Important: httpd:2.4 security update

2024-08-1200:00:00

errata.almalinux.org

apache http server

security update

cve-2024-38476

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

6.9

Confidence

Low

EPSS

0.018

Percentile

88.5%

JSON

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

httpd: Security issues via?backend applications whose response headers are malicious or exploitable (CVE-2024-38476)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

OSVersionArchitecturePackageVersionFilename
almalinux8noarchhttpd-manual< 2.4.37-65.module_el8.10.0+3874+c2064c23.2httpd-manual-2.4.37-65.module_el8.10.0+3874+c2064c23.2.noarch.rpm
almalinux8noarchhttpd-filesystem< 2.4.37-65.module_el8.10.0+3874+c2064c23.2httpd-filesystem-2.4.37-65.module_el8.10.0+3874+c2064c23.2.noarch.rpm
almalinux8aarch64httpd-devel< 2.4.37-65.module_el8.10.0+3874+c2064c23.2httpd-devel-2.4.37-65.module_el8.10.0+3874+c2064c23.2.aarch64.rpm
almalinux8aarch64mod_md< 2.0.8-8.module_el8.6.0+2872+fe0ff7aamod_md-2.0.8-8.module_el8.6.0+2872+fe0ff7aa.aarch64.rpm
almalinux8aarch64mod_proxy_html< 2.4.37-65.module_el8.10.0+3874+c2064c23.2mod_proxy_html-2.4.37-65.module_el8.10.0+3874+c2064c23.2.aarch64.rpm
almalinux8aarch64mod_http2< 1.15.7-10.module_el8.10.0+3832+564e7653mod_http2-1.15.7-10.module_el8.10.0+3832+564e7653.aarch64.rpm
almalinux8aarch64httpd-tools< 2.4.37-65.module_el8.10.0+3874+c2064c23.2httpd-tools-2.4.37-65.module_el8.10.0+3874+c2064c23.2.aarch64.rpm
almalinux8aarch64httpd< 2.4.37-65.module_el8.10.0+3874+c2064c23.2httpd-2.4.37-65.module_el8.10.0+3874+c2064c23.2.aarch64.rpm
almalinux8aarch64mod_session< 2.4.37-65.module_el8.10.0+3874+c2064c23.2mod_session-2.4.37-65.module_el8.10.0+3874+c2064c23.2.aarch64.rpm
almalinux8aarch64mod_ssl< 2.4.37-65.module_el8.10.0+3874+c2064c23.2mod_ssl-2.4.37-65.module_el8.10.0+3874+c2064c23.2.aarch64.rpm

OS	Version	Architecture	Package	Version	Filename
almalinux	8	noarch	httpd-manual	< 2.4.37-65.module_el8.10.0+3874+c2064c23.2	httpd-manual-2.4.37-65.module_el8.10.0+3874+c2064c23.2.noarch.rpm
almalinux	8	noarch	httpd-filesystem	< 2.4.37-65.module_el8.10.0+3874+c2064c23.2	httpd-filesystem-2.4.37-65.module_el8.10.0+3874+c2064c23.2.noarch.rpm
almalinux	8	aarch64	httpd-devel	< 2.4.37-65.module_el8.10.0+3874+c2064c23.2	httpd-devel-2.4.37-65.module_el8.10.0+3874+c2064c23.2.aarch64.rpm
almalinux	8	aarch64	mod_md	< 2.0.8-8.module_el8.6.0+2872+fe0ff7aa	mod_md-2.0.8-8.module_el8.6.0+2872+fe0ff7aa.aarch64.rpm
almalinux	8	aarch64	mod_proxy_html	< 2.4.37-65.module_el8.10.0+3874+c2064c23.2	mod_proxy_html-2.4.37-65.module_el8.10.0+3874+c2064c23.2.aarch64.rpm
almalinux	8	aarch64	mod_http2	< 1.15.7-10.module_el8.10.0+3832+564e7653	mod_http2-1.15.7-10.module_el8.10.0+3832+564e7653.aarch64.rpm
almalinux	8	aarch64	httpd-tools	< 2.4.37-65.module_el8.10.0+3874+c2064c23.2	httpd-tools-2.4.37-65.module_el8.10.0+3874+c2064c23.2.aarch64.rpm
almalinux	8	aarch64	httpd	< 2.4.37-65.module_el8.10.0+3874+c2064c23.2	httpd-2.4.37-65.module_el8.10.0+3874+c2064c23.2.aarch64.rpm
almalinux	8	aarch64	mod_session	< 2.4.37-65.module_el8.10.0+3874+c2064c23.2	mod_session-2.4.37-65.module_el8.10.0+3874+c2064c23.2.aarch64.rpm
almalinux	8	aarch64	mod_ssl	< 2.4.37-65.module_el8.10.0+3874+c2064c23.2	mod_ssl-2.4.37-65.module_el8.10.0+3874+c2064c23.2.aarch64.rpm