(RHSA-2024:6467) Important: httpd:2.4 security update

2024-09-0901:03:06

access.redhat.com

httpd

security fix

cve-2024-38476

unix

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.018

Percentile

88.5%

JSON

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

httpd: Security issues via?backend applications whose response headers are malicious or exploitable (CVE-2024-38476)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

OSVersionArchitecturePackageVersionFilename
RedHatanyppc64lemod_session-debuginfo< 2.4.37-39.module+el8.4.0+22233+7f67fd1f.9mod_session-debuginfo-2.4.37-39.module+el8.4.0+22233+7f67fd1f.9.ppc64le.rpm
RedHatanyppc64lemod_session< 2.4.37-39.module+el8.4.0+22233+7f67fd1f.9mod_session-2.4.37-39.module+el8.4.0+22233+7f67fd1f.9.ppc64le.rpm
RedHatanyx86_64httpd-debugsource< 2.4.37-39.module+el8.4.0+22233+7f67fd1f.9httpd-debugsource-2.4.37-39.module+el8.4.0+22233+7f67fd1f.9.x86_64.rpm
RedHatanyx86_64mod_session< 2.4.37-39.module+el8.4.0+22233+7f67fd1f.9mod_session-2.4.37-39.module+el8.4.0+22233+7f67fd1f.9.x86_64.rpm
RedHatanyx86_64httpd-debuginfo< 2.4.37-39.module+el8.4.0+22233+7f67fd1f.9httpd-debuginfo-2.4.37-39.module+el8.4.0+22233+7f67fd1f.9.x86_64.rpm
RedHatanyx86_64mod_ldap< 2.4.37-39.module+el8.4.0+22233+7f67fd1f.9mod_ldap-2.4.37-39.module+el8.4.0+22233+7f67fd1f.9.x86_64.rpm
RedHatanyppc64lemod_http2-debugsource< 1.15.7-3.module+el8.4.0+21747+916a74df.3mod_http2-debugsource-1.15.7-3.module+el8.4.0+21747+916a74df.3.ppc64le.rpm
RedHatanyx86_64mod_ssl-debuginfo< 2.4.37-39.module+el8.4.0+22233+7f67fd1f.9mod_ssl-debuginfo-2.4.37-39.module+el8.4.0+22233+7f67fd1f.9.x86_64.rpm
RedHatanyppc64lehttpd-devel< 2.4.37-39.module+el8.4.0+22233+7f67fd1f.9httpd-devel-2.4.37-39.module+el8.4.0+22233+7f67fd1f.9.ppc64le.rpm
RedHatanyx86_64mod_md< 2.0.8-8.module+el8.3.0+6814+67d1e611mod_md-2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
RedHat	any	ppc64le	mod_session-debuginfo	< 2.4.37-39.module+el8.4.0+22233+7f67fd1f.9	mod_session-debuginfo-2.4.37-39.module+el8.4.0+22233+7f67fd1f.9.ppc64le.rpm
RedHat	any	ppc64le	mod_session	< 2.4.37-39.module+el8.4.0+22233+7f67fd1f.9	mod_session-2.4.37-39.module+el8.4.0+22233+7f67fd1f.9.ppc64le.rpm
RedHat	any	x86_64	httpd-debugsource	< 2.4.37-39.module+el8.4.0+22233+7f67fd1f.9	httpd-debugsource-2.4.37-39.module+el8.4.0+22233+7f67fd1f.9.x86_64.rpm
RedHat	any	x86_64	mod_session	< 2.4.37-39.module+el8.4.0+22233+7f67fd1f.9	mod_session-2.4.37-39.module+el8.4.0+22233+7f67fd1f.9.x86_64.rpm
RedHat	any	x86_64	httpd-debuginfo	< 2.4.37-39.module+el8.4.0+22233+7f67fd1f.9	httpd-debuginfo-2.4.37-39.module+el8.4.0+22233+7f67fd1f.9.x86_64.rpm
RedHat	any	x86_64	mod_ldap	< 2.4.37-39.module+el8.4.0+22233+7f67fd1f.9	mod_ldap-2.4.37-39.module+el8.4.0+22233+7f67fd1f.9.x86_64.rpm
RedHat	any	ppc64le	mod_http2-debugsource	< 1.15.7-3.module+el8.4.0+21747+916a74df.3	mod_http2-debugsource-1.15.7-3.module+el8.4.0+21747+916a74df.3.ppc64le.rpm
RedHat	any	x86_64	mod_ssl-debuginfo	< 2.4.37-39.module+el8.4.0+22233+7f67fd1f.9	mod_ssl-debuginfo-2.4.37-39.module+el8.4.0+22233+7f67fd1f.9.x86_64.rpm
RedHat	any	ppc64le	httpd-devel	< 2.4.37-39.module+el8.4.0+22233+7f67fd1f.9	httpd-devel-2.4.37-39.module+el8.4.0+22233+7f67fd1f.9.ppc64le.rpm
RedHat	any	x86_64	mod_md	< 2.0.8-8.module+el8.3.0+6814+67d1e611	mod_md-2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64.rpm