Alerts This Week
Warning Icon 1 1,109
Alerts This Week
Warning Icon 1 1,109

Ubuntu 24.04 LTS USN-6885-2 Critical Advisory on Apache HTTP Server Issues

ubuntu
Calendar Grey July 11, 2024
Dist Ubuntu Esm H88
Ubuntu Security Notice USN-6885-2 July 11, 2024 apache2 regression A security issue affects these re
USN-6885-1 introduced a regression in Apache HTTP Server.

Summary

USN-6885-1 introduced a regression in Apache HTTP Server.

Software Description:

- apache2: Apache HTTP server

Details:

USN-6885-1 fixed vulnerabilities in Apache HTTP Server. One of the security

fixes introduced a regression when proxying requests to a HTTP/2 server.

This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

Marc Stern discovered that the Apache HTTP Server incorrectly handled

serving WebSocket protocol upgrades over HTTP/2 connections. A remote

attacker could possibly use this issue to cause the server to crash,

resulting in a denial of service. (CVE-2024-36387)

Orange Tsai discovered that the Apache HTTP Server mod_proxy module

incorrectly sent certain request URLs with incorrect encodings to backends.

A remote attacker could possibly use this issue to bypass authentication.

(CVE-2024-38473)

Orange Tsai discovered that the Apache HTTP Server mod_rewrite module

incorrectly hand...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory DoS Ubuntu authentication issue Apache HTTP Server information disclosure regression

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
   apache2                         2.4.58-1ubuntu8.3

Ubuntu 22.04 LTS
   apache2                         2.4.52-1ubuntu4.11

Ubuntu 20.04 LTS
   apache2                         2.4.41-4ubuntu3.20

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-6885-2

https://ubuntu.com/security/notices/USN-6885-1

https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/2072648

Severity
critical
Lowest
Low
Medium
High
Critical

Ubuntu Security Notice USN-6885-2

Topics%20covered

Topics Covered

security advisory DoS Ubuntu authentication issue Apache HTTP Server information disclosure regression

Package Information

https://launchpad.net/ubuntu/+source/apache2/2.4.52-1ubuntu4.11
https://launchpad.net/ubuntu/+source/apache2/2.4.41-4ubuntu3.20

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here