Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Red Hat Apache httpd may allow remote code execution

published 2 years ago

Summary

The listed Red Hat httpd packages could let an attacker run their own programs on your server if they send specially crafted web requests. This could lead to loss of control over the affected system. Apply the latest security update from Red Hat as soon as possible to fix the problem.

What to do

Update redhat httpd to version 0:2.4.6-99.el7_9.2.
Update redhat httpd-debuginfo to version 0:2.4.6-99.el7_9.2.
Update redhat httpd-devel to version 0:2.4.6-99.el7_9.2.
Update redhat httpd-manual to version 0:2.4.6-99.el7_9.2.
Update redhat httpd-tools to version 0:2.4.6-99.el7_9.2.
Update redhat mod_session to version 0:2.4.6-99.el7_9.2.
Update redhat mod_ssl to version 1:2.4.6-99.el7_9.2.
Update redhat mod_ldap to version 0:2.4.6-99.el7_9.2.
Update redhat mod_proxy_html to version 1:2.4.6-99.el7_9.2.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_els:7	redhat	httpd	< 0:2.4.6-99.el7_9.2 Fix: upgrade to 0:2.4.6-99.el7_9.2
Red Hat:rhel_els:7	redhat	httpd-debuginfo	< 0:2.4.6-99.el7_9.2 Fix: upgrade to 0:2.4.6-99.el7_9.2
Red Hat:rhel_els:7	redhat	httpd-devel	< 0:2.4.6-99.el7_9.2 Fix: upgrade to 0:2.4.6-99.el7_9.2
Red Hat:rhel_els:7	redhat	httpd-manual	< 0:2.4.6-99.el7_9.2 Fix: upgrade to 0:2.4.6-99.el7_9.2
Red Hat:rhel_els:7	redhat	httpd-tools	< 0:2.4.6-99.el7_9.2 Fix: upgrade to 0:2.4.6-99.el7_9.2
Red Hat:rhel_els:7	redhat	mod_session	< 0:2.4.6-99.el7_9.2 Fix: upgrade to 0:2.4.6-99.el7_9.2
Red Hat:rhel_els:7	redhat	mod_ssl	< 1:2.4.6-99.el7_9.2 Fix: upgrade to 1:2.4.6-99.el7_9.2
Red Hat:rhel_els:7	redhat	mod_ldap	< 0:2.4.6-99.el7_9.2 Fix: upgrade to 0:2.4.6-99.el7_9.2
Red Hat:rhel_els:7	redhat	mod_proxy_html	< 1:2.4.6-99.el7_9.2 Fix: upgrade to 1:2.4.6-99.el7_9.2

Original advisory text

Red Hat Security Advisory: httpd security update

References

https://access.redhat.com/errata/RHSA-2024:4943 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2295013 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2295014 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2295016 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4943.j... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2024-38474 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2024-38474 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-38474 Vendor Advisory
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2024-38474 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2024-38475 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2024-38475 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-38475 Vendor Advisory
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2024-38475 Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog Third Party Advisory
https://access.redhat.com/security/cve/CVE-2024-38477 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2024-38477 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-38477 Vendor Advisory
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2024-38477 Third Party Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.8 Critical

Timeline

Published13 Sep 2024

Updated23 Sep 2026

First seen23 Sep 2026

Sources

RHSA-2024:4943 · OSV

Track software like this

Free during beta