REDHAT-BUG-2295013
First published: Mon Jul 01 2024(Updated: )
Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI. Users are recommended to upgrade to version 2.4.60, which fixes this issue. Some RewriteRules that capture and substitute unsafely will now fail unless rewrite flag "UnsafeAllow3F" is specified.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Http Server | <2.4.60 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/errata/RHSA-2024:4720
- https://access.redhat.com/errata/RHSA-2024:4719
- https://access.redhat.com/errata/RHSA-2024:4726
- https://access.redhat.com/errata/RHSA-2024:4820
- https://access.redhat.com/errata/RHSA-2024:4827
- https://access.redhat.com/errata/RHSA-2024:4830
- https://access.redhat.com/errata/RHSA-2024:4863
- https://access.redhat.com/errata/RHSA-2024:4862
- https://access.redhat.com/errata/RHSA-2024:4938
- https://access.redhat.com/errata/RHSA-2024:4943
- https://access.redhat.com/errata/RHSA-2024:5240
- https://access.redhat.com/errata/RHSA-2024:5239
- https://bugzilla.redhat.com/show_bug.cgi?id=2295013
Frequently Asked Questions
What is the severity of REDHAT-BUG-2295013?
The severity of REDHAT-BUG-2295013 is considered critical due to the potential for script execution in unauthorized directories.
How do I fix REDHAT-BUG-2295013?
To fix REDHAT-BUG-2295013, you should upgrade your Apache HTTP Server to version 2.4.60 or later.
What versions of Apache HTTP Server are affected by REDHAT-BUG-2295013?
Apache HTTP Server versions 2.4.59 and earlier are affected by REDHAT-BUG-2295013.
What type of vulnerability is identified in REDHAT-BUG-2295013?
REDHAT-BUG-2295013 identifies a substitution encoding issue within mod_rewrite in Apache HTTP Server.
What could be the impact of exploiting REDHAT-BUG-2295013?
Exploiting REDHAT-BUG-2295013 could lead to unauthorized script execution or disclosure of sensitive script information.
- agent/severity
- agent/type
- agent/description
- agent/first-publish-date
- agent/event
- agent/references
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-38474
- agent/last-modified-date
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/apache
- canonical/apache http server