USN-6885-1: Apache HTTP Server vulnerabilities

Releases

• Ubuntu 24.04 LTS
• Ubuntu 23.10
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS

Packages

• apache2 - Apache HTTP server

Details

Marc Stern discovered that the Apache HTTP Server incorrectly handled
serving WebSocket protocol upgrades over HTTP/2 connections. A remote
attacker could possibly use this issue to cause the server to crash,
resulting in a denial of service. (CVE-2024-36387)

Orange Tsai discovered that the Apache HTTP Server mod_proxy module
incorrectly sent certain request URLs with incorrect encodings to backends.
A remote attacker could possibly use this issue to bypass authentication.
(CVE-2024-38473)

Orange Tsai discovered that the Apache HTTP Server mod_rewrite module
incorrectly handled certain substitutions. A remote attacker could possibly
use this issue to execute scripts in directories not directly reachable
by any URL, or cause a denial of service. Some environments may require
using the new UnsafeAllow3F flag to handle unsafe substitutions.
(CVE-2024-38474, CVE-2024-38475, CVE-2024-39573)

Orange Tsai discovered that the Apache HTTP Server incorrectly handled
certain response headers. A remote attacker could possibly use this issue
to obtain sensitive information, execute local scripts, or perform SSRF
attacks. (CVE-2024-38476)

Orange Tsai discovered that the Apache HTTP Server mod_proxy module
incorrectly handled certain requests. A remote attacker could possibly use
this issue to cause the server to crash, resulting in a denial of service.
(CVE-2024-38477)

It was discovered that the Apache HTTP Server incorrectly handled certain
handlers configured via AddType. A remote attacker could possibly use this
issue to obtain source code. (CVE-2024-39884)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 24.04

• apache2 - 2.4.58-1ubuntu8.2

Ubuntu 23.10

• apache2 - 2.4.57-2ubuntu2.5

Ubuntu 22.04

• apache2 - 2.4.52-1ubuntu4.10

Ubuntu 20.04

• apache2 - 2.4.41-4ubuntu3.19

In general, a standard system update will make all the necessary changes.

References

• CVE-2024-38475
• CVE-2024-38474
• CVE-2024-39573
• CVE-2024-38476
• CVE-2024-38477
• CVE-2024-36387
• CVE-2024-39884
• CVE-2024-38473

Related notices

• USN-6885-3: apache2-dev, apache2-bin, apache2-doc, apache2-suexec-pristine, apache2-data, apache2, apache2-ssl-dev, apache2-suexec-custom, apache2-utils