REDHAT-BUG-2295015: SSRF
First published: Mon Jul 01 2024(Updated: )
Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable. Users are recommended to upgrade to version 2.4.60, which fixes this issue.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Http Server | <=2.4.59 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/errata/RHSA-2024:5138
- https://access.redhat.com/errata/RHSA-2024:5193
- https://access.redhat.com/errata/RHSA-2024:5240
- https://access.redhat.com/errata/RHSA-2024:5239
- https://access.redhat.com/errata/RHSA-2024:5832
- https://access.redhat.com/errata/RHSA-2024:5812
- https://access.redhat.com/errata/RHSA-2024:6136
- https://access.redhat.com/errata/RHSA-2024:6467
- https://access.redhat.com/errata/RHSA-2024:6468
- https://access.redhat.com/errata/RHSA-2024:6583
- https://access.redhat.com/errata/RHSA-2024:6584
- https://access.redhat.com/errata/RHSA-2024:7101
- https://bugzilla.redhat.com/show_bug.cgi?id=2295015
Frequently Asked Questions
What is the severity of REDHAT-BUG-2295015?
The severity of REDHAT-BUG-2295015 is high due to its potential for information disclosure and exploitation.
How do I fix REDHAT-BUG-2295015?
To fix REDHAT-BUG-2295015, upgrade Apache HTTP Server to version 2.4.60 or later.
What are the risks associated with REDHAT-BUG-2295015?
The risks associated with REDHAT-BUG-2295015 include information disclosure, SSRF, and the possibility of local script execution.
Which versions of Apache HTTP Server are affected by REDHAT-BUG-2295015?
Apache HTTP Server versions 2.4.59 and earlier are affected by REDHAT-BUG-2295015.
Who should be concerned about REDHAT-BUG-2295015?
Administrators and users of Apache HTTP Server versions 2.4.59 and earlier should be concerned about REDHAT-BUG-2295015.
- agent/severity
- agent/weakness
- agent/first-publish-date
- agent/type
- agent/description
- agent/event
- agent/references
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-38476
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/apache
- canonical/apache http server