Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.8
Red Hat Apache HTTP Server could let attackers run code
published 2 years ago
Summary
The Apache HTTP Server packages for Red Hat (including development and debug versions) contain a flaw that could let a remote user execute commands on the server. This could lead to unauthorized access or control of the web server. Apply the latest Red Hat security update as soon as possible to fix the issue.
What to do
- Update redhat httpd to version 0:2.4.37-65.module+el8.10.0+21982+14717793.
- Update redhat httpd-debuginfo to version 0:2.4.37-65.module+el8.10.0+21982+14717793.
- Update redhat httpd-debugsource to version 0:2.4.37-65.module+el8.10.0+21982+14717793.
- Update redhat httpd-devel to version 0:2.4.37-65.module+el8.10.0+21982+14717793.
- Update redhat httpd-filesystem to version 0:2.4.37-65.module+el8.10.0+21982+14717793.
- Update redhat httpd-manual to version 0:2.4.37-65.module+el8.10.0+21982+14717793.
- Update redhat httpd-tools to version 0:2.4.37-65.module+el8.10.0+21982+14717793.
- Update redhat httpd-tools-debuginfo to version 0:2.4.37-65.module+el8.10.0+21982+14717793.
- Update redhat mod_http2 to version 0:1.15.7-10.module+el8.10.0+21653+eaff63f0.
- Update redhat mod_http2-debuginfo to version 0:1.15.7-10.module+el8.10.0+21653+eaff63f0.
- Update redhat mod_http2-debugsource to version 0:1.15.7-10.module+el8.10.0+21653+eaff63f0.
- Update redhat mod_ldap to version 0:2.4.37-65.module+el8.10.0+21982+14717793.
- Update redhat mod_ldap-debuginfo to version 0:2.4.37-65.module+el8.10.0+21982+14717793.
- Update redhat mod_md to version 1:2.0.8-8.module+el8.9.0+19080+567b90f8.
- Update redhat mod_md-debuginfo to version 1:2.0.8-8.module+el8.9.0+19080+567b90f8.
- Update redhat mod_md-debugsource to version 1:2.0.8-8.module+el8.9.0+19080+567b90f8.
- Update redhat mod_proxy_html to version 1:2.4.37-65.module+el8.10.0+21982+14717793.
- Update redhat mod_proxy_html-debuginfo to version 1:2.4.37-65.module+el8.10.0+21982+14717793.
- Update redhat mod_session to version 0:2.4.37-65.module+el8.10.0+21982+14717793.
- Update redhat mod_session-debuginfo to version 0:2.4.37-65.module+el8.10.0+21982+14717793.
- Update redhat mod_ssl to version 1:2.4.37-65.module+el8.10.0+21982+14717793.
- Update redhat mod_ssl-debuginfo to version 1:2.4.37-65.module+el8.10.0+21982+14717793.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:enterprise_linux:8::appstream | redhat | httpd |
< 0:2.4.37-65.module+el8.10.0+21982+14717793 Fix: upgrade to 0:2.4.37-65.module+el8.10.0+21982+14717793
|
| Red Hat:enterprise_linux:8::appstream | redhat | httpd-debuginfo |
< 0:2.4.37-65.module+el8.10.0+21982+14717793 Fix: upgrade to 0:2.4.37-65.module+el8.10.0+21982+14717793
|
| Red Hat:enterprise_linux:8::appstream | redhat | httpd-debugsource |
< 0:2.4.37-65.module+el8.10.0+21982+14717793 Fix: upgrade to 0:2.4.37-65.module+el8.10.0+21982+14717793
|
| Red Hat:enterprise_linux:8::appstream | redhat | httpd-devel |
< 0:2.4.37-65.module+el8.10.0+21982+14717793 Fix: upgrade to 0:2.4.37-65.module+el8.10.0+21982+14717793
|
| Red Hat:enterprise_linux:8::appstream | redhat | httpd-filesystem |
< 0:2.4.37-65.module+el8.10.0+21982+14717793 Fix: upgrade to 0:2.4.37-65.module+el8.10.0+21982+14717793
|
| Red Hat:enterprise_linux:8::appstream | redhat | httpd-manual |
< 0:2.4.37-65.module+el8.10.0+21982+14717793 Fix: upgrade to 0:2.4.37-65.module+el8.10.0+21982+14717793
|
| Red Hat:enterprise_linux:8::appstream | redhat | httpd-tools |
< 0:2.4.37-65.module+el8.10.0+21982+14717793 Fix: upgrade to 0:2.4.37-65.module+el8.10.0+21982+14717793
|
| Red Hat:enterprise_linux:8::appstream | redhat | httpd-tools-debuginfo |
< 0:2.4.37-65.module+el8.10.0+21982+14717793 Fix: upgrade to 0:2.4.37-65.module+el8.10.0+21982+14717793
|
| Red Hat:enterprise_linux:8::appstream | redhat | mod_http2 |
< 0:1.15.7-10.module+el8.10.0+21653+eaff63f0 Fix: upgrade to 0:1.15.7-10.module+el8.10.0+21653+eaff63f0
|
| Red Hat:enterprise_linux:8::appstream | redhat | mod_http2-debuginfo |
< 0:1.15.7-10.module+el8.10.0+21653+eaff63f0 Fix: upgrade to 0:1.15.7-10.module+el8.10.0+21653+eaff63f0
|
| Red Hat:enterprise_linux:8::appstream | redhat | mod_http2-debugsource |
< 0:1.15.7-10.module+el8.10.0+21653+eaff63f0 Fix: upgrade to 0:1.15.7-10.module+el8.10.0+21653+eaff63f0
|
| Red Hat:enterprise_linux:8::appstream | redhat | mod_ldap |
< 0:2.4.37-65.module+el8.10.0+21982+14717793 Fix: upgrade to 0:2.4.37-65.module+el8.10.0+21982+14717793
|
| Red Hat:enterprise_linux:8::appstream | redhat | mod_ldap-debuginfo |
< 0:2.4.37-65.module+el8.10.0+21982+14717793 Fix: upgrade to 0:2.4.37-65.module+el8.10.0+21982+14717793
|
| Red Hat:enterprise_linux:8::appstream | redhat | mod_md |
< 1:2.0.8-8.module+el8.9.0+19080+567b90f8 Fix: upgrade to 1:2.0.8-8.module+el8.9.0+19080+567b90f8
|
| Red Hat:enterprise_linux:8::appstream | redhat | mod_md-debuginfo |
< 1:2.0.8-8.module+el8.9.0+19080+567b90f8 Fix: upgrade to 1:2.0.8-8.module+el8.9.0+19080+567b90f8
|
| Red Hat:enterprise_linux:8::appstream | redhat | mod_md-debugsource |
< 1:2.0.8-8.module+el8.9.0+19080+567b90f8 Fix: upgrade to 1:2.0.8-8.module+el8.9.0+19080+567b90f8
|
| Red Hat:enterprise_linux:8::appstream | redhat | mod_proxy_html |
< 1:2.4.37-65.module+el8.10.0+21982+14717793 Fix: upgrade to 1:2.4.37-65.module+el8.10.0+21982+14717793
|
| Red Hat:enterprise_linux:8::appstream | redhat | mod_proxy_html-debuginfo |
< 1:2.4.37-65.module+el8.10.0+21982+14717793 Fix: upgrade to 1:2.4.37-65.module+el8.10.0+21982+14717793
|
| Red Hat:enterprise_linux:8::appstream | redhat | mod_session |
< 0:2.4.37-65.module+el8.10.0+21982+14717793 Fix: upgrade to 0:2.4.37-65.module+el8.10.0+21982+14717793
|
| Red Hat:enterprise_linux:8::appstream | redhat | mod_session-debuginfo |
< 0:2.4.37-65.module+el8.10.0+21982+14717793 Fix: upgrade to 0:2.4.37-65.module+el8.10.0+21982+14717793
|
| Red Hat:enterprise_linux:8::appstream | redhat | mod_ssl |
< 1:2.4.37-65.module+el8.10.0+21982+14717793 Fix: upgrade to 1:2.4.37-65.module+el8.10.0+21982+14717793
|
| Red Hat:enterprise_linux:8::appstream | redhat | mod_ssl-debuginfo |
< 1:2.4.37-65.module+el8.10.0+21982+14717793 Fix: upgrade to 1:2.4.37-65.module+el8.10.0+21982+14717793
|
Original advisory text
Red Hat Security Advisory: httpd:2.4/httpd security update
References
- https://access.redhat.com/errata/RHSA-2024:4197 Vendor Advisory
- https://access.redhat.com/security/updates/classification/#moderate Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2273491 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4197.j... Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2023-38709 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2023-38709 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-38709 Vendor Advisory
- https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2023-38709 Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published27 Sep 2024
Updated23 Sep 2026
First seen23 Sep 2026
Sources
RHSA-2024:4197 · OSV
Track software like this
Free during beta