Red Hat Http Server
Recent Red Hat Http Server Security Advisories
| Advisory | Title | Published |
|---|---|---|
| RHSA-2024:6928 | (RHSA-2024:6928) Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP6 security update | September 24, 2024 |
| RHSA-2024:6927 | (RHSA-2024:6927) Moderate: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP6 security update | September 24, 2024 |
| RHSA-2024:5239 | (RHSA-2024:5239) Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP5 security update | August 13, 2024 |
| RHSA-2024:5240 | (RHSA-2024:5240) Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP5 security update | August 13, 2024 |
| RHSA-2024:2693 | (RHSA-2024:2693) Moderate: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP4 security update | May 7, 2024 |
| RHSA-2024:2694 | (RHSA-2024:2694) Moderate: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP4 security update | May 7, 2024 |
| RHSA-2024:1316 | (RHSA-2024:1316) Moderate: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP3 security update | March 18, 2024 |
| RHSA-2024:1317 | (RHSA-2024:1317) Moderate: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP3 security update | March 18, 2024 |
| RHSA-2023:7626 | (RHSA-2023:7626) Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP2 security update | December 7, 2023 |
| RHSA-2023:7625 | (RHSA-2023:7625) Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP2 security update | December 7, 2023 |
By the Year
In 2024 there have been 9 vulnerabilities in Red Hat Http Server with an average score of 8.7 out of ten. Http Server did not have any published security vulnerabilities last year. That is, 9 more vulnerabilities have already been reported in 2024 as compared to last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2024 | 9 | 8.65 |
| 2023 | 0 | 0.00 |
| 2022 | 0 | 0.00 |
| 2021 | 0 | 0.00 |
| 2020 | 0 | 0.00 |
| 2019 | 0 | 0.00 |
| 2018 | 0 | 0.00 |
It may take a day or so for new Http Server vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Red Hat Http Server Security Vulnerabilities
SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context
CVE-2024-40898
7.5 - High
- July 18, 2024
SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests. Users are recommended to upgrade to version 2.4.62 which fixes this issue.
XSPA
Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier
CVE-2024-38473
- July 01, 2024
Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests. Users are recommended to upgrade to version 2.4.60, which fixes this issue.
Output Sanitization
Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier
CVE-2024-38474
9.8 - Critical
- July 01, 2024
Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI. Users are recommended to upgrade to version 2.4.60, which fixes this issue. Some RewriteRules that capture and substitute unsafely will now fail unless rewrite flag "UnsafeAllow3F" is specified.
Output Sanitization
Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations
CVE-2024-38475
- July 01, 2024
Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.
Output Sanitization
Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution
CVE-2024-38476
9.8 - Critical
- July 01, 2024
Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable. Users are recommended to upgrade to version 2.4.60, which fixes this issue.
Inclusion of Functionality from Untrusted Control Sphere
null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier
CVE-2024-38477
7.5 - High
- July 01, 2024
null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request. Users are recommended to upgrade to version 2.4.60, which fixes this issue.
NULL Pointer Dereference
Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and earlier
CVE-2024-39573
- July 01, 2024
Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to cause unsafe RewriteRules to unexpectedly setup URL's to be handled by mod_proxy. Users are recommended to upgrade to version 2.4.60, which fixes this issue.
Improper Input Validation
SSRF in Apache HTTP Server on Windows
CVE-2024-38472
- July 01, 2024
SSRF in Apache HTTP Server on Windows allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue. Note: Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing.
Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses
CVE-2023-38709
- April 04, 2024
Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58.
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Red Hat Http Server or by Red Hat? Click the Watch button to subscribe.
