[SECURITY] Fedora 39 Update: httpd-2.4.62-2.fc39

The Apache HTTP Server is a powerful, efficient, and extensible web server...

Fedora 39 : httpd (2024-e83af0855e)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-e83af0855e advisory. - Fix regression introduced by CVE-2024-38474 fix ---- - new version 2.4.62 - Fixes CVE-2024-40725 Tenable has extracted the preceding description...

Amazon Linux 2 : httpd (ALAS-2024-2606)

The version of httpd installed on the remote host is prior to 2.4.62-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2606 advisory. A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based...

Fedora: Security Advisory (FEDORA-2024-e83af0855e)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-42634

CVE-2024-42634 affects the Tenda AC9 router running v15.03.06.42. The vulnerability lies in the httpd binary’s function formWriteFacMac , enabling a command injection that allows an attacker to execute OS commands with root privileges. Impact is stated as full compromise of the device with root a...

CBL Mariner 2.0 Security Update: httpd / mod_http2 (CVE-2024-27316)

The version of httpd / modhttp2 installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-27316 advisory. - HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to genera...

CBL Mariner 2.0 Security Update: httpd (CVE-2023-38709)

The version of httpd installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-38709 advisory. - Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to...

CBL Mariner 2.0 Security Update: httpd (CVE-2024-24795)

The version of httpd installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-24795 advisory. - HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject maliciou...

Important: httpd

Issue Overview: A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosu...

F5 Networks BIG-IP : Apache HTTPD vulnerabilities (K000140620)

The version of F5 Networks BIG-IP installed on the remote host is prior to 16.1.6 / 17.1.2.2 / 17.5.0. It is, therefore, affected by multiple vulnerabilities as referenced in the K000140620 advisory. CVE-2024-38474Substitution encoding issue in modrewrite in Apache HTTP Server 2.4.59 and earlier...

CVE-2024-40725 affecting package httpd for versions less than 2.4.62-1

CVE-2024-40725 affecting package httpd for versions less than 2.4.62-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-27316 affecting package httpd for versions less than 2.4.61-1

CVE-2024-27316 affecting package httpd for versions less than 2.4.61-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-38473 affecting package httpd for versions less than 2.4.61-1

CVE-2024-38473 affecting package httpd for versions less than 2.4.61-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-39884 affecting package httpd for versions less than 2.4.61-1

CVE-2024-39884 affecting package httpd for versions less than 2.4.61-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-36387 affecting package httpd for versions less than 2.4.61-1

CVE-2024-36387 affecting package httpd for versions less than 2.4.61-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-24795 affecting package httpd for versions less than 2.4.61-1

CVE-2024-24795 affecting package httpd for versions less than 2.4.61-1. An upgraded version of the package is available that resolves this issue...

CVE-2023-38709 affecting package httpd for versions less than 2.4.61-1

CVE-2023-38709 affecting package httpd for versions less than 2.4.61-1. An upgraded version of the package is available that resolves this issue...

Oracle Linux 8 : httpd:2.4 (ELSA-2024-5193)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-5193 advisory. - Resolves: RHEL-46040 - httpd:2.4/httpd: Security issues via backend applications whose response headers are malicious or exploitable CVE-2024-38476 - Resolves...

httpd: Improper escaping of output in mod_rewrite

A flaw was found in the modrewrite module of httpd. Improper escaping of output allows an attacker to map URLs to filesystem locations permitted to be served by the server but are not intentionally or directly reachable by any URL. This issue results in code execution or source code disclosure...

httpd: Security issues via backend applications whose response headers are malicious or exploitable

A flaw was found in httpd. Backend applications whose response headers are malicious or exploitable may allow information disclosure, server-side request forgery SSRF or local script execution...