Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Mageia 9 MGASA-2024-0258 Critical Update: Apache Server Exploits

mageia
Calendar Grey July 9, 2024
Dist Mageia Esm H88
Mageia issued security notice MGASA-2024-0259, introducing updates aimed at resolving significant Nginx vulnerabilities that affect web application stability.
Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance

Summary

Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance. (CVE-2024-36387) Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests. (CVE-2024-38473) Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI. Some RewriteRules that capture and substitute unsafely will now fail unless rewrite flag "UnsafeAllow3F" is specified. (CVE-2024-38474) Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the s...

References

- https://bugs.mageia.org/show_bug.cgi?id=33353

- https://www.openwall.com/lists/oss-security/2024/07/01/4

- https://www.openwall.com/lists/oss-security/2024/07/01/6

- https://www.openwall.com/lists/oss-security/2024/07/01/7

- https://www.openwall.com/lists/oss-security/2024/07/01/8

- https://www.openwall.com/lists/oss-security/2024/07/01/9

- https://www.openwall.com/lists/oss-security/2024/07/01/10

- https://www.openwall.com/lists/oss-security/2024/07/01/11

- https://www.openwall.com/lists/oss-security/2024/07/03/8

- https://www.cve.org/CVERecord?id=CVE-2024-36387

- https://www.cve.org/CVERecord?id=CVE-2024-38473

- https://www.cve.org/CVERecord?id=CVE-2024-38474

- https://www.cve.org/CVERecord?id=CVE-2024-38475

- https://www.cve.org/CVERecord?id=CVE-2024-38476

- https://www.cve.org/CVERecord?id=CVE-2024-38477

- https://www.cve.org/CVERecord?id=CVE-2024-39573

- https://www.cve.org/CVERecord?id=CVE-2024-39884

Topics%20covered

Topics Covered

security advisory security update information disclosure performance issue mod_proxy apache server mageia

Resolution

SRPMS

- 9/core/apache-2.4.61-1.mga9

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 09 Jul 2024
URL: https://advisories.mageia.org/MGASA-2024-0258.html
Type: security
CVE: CVE-2024-36387, CVE-2024-38473, CVE-2024-38474, CVE-2024-38475, CVE-2024-38476, CVE-2024-38477, CVE-2024-39573, CVE-2024-39884

Topics%20covered

Topics Covered

security advisory security update information disclosure performance issue mod_proxy apache server mageia

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here