CVE-2024-24795

2024-04-0400:00:00

ubuntu.com

apache http server

http response splitting

upgrade to 2.4.59

http desynchronization attack

backend applications

cve-2024-24795

7.5 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

10.0%

JSON

HTTP Response splitting in multiple modules in Apache HTTP Server allows an
attacker that can inject malicious response headers into backend
applications to cause an HTTP desynchronization attack. Users are
recommended to upgrade to version 2.4.59, which fixes this issue.

Bugs

<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068412>

Notes

Author	Note
leosilva	after this update reports were made that fossil package stopped to work properly (LP: #2064509).

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchapache2< 2.4.29-1ubuntu4.27+esm2UNKNOWN
ubuntu20.04noarchapache2< 2.4.41-4ubuntu3.17UNKNOWN
ubuntu22.04noarchapache2< 2.4.52-1ubuntu4.9UNKNOWN
ubuntu23.10noarchapache2< 2.4.57-2ubuntu2.4UNKNOWN
ubuntu24.04noarchapache2< 2.4.58-1ubuntu8.1UNKNOWN
ubuntu14.04noarchapache2< anyUNKNOWN
ubuntu16.04noarchapache2< 2.4.18-2ubuntu3.17+esm12UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	apache2	< 2.4.29-1ubuntu4.27+esm2	UNKNOWN
ubuntu	20.04	noarch	apache2	< 2.4.41-4ubuntu3.17	UNKNOWN
ubuntu	22.04	noarch	apache2	< 2.4.52-1ubuntu4.9	UNKNOWN
ubuntu	23.10	noarch	apache2	< 2.4.57-2ubuntu2.4	UNKNOWN
ubuntu	24.04	noarch	apache2	< 2.4.58-1ubuntu8.1	UNKNOWN
ubuntu	14.04	noarch	apache2	< any	UNKNOWN
ubuntu	16.04	noarch	apache2	< 2.4.18-2ubuntu3.17+esm12	UNKNOWN