Lucene search

Debian Security Bug TrackerDEBIANCVE:CVE-2024-38472

HistoryJul 01, 2024 - 7:15 p.m.

CVE-2024-38472

2024-07-0119:15:04

Debian Security Bug Tracker

security-tracker.debian.org

ssrf

apache http server

windows

ntml hashes

malicious requests

upgrade

unc paths

6.6 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.2%

JSON

SSRF in Apache HTTP Server on Windows allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue. Note: Existing configurations that access UNC paths will have to configure new directive “UNCList” to allow access during request processing.

OSVersionArchitecturePackageVersionFilename
Debian12allapache2<= 2.4.59-1~deb12u1apache2_2.4.59-1~deb12u1_all.deb
Debian11allapache2<= 2.4.59-1~deb11u1apache2_2.4.59-1~deb11u1_all.deb
Debian999allapache2< 2.4.60-1apache2_2.4.60-1_all.deb
Debian13allapache2<= 2.4.59-2apache2_2.4.59-2_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	apache2	<= 2.4.59-1~deb12u1	apache2_2.4.59-1~deb12u1_all.deb
Debian	11	all	apache2	<= 2.4.59-1~deb11u1	apache2_2.4.59-1~deb11u1_all.deb
Debian	999	all	apache2	< 2.4.60-1	apache2_2.4.60-1_all.deb
Debian	13	all	apache2	<= 2.4.59-2	apache2_2.4.59-2_all.deb