| Name | CVE-2024-38475 |
| Description | Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DSA-5729-1, ELA-1182-1, ELA-1183-1 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| apache2 (PTS) | jessie, jessie (lts) | 2.4.10-10+deb8u29 | fixed |
| stretch (security) | 2.4.25-3+deb9u13 | vulnerable | |
| stretch (lts), stretch | 2.4.25-3+deb9u19 | fixed | |
| buster, buster (lts) | 2.4.59-1~deb10u4 | fixed | |
| buster (security) | 2.4.59-1~deb10u1 | vulnerable | |
| bullseye | 2.4.62-1~deb11u1 | fixed | |
| bullseye (security) | 2.4.62-1~deb11u2 | fixed | |
| bookworm (security), bookworm | 2.4.62-1~deb12u2 | fixed | |
| sid, trixie | 2.4.62-3 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| apache2 | source | jessie | 2.4.10-10+deb8u29 | ELA-1183-1 | ||
| apache2 | source | stretch | 2.4.25-3+deb9u19 | ELA-1183-1 | ||
| apache2 | source | buster | 2.4.59-1~deb10u3 | ELA-1182-1 | ||
| apache2 | source | bullseye | 2.4.61-1~deb11u1 | DSA-5729-1 | ||
| apache2 | source | bookworm | 2.4.61-1~deb12u1 | DSA-5729-1 | ||
| apache2 | source | (unstable) | 2.4.60-1 |
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2024-38475
same fix as CVE-2024-28474
Fixed [1/2] https://github.com/apache/httpd/commit/1feb5e04a4f7b5f3f13cd40f9635144319dcf24a
need also log fix [2/2] https://github.com/apache/httpd/commit/4797330ad813d9f8a2bb1b3b8d03ceb523dc4884
regression: bug https://bz.apache.org/bugzilla/show_bug.cgi?id=69197
regression: tracked at https://bugs.debian.org/1079172
regression: Fixed by: https://github.com/apache/httpd/commit/a1a93beb58b81f1de2b713ae5f96c41ed5952a74 (trunk)
regression: Fixed by: https://github.com/apache/httpd/commit/a0a68b99d131741c1867cff321424892838fc4b3 (2.4.x)
(or https://svn.apache.org/viewvc?view=revision&revision=1918561)