| Name | CVE-2024-38474 |
| Description | Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI. Users are recommended to upgrade to version 2.4.60, which fixes this issue. Some RewriteRules that capture and substitute unsafely will now fail unless rewrite flag "UnsafeAllow3F" is specified. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DSA-5729-1, ELA-1182-1, ELA-1183-1 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| apache2 (PTS) | jessie, jessie (lts) | 2.4.10-10+deb8u29 | fixed |
| stretch (security) | 2.4.25-3+deb9u13 | vulnerable | |
| stretch (lts), stretch | 2.4.25-3+deb9u19 | fixed | |
| buster, buster (lts) | 2.4.59-1~deb10u4 | fixed | |
| buster (security) | 2.4.59-1~deb10u1 | vulnerable | |
| bullseye | 2.4.62-1~deb11u1 | fixed | |
| bullseye (security) | 2.4.62-1~deb11u2 | fixed | |
| bookworm (security), bookworm | 2.4.62-1~deb12u2 | fixed | |
| sid, trixie | 2.4.62-3 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| apache2 | source | jessie | 2.4.10-10+deb8u29 | ELA-1183-1 | ||
| apache2 | source | stretch | 2.4.25-3+deb9u19 | ELA-1183-1 | ||
| apache2 | source | buster | 2.4.59-1~deb10u3 | ELA-1182-1 | ||
| apache2 | source | bullseye | 2.4.61-1~deb11u1 | DSA-5729-1 | ||
| apache2 | source | bookworm | 2.4.61-1~deb12u1 | DSA-5729-1 | ||
| apache2 | source | (unstable) | 2.4.60-1 |
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2024-38474
same fix as CVE-2024-28475
Fixed [1/2] https://github.com/apache/httpd/commit/1feb5e04a4f7b5f3f13cd40f9635144319dcf24a
need also log fix [2/2] https://github.com/apache/httpd/commit/4797330ad813d9f8a2bb1b3b8d03ceb523dc4884
regression: bug https://bz.apache.org/bugzilla/show_bug.cgi?id=69197
regression: tracked at https://bugs.debian.org/1079172
regression: Fixed by: https://github.com/apache/httpd/commit/a1a93beb58b81f1de2b713ae5f96c41ed5952a74 (trunk)
regression: Fixed by: https://github.com/apache/httpd/commit/a0a68b99d131741c1867cff321424892838fc4b3 (2.4.x)
(or https://svn.apache.org/viewvc?view=revision&revision=1918561)