CVE-2024-38475

Publication date 1 July 2024

Last updated 18 September 2024

Ubuntu priority

Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
apache2	24.10 oracular	Fixed 2.4.62-1ubuntu1
	24.04 LTS noble	Fixed 2.4.58-1ubuntu8.2
	23.10 mantic	Fixed 2.4.57-2ubuntu2.5
	22.04 LTS jammy	Fixed 2.4.52-1ubuntu4.10
	20.04 LTS focal	Fixed 2.4.41-4ubuntu3.19
	18.04 LTS bionic	Fixed 2.4.29-1ubuntu4.27+esm3 Ubuntu Pro
	16.04 LTS xenial	Fixed 2.4.18-2ubuntu3.17+esm13 Ubuntu Pro
	14.04 LTS trusty	Needs evaluation

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

Get Ubuntu Pro

Notes

mdeslaur

same fix as CVE-2024-28474

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
apache2	Upstream: https://svn.apache.org/viewvc?view=revision&revision=1918561 Upstream: 1feb5e0

CVE-2024-38475

Status

Get expanded security coverage with Ubuntu Pro

Notes

mdeslaur

Patch details

References

Related Ubuntu Security Notices (USN)

Other references