd: security fixes equal to RHSA-2024:4943",
    "tracking": {
      "current_release_date": "2026-09-20T10:51:03Z",
      "generator": {
        "date": "2024-09-17T10:09:48Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "ESSA-2024:0620",
      "initial_release_date": "2024-09-17T10:09:48Z",
      "revision_history": [
        {
          "date": "2024-09-17T10:09:48Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-20T10:51:03Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "httpd-manual-0:2.4.6-99.el7_9.3.noarch",
                "product": {
                  "name": "httpd-manual-0:2.4.6-99.el7_9.3.noarch",
                  "product_id": "httpd-manual-0:2.4.6-99.el7_9.3.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/httpd-manual@2.4.6-99.el7_9.3?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "httpd-0:2.4.6-99.el7_9.3.x86_64",
                "product": {
                  "name": "httpd-0:2.4.6-99.el7_9.3.x86_64",
                  "product_id": "httpd-0:2.4.6-99.el7_9.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/httpd@2.4.6-99.el7_9.3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-devel-0:2.4.6-99.el7_9.3.x86_64",
                "product": {
                  "name": "httpd-devel-0:2.4.6-99.el7_9.3.x86_64",
                  "product_id": "httpd-devel-0:2.4.6-99.el7_9.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/httpd-devel@2.4.6-99.el7_9.3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd-tools-0:2.4.6-99.el7_9.3.x86_64",
                "product": {
                  "name": "httpd-tools-0:2.4.6-99.el7_9.3.x86_64",
                  "product_id": "httpd-tools-0:2.4.6-99.el7_9.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/httpd-tools@2.4.6-99.el7_9.3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_ldap-0:2.4.6-99.el7_9.3.x86_64",
                "product": {
                  "name": "mod_ldap-0:2.4.6-99.el7_9.3.x86_64",
                  "product_id": "mod_ldap-0:2.4.6-99.el7_9.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/mod_ldap@2.4.6-99.el7_9.3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_proxy_html-1:2.4.6-99.el7_9.3.x86_64",
                "product": {
                  "name": "mod_proxy_html-1:2.4.6-99.el7_9.3.x86_64",
                  "product_id": "mod_proxy_html-1:2.4.6-99.el7_9.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/mod_proxy_html@2.4.6-99.el7_9.3?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_session-0:2.4.6-99.el7_9.3.x86_64",
                "product": {
                  "name": "mod_session-0:2.4.6-99.el7_9.3.x86_64",
                  "product_id": "mod_session-0:2.4.6-99.el7_9.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/mod_session@2.4.6-99.el7_9.3?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_ssl-1:2.4.6-99.el7_9.3.x86_64",
                "product": {
                  "name": "mod_ssl-1:2.4.6-99.el7_9.3.x86_64",
                  "product_id": "mod_ssl-1:2.4.6-99.el7_9.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/mod_ssl@2.4.6-99.el7_9.3?arch=x86_64\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 7 LTSS",
                "product": {
                  "name": "SUSE Liberty Linux 7 LTSS",
                  "product_id": "SUSE Liberty Linux 7 LTSS"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-0:2.4.6-99.el7_9.3.x86_64 as component of SUSE Liberty Linux 7 LTSS",
          "product_id": "SUSE Liberty Linux 7 LTSS:httpd-0:2.4.6-99.el7_9.3.x86_64"
        },
        "product_reference": "httpd-0:2.4.6-99.el7_9.3.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7 LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-devel-0:2.4.6-99.el7_9.3.x86_64 as component of SUSE Liberty Linux 7 LTSS",
          "product_id": "SUSE Liberty Linux 7 LTSS:httpd-devel-0:2.4.6-99.el7_9.3.x86_64"
        },
        "product_reference": "httpd-devel-0:2.4.6-99.el7_9.3.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7 LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-manual-0:2.4.6-99.el7_9.3.noarch as component of SUSE Liberty Linux 7 LTSS",
          "product_id": "SUSE Liberty Linux 7 LTSS:httpd-manual-0:2.4.6-99.el7_9.3.noarch"
        },
        "product_reference": "httpd-manual-0:2.4.6-99.el7_9.3.noarch",
        "relates_to_product_reference": "SUSE Liberty Linux 7 LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd-tools-0:2.4.6-99.el7_9.3.x86_64 as component of SUSE Liberty Linux 7 LTSS",
          "product_id": "SUSE Liberty Linux 7 LTSS:httpd-tools-0:2.4.6-99.el7_9.3.x86_64"
        },
        "product_reference": "httpd-tools-0:2.4.6-99.el7_9.3.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7 LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_ldap-0:2.4.6-99.el7_9.3.x86_64 as component of SUSE Liberty Linux 7 LTSS",
          "product_id": "SUSE Liberty Linux 7 LTSS:mod_ldap-0:2.4.6-99.el7_9.3.x86_64"
        },
        "product_reference": "mod_ldap-0:2.4.6-99.el7_9.3.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7 LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_proxy_html-1:2.4.6-99.el7_9.3.x86_64 as component of SUSE Liberty Linux 7 LTSS",
          "product_id": "SUSE Liberty Linux 7 LTSS:mod_proxy_html-1:2.4.6-99.el7_9.3.x86_64"
        },
        "product_reference": "mod_proxy_html-1:2.4.6-99.el7_9.3.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7 LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_session-0:2.4.6-99.el7_9.3.x86_64 as component of SUSE Liberty Linux 7 LTSS",
          "product_id": "SUSE Liberty Linux 7 LTSS:mod_session-0:2.4.6-99.el7_9.3.x86_64"
        },
        "product_reference": "mod_session-0:2.4.6-99.el7_9.3.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7 LTSS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_ssl-1:2.4.6-99.el7_9.3.x86_64 as component of SUSE Liberty Linux 7 LTSS",
          "product_id": "SUSE Liberty Linux 7 LTSS:mod_ssl-1:2.4.6-99.el7_9.3.x86_64"
        },
        "product_reference": "mod_ssl-1:2.4.6-99.el7_9.3.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7 LTSS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-38474",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-38474"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in\ndirectories permitted by the configuration but not directly reachable by any  URL or source disclosure of scripts meant to only to be executed as CGI.\n\nUsers are recommended to upgrade to version 2.4.60, which fixes this issue.\n\nSome RewriteRules that capture and substitute unsafely will now fail unless rewrite flag \"UnsafeAllow3F\" is specified.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7 LTSS:httpd-0:2.4.6-99.el7_9.3.x86_64",
          "SUSE Liberty Linux 7 LTSS:httpd-devel-0:2.4.6-99.el7_9.3.x86_64",
          "SUSE Liberty Linux 7 LTSS:httpd-manual-0:2.4.6-99.el7_9.3.noarch",
          "SUSE Liberty Linux 7 LTSS:httpd-tools-0:2.4.6-99.el7_9.3.x86_64",
          "SUSE Liberty Linux 7 LTSS:mod_ldap-0:2.4.6-99.el7_9.3.x86_64",
          "SUSE Liberty Linux 7 LTSS:mod_proxy_html-1:2.4.6-99.el7_9.3.x86_64",
          "SUSE Liberty Linux 7 LTSS:mod_session-0:2.4.6-99.el7_9.3.x86_64",
          "SUSE Liberty Linux 7 LTSS:mod_ssl-1:2.4.6-99.el7_9.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-38474",
          "url": "https://www.suse.com/security/cve/CVE-2024-38474"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1227278 for CVE-2024-38474",
          "url": "https://bugzilla.suse.com/1227278"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7 LTSS:httpd-0:2.4.6-99.el7_9.3.x86_64",
            "SUSE Liberty Linux 7 LTSS:httpd-devel-0:2.4.6-99.el7_9.3.x86_64",
            "SUSE Liberty Linux 7 LTSS:httpd-manual-0:2.4.6-99.el7_9.3.noarch",
            "SUSE Liberty Linux 7 LTSS:httpd-tools-0:2.4.6-99.el7_9.3.x86_64",
            "SUSE Liberty Linux 7 LTSS:mod_ldap-0:2.4.6-99.el7_9.3.x86_64",
            "SUSE Liberty Linux 7 LTSS:mod_proxy_html-1:2.4.6-99.el7_9.3.x86_64",
            "SUSE Liberty Linux 7 LTSS:mod_session-0:2.4.6-99.el7_9.3.x86_64",
            "SUSE Liberty Linux 7 LTSS:mod_ssl-1:2.4.6-99.el7_9.3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 7 LTSS:httpd-0:2.4.6-99.el7_9.3.x86_64",
            "SUSE Liberty Linux 7 LTSS:httpd-devel-0:2.4.6-99.el7_9.3.x86_64",
            "SUSE Liberty Linux 7 LTSS:httpd-manual-0:2.4.6-99.el7_9.3.noarch",
            "SUSE Liberty Linux 7 LTSS:httpd-tools-0:2.4.6-99.el7_9.3.x86_64",
            "SUSE Liberty Linux 7 LTSS:mod_ldap-0:2.4.6-99.el7_9.3.x86_64",
            "SUSE Liberty Linux 7 LTSS:mod_proxy_html-1:2.4.6-99.el7_9.3.x86_64",
            "SUSE Liberty Linux 7 LTSS:mod_session-0:2.4.6-99.el7_9.3.x86_64",
            "SUSE Liberty Linux 7 LTSS:mod_ssl-1:2.4.6-99.el7_9.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-09-17T10:09:48Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-38474"
    },
    {
      "cve": "CVE-2024-38475",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-38475"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are  permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. \n\nSubstitutions in  server context that use a backreferences or variables as the first segment of the substitution are affected.   Some unsafe RewiteRules will be broken by this change and the rewrite flag \"UnsafePrefixStat\" can be used to opt back in once ensuring the substitution is appropriately constrained.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7 LTSS:httpd-0:2.4.6-99.el7_9.3.x86_64",
          "SUSE Liberty Linux 7 LTSS:httpd-devel-0:2.4.6-99.el7_9.3.x86_64",
          "SUSE Liberty Linux 7 LTSS:httpd-manual-0:2.4.6-99.el7_9.3.noarch",
          "SUSE Liberty Linux 7 LTSS:httpd-tools-0:2.4.6-99.el7_9.3.x86_64",
          "SUSE Liberty Linux 7 LTSS:mod_ldap-0:2.4.6-99.el7_9.3.x86_64",
          "SUSE Liberty Linux 7 LTSS:mod_proxy_html-1:2.4.6-99.el7_9.3.x86_64",
          "SUSE Liberty Linux 7 LTSS:mod_session-0:2.4.6-99.el7_9.3.x86_64",
          "SUSE Liberty Linux 7 LTSS:mod_ssl-1:2.4.6-99.el7_9.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-38475",
          "url": "https://www.suse.com/security/cve/CVE-2024-38475"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1227268 for CVE-2024-38475",
          "url": "https://bugzilla.suse.com/1227268"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7 LTSS:httpd-0:2.4.6-99.el7_9.3.x86_64",
            "SUSE Liberty Linux 7 LTSS:httpd-devel-0:2.4.6-99.el7_9.3.x86_64",
            "SUSE Liberty Linux 7 LTSS:httpd-manual-0:2.4.6-99.el7_9.3.noarch",
            "SUSE Liberty Linux 7 LTSS:httpd-tools-0:2.4.6-99.el7_9.3.x86_64",
            "SUSE Liberty Linux 7 LTSS:mod_ldap-0:2.4.6-99.el7_9.3.x86_64",
            "SUSE Liberty Linux 7 LTSS:mod_proxy_html-1:2.4.6-99.el7_9.3.x86_64",
            "SUSE Liberty Linux 7 LTSS:mod_session-0:2.4.6-99.el7_9.3.x86_64",
            "SUSE Liberty Linux 7 LTSS:mod_ssl-1:2.4.6-99.el7_9.3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 7 LTSS:httpd-0:2.4.6-99.el7_9.3.x86_64",
            "SUSE Liberty Linux 7 LTSS:httpd-devel-0:2.4.6-99.el7_9.3.x86_64",
            "SUSE Liberty Linux 7 LTSS:httpd-manual-0:2.4.6-99.el7_9.3.noarch",
            "SUSE Liberty Linux 7 LTSS:httpd-tools-0:2.4.6-99.el7_9.3.x86_64",
            "SUSE Liberty Linux 7 LTSS:mod_ldap-0:2.4.6-99.el7_9.3.x86_64",
            "SUSE Liberty Linux 7 LTSS:mod_proxy_html-1:2.4.6-99.el7_9.3.x86_64",
            "SUSE Liberty Linux 7 LTSS:mod_session-0:2.4.6-99.el7_9.3.x86_64",
            "SUSE Liberty Linux 7 LTSS:mod_ssl-1:2.4.6-99.el7_9.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-09-17T10:09:48Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-38475"
    },
    {
      "cve": "CVE-2024-38477",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-38477"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request.\nUsers are recommended to upgrade to version 2.4.60, which fixes this issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7 LTSS:httpd-0:2.4.6-99.el7_9.3.x86_64",
          "SUSE Liberty Linux 7 LTSS:httpd-devel-0:2.4.6-99.el7_9.3.x86_64",
          "SUSE Liberty Linux 7 LTSS:httpd-manual-0:2.4.6-99.el7_9.3.noarch",
          "SUSE Liberty Linux 7 LTSS:httpd-tools-0:2.4.6-99.el7_9.3.x86_64",
          "SUSE Liberty Linux 7 LTSS:mod_ldap-0:2.4.6-99.el7_9.3.x86_64",
          "SUSE Liberty Linux 7 LTSS:mod_proxy_html-1:2.4.6-99.el7_9.3.x86_64",
          "SUSE Liberty Linux 7 LTSS:mod_session-0:2.4.6-99.el7_9.3.x86_64",
          "SUSE Liberty Linux 7 LTSS:mod_ssl-1:2.4.6-99.el7_9.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-38477",
          "url": "https://www.suse.com/security/cve/CVE-2024-38477"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1227270 for CVE-2024-38477",
          "url": "https://bugzilla.suse.com/1227270"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7 LTSS:httpd-0:2.4.6-99.el7_9.3.x86_64",
            "SUSE Liberty Linux 7 LTSS:httpd-devel-0:2.4.6-99.el7_9.3.x86_64",
            "SUSE Liberty Linux 7 LTSS:httpd-manual-0:2.4.6-99.el7_9.3.noarch",
            "SUSE Liberty Linux 7 LTSS:httpd-tools-0:2.4.6-99.el7_9.3.x86_64",
            "SUSE Liberty Linux 7 LTSS:mod_ldap-0:2.4.6-99.el7_9.3.x86_64",
            "SUSE Liberty Linux 7 LTSS:mod_proxy_html-1:2.4.6-99.el7_9.3.x86_64",
            "SUSE Liberty Linux 7 LTSS:mod_session-0:2.4.6-99.el7_9.3.x86_64",
            "SUSE Liberty Linux 7 LTSS:mod_ssl-1:2.4.6-99.el7_9.3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Liberty Linux 7 LTSS:httpd-0:2.4.6-99.el7_9.3.x86_64",
            "SUSE Liberty Linux 7 LTSS:httpd-devel-0:2.4.6-99.el7_9.3.x86_64",
            "SUSE Liberty Linux 7 LTSS:httpd-manual-0:2.4.6-99.el7_9.3.noarch",
            "SUSE Liberty Linux 7 LTSS:httpd-tools-0:2.4.6-99.el7_9.3.x86_64",
            "SUSE Liberty Linux 7 LTSS:mod_ldap-0:2.4.6-99.el7_9.3.x86_64",
            "SUSE Liberty Linux 7 LTSS:mod_proxy_html-1:2.4.6-99.el7_9.3.x86_64",
            "SUSE Liberty Linux 7 LTSS:mod_session-0:2.4.6-99.el7_9.3.x86_64",
            "SUSE Liberty Linux 7 LTSS:mod_ssl-1:2.4.6-99.el7_9.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-09-17T10:09:48Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-38477"
    }
  ]
}

CVE-2024-38474 (GCVE-0-2024-38474)

Vulnerability from cvelistv5 – Published: 2024-07-01 18:14 – Updated: 2025-03-25 18:24

Title

Apache HTTP Server weakness with encoded question marks in backreferences

Summary

Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI. Users are recommended to upgrade to version 2.4.60, which fixes this issue. Some RewriteRules that capture and substitute unsafely will now fail unless rewrite flag "UnsafeAllow3F" is specified.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-07-09 18:02 UTC

CWE

CWE-116 - Improper Encoding or Escaping of Output

Assigner

apache mitre root

References

3 references

URL	Tags
https://httpd.apache.org/security/vulnerabilities…	vendor-advisory
https://security.netapp.com/advisory/ntap-2024071…
http://www.openwall.com/lists/oss-security/2024/07/01/7

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache HTTP Server	Affected: 2.4.0 , ≤ 2.4.59 (semver)

Credits

Orange Tsai (@orange_8361) from DEVCORE

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-38474",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-09T18:02:41.305061Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-25T18:24:03.613Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-09-13T17:04:55.485Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240712-0001/"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2024/07/01/7"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache HTTP Server",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.4.59",
              "status": "affected",
              "version": "2.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Orange Tsai (@orange_8361) from DEVCORE"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in\u003cbr\u003edirectories permitted by the configuration but not directly reachable by any\u0026nbsp;URL or source disclosure of scripts meant to only to be executed as CGI.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 2.4.60, which fixes this issue.\u003cbr\u003e\u003cbr\u003eSome RewriteRules that capture and substitute unsafely will now fail unless rewrite flag \"UnsafeAllow3F\" is specified."
            }
          ],
          "value": "Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in\ndirectories permitted by the configuration but not directly reachable by any\u00a0URL or source disclosure of scripts meant to only to be executed as CGI.\n\nUsers are recommended to upgrade to version 2.4.60, which fixes this issue.\n\nSome RewriteRules that capture and substitute unsafely will now fail unless rewrite flag \"UnsafeAllow3F\" is specified."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-116",
              "description": "CWE-116 Improper Encoding or Escaping of Output",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-12T14:06:11.357Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240712-0001/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2024-04-01T12:00:00.000Z",
          "value": "reported"
        }
      ],
      "title": "Apache HTTP Server weakness with encoded question marks in backreferences",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2024-38474",
    "datePublished": "2024-07-01T18:14:47.004Z",
    "dateReserved": "2024-06-17T11:09:02.297Z",
    "dateUpdated": "2025-03-25T18:24:03.613Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-38475 (GCVE-0-2024-38475)

Vulnerability from cvelistv5 – Published: 2024-07-01 18:15 – Updated: 2025-11-03 21:55

Title

Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.

Summary

Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.

Severity

9.1 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: active Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-05-02 03:55 UTC

CWE

CWE-116 - Improper Encoding or Escaping of Output

Assigner

apache mitre root

References

7 references

URL	Tags
https://httpd.apache.org/security/vulnerabilities…	vendor-advisory
https://security.netapp.com/advisory/ntap-2024071…
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource
https://www.blackhat.com/us-24/briefings/schedule…
https://github.com/apache/httpd/commit/9a6157d1e2…
http://www.openwall.com/lists/oss-security/2024/07/01/8
https://psirt.global.sonicwall.com/vuln-detail/SN…

Impacted products

3 products

Vendor	Product	Version
Apache Software Foundation	Apache HTTP Server	Affected: 2.4.0 , ≤ 2.4.59 (semver)
apache	http_server	Affected: 2.4.0 , ≤ 2.4.59 (custom) cpe:2.3:a:apache:http_server:2.4.0:::::::*
netapp	ontap_9	Affected: 0 , < * (custom) cpe:2.3:a:netapp:ontap_9:-:::::::*

Credits

Orange Tsai (@orange_8361) from DEVCORE

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:apache:http_server:2.4.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "http_server",
            "vendor": "apache",
            "versions": [
              {
                "lessThanOrEqual": "2.4.59",
                "status": "affected",
                "version": "2.4.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:netapp:ontap_9:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "ontap_9",
            "vendor": "netapp",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-38475",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-02T03:55:18.245532Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2025-05-01",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38475"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T22:55:50.372Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38475"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2025-05-01T00:00:00.000Z",
            "value": "CVE-2024-38475 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:55:40.951Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://www.blackhat.com/us-24/briefings/schedule/index.html#confusion-attacks-exploiting-hidden-semantic-ambiguity-in-apache-http-server-pre-recorded-40227"
          },
          {
            "url": "https://github.com/apache/httpd/commit/9a6157d1e2f7ab15963020381054b48782bc18cf"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240712-0001/"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2024/07/01/8"
          },
          {
            "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0018"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache HTTP Server",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.4.59",
              "status": "affected",
              "version": "2.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Orange Tsai (@orange_8361) from DEVCORE"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are\u0026nbsp;permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. \u003cbr\u003e\u003cbr\u003eSubstitutions in\u0026nbsp;server context that use a backreferences or variables as the first segment of the substitution are affected.\u0026nbsp; Some unsafe RewiteRules will be broken by this change and the rewrite flag \"UnsafePrefixStat\" can be used to opt back in once ensuring the substitution is appropriately constrained."
            }
          ],
          "value": "Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are\u00a0permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. \n\nSubstitutions in\u00a0server context that use a backreferences or variables as the first segment of the substitution are affected.\u00a0 Some unsafe RewiteRules will be broken by this change and the rewrite flag \"UnsafePrefixStat\" can be used to opt back in once ensuring the substitution is appropriately constrained."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-116",
              "description": "CWE-116 Improper Encoding or Escaping of Output",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-12T14:06:09.772Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240712-0001/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2024-04-01T12:00:00.000Z",
          "value": "reported"
        }
      ],
      "title": "Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2024-38475",
    "datePublished": "2024-07-01T18:15:12.292Z",
    "dateReserved": "2024-06-17T11:09:56.096Z",
    "dateUpdated": "2025-11-03T21:55:40.951Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-38477 (GCVE-0-2024-38477)

Vulnerability from cvelistv5 – Published: 2024-07-01 18:16 – Updated: 2025-11-03 21:55

Title

Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request

Summary

null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request. Users are recommended to upgrade to version 2.4.60, which fixes this issue.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-07-22 16:23 UTC

CWE

CWE-476 - NULL Pointer Dereference

Assigner

apache mitre root

References

4 references

URL	Tags
https://httpd.apache.org/security/vulnerabilities…	vendor-advisory
https://security.netapp.com/advisory/ntap-2024071…
http://www.openwall.com/lists/oss-security/2024/0…
http://seclists.org/fulldisclosure/2024/Oct/11

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache HTTP Server	Affected: 2.4.0 , ≤ 2.4.59 (semver)

Credits

Orange Tsai (@orange_8361) from DEVCORE

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-38477",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-22T16:23:13.858578Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-18T18:36:04.103Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T21:55:44.577Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240712-0001/"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2024/07/01/10"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Oct/11"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache HTTP Server",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.4.59",
              "status": "affected",
              "version": "2.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Orange Tsai (@orange_8361) from DEVCORE"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request.\u003cbr\u003eUsers are recommended to upgrade to version 2.4.60, which fixes this issue."
            }
          ],
          "value": "null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request.\nUsers are recommended to upgrade to version 2.4.60, which fixes this issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "important"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476 NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-12T14:06:17.790Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240712-0001/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2024-04-01T12:00:00.000Z",
          "value": "Reported"
        }
      ],
      "title": "Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2024-38477",
    "datePublished": "2024-07-01T18:16:11.935Z",
    "dateReserved": "2024-06-17T11:11:30.174Z",
    "dateUpdated": "2025-11-03T21:55:44.577Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

ESSA-2024:0620

CVE-2024-38474 (GCVE-0-2024-38474)

CVE-2024-38475 (GCVE-0-2024-38475)

CVE-2024-38477 (GCVE-0-2024-38477)

Tags

Sightings

Nomenclature

Related by attack behaviour