REDHAT-BUG-2419262: Medium severity Apache HTTP Server vulnerability
moduserdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid.
This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65.
Users are recommended to upgrade to version 2.4.66, which fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2419262?
The severity of REDHAT-BUG-2419262 is considered important due to the risk of unauthorized script execution under unexpected user IDs.
How do I fix REDHAT-BUG-2419262?
To fix REDHAT-BUG-2419262, you should upgrade your Apache HTTP Server to a version later than 2.4.65.
Which versions of Apache HTTP Server are affected by REDHAT-BUG-2419262?
Apache HTTP Server versions from 2.4.7 through 2.4.65 are affected by REDHAT-BUG-2419262.
What is the nature of the vulnerability in REDHAT-BUG-2419262?
REDHAT-BUG-2419262 is a mod_userdir+suexec bypass vulnerability that can be exploited using the RequestHeader directive in htaccess.
Who is impacted by the vulnerability REDHAT-BUG-2419262?
Users with access to modify htaccess files in vulnerable Apache HTTP Server installations are impacted by REDHAT-BUG-2419262.