Red Hat Product Errata RHSA-2024:4820 - Security Advisory
Issued:
2024-07-24
Updated:
2024-07-24

RHSA-2024:4820 - Security Advisory

Synopsis

Important: httpd:2.4 security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for the httpd:2.4 module is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

  • httpd: Substitution encoding issue in mod_rewrite (CVE-2024-38474)
  • httpd: Improper escaping of output in mod_rewrite (CVE-2024-38475)
  • httpd: NULL pointer dereference in mod_proxy (CVE-2024-38477)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux Server - AUS 8.2 x86_64

Fixes

  • BZ - 2295013 - CVE-2024-38474 httpd: Substitution encoding issue in mod_rewrite
  • BZ - 2295014 - CVE-2024-38475 httpd: Improper escaping of output in mod_rewrite
  • BZ - 2295016 - CVE-2024-38477 httpd: NULL pointer dereference in mod_proxy

Red Hat Enterprise Linux Server - AUS 8.2

SRPM
httpd-2.4.37-21.module+el8.2.0+22128+68c62a5c.8.src.rpm SHA-256: e3ef055c8c4a063115f2afa04c57db8daafff68649505cbfb6f413cd78da9305
mod_http2-1.11.3-3.module+el8.2.0+22123+cf5a147c.4.src.rpm SHA-256: 60e447472277e1fbff44e3f3610c1b74cdfc70412f241e87720c3aec39b1c11c
mod_md-2.0.8-7.module+el8.2.0+5531+7e4d69a2.src.rpm SHA-256: ac0b05f049712493b3fcf948e094b58b87ba5687c6efca902e0fa352ca2c184d
x86_64
httpd-2.4.37-21.module+el8.2.0+22128+68c62a5c.8.x86_64.rpm SHA-256: 213493ee668cb902147a207278b1f9911f8a88090fb178620bf70273308604b9
httpd-debuginfo-2.4.37-21.module+el8.2.0+22128+68c62a5c.8.x86_64.rpm SHA-256: f3e9f783fa9b99cceda004c706b11fe6822137b87603187c9f0599cfbf3600d8
httpd-debugsource-2.4.37-21.module+el8.2.0+22128+68c62a5c.8.x86_64.rpm SHA-256: a279d7675e9bd1c7d7b112f3a89719aa900cce21dac22e344993042725055e10
httpd-devel-2.4.37-21.module+el8.2.0+22128+68c62a5c.8.x86_64.rpm SHA-256: 7e4ecee7e908ec3a8ab6cd091088b53f15e9ec531ba4c39d9fa4161c5ebd1d5a
httpd-filesystem-2.4.37-21.module+el8.2.0+22128+68c62a5c.8.noarch.rpm SHA-256: 247423d273cd9b088d3cf115b81b774ffe98495f24b4b04ab3f84bbb24803f76
httpd-manual-2.4.37-21.module+el8.2.0+22128+68c62a5c.8.noarch.rpm SHA-256: 24fccec49e3b56b71da21a5c07300e3443bb6ece4e23898ddeaf028a60a7c62b
httpd-tools-2.4.37-21.module+el8.2.0+22128+68c62a5c.8.x86_64.rpm SHA-256: e9082af62a5a837907a157b54075f895f8aab72998fe8292f47cde0e3f99cf54
httpd-tools-debuginfo-2.4.37-21.module+el8.2.0+22128+68c62a5c.8.x86_64.rpm SHA-256: b1c2aa91a0a423696fcf50bbb1029f261da7744fa419f5db788691d3995765ed
mod_http2-1.11.3-3.module+el8.2.0+22123+cf5a147c.4.x86_64.rpm SHA-256: 92e4f636a37bf340e5be57e6a09d35a41d3d7152be2c3db475aeb7f1d9842086
mod_http2-debuginfo-1.11.3-3.module+el8.2.0+22123+cf5a147c.4.x86_64.rpm SHA-256: 14a7af51444a46ecfa215cc546c677ac5b183578d4619696aa08bea642f295f9
mod_http2-debugsource-1.11.3-3.module+el8.2.0+22123+cf5a147c.4.x86_64.rpm SHA-256: aec22bdc84dff3c3e544f5c4cc9402904dde5da8c1912da30eabf8069ad1b4fa
mod_ldap-2.4.37-21.module+el8.2.0+22128+68c62a5c.8.x86_64.rpm SHA-256: db02ce6c631c926171b6b62a3092434b0eb95696b8ebf16832190338a86ba965
mod_ldap-debuginfo-2.4.37-21.module+el8.2.0+22128+68c62a5c.8.x86_64.rpm SHA-256: 8603ce9ec81effc67ad4768f8307fce7b814e822af2f0b75fd743c49a5167118
mod_md-2.0.8-7.module+el8.2.0+5531+7e4d69a2.x86_64.rpm SHA-256: 488993a0340198b852a125e8857c25595e6bf0f334b47d2a77613ee8a7fb6d37
mod_md-debuginfo-2.0.8-7.module+el8.2.0+5531+7e4d69a2.x86_64.rpm SHA-256: b8773d35478dc2149b1098d646e59184ad4e00e17e37972c860858ee5639c1a1
mod_md-debugsource-2.0.8-7.module+el8.2.0+5531+7e4d69a2.x86_64.rpm SHA-256: 0ff0f0e08de22afce2c2e7cb80ef1ea73925ee27d1c5ff86d45d5669e913826e
mod_proxy_html-2.4.37-21.module+el8.2.0+22128+68c62a5c.8.x86_64.rpm SHA-256: a53b6c5aaff02e056d54af92b31a33ef6d55cd44ae255fc0e4e8956b3184c5d4
mod_proxy_html-debuginfo-2.4.37-21.module+el8.2.0+22128+68c62a5c.8.x86_64.rpm SHA-256: c29ff05c945fbdd8b216daaee7d2bb40fd1f1b3772420a831b112a16adfd7e07
mod_session-2.4.37-21.module+el8.2.0+22128+68c62a5c.8.x86_64.rpm SHA-256: 4db77a410d401f3ae1658a979c4cadfbec7b75829aecd3036f9521ff9e9734a7
mod_session-debuginfo-2.4.37-21.module+el8.2.0+22128+68c62a5c.8.x86_64.rpm SHA-256: 4fe19dc62b2a09ba06d19917fbeda14ef2a1adc6234d2fc554c3ed7ec35b6d52
mod_ssl-2.4.37-21.module+el8.2.0+22128+68c62a5c.8.x86_64.rpm SHA-256: 412b617f6d51abd7305dd145d236e5fa2c9bd22922fe426b4dc3d3ba3c57be33
mod_ssl-debuginfo-2.4.37-21.module+el8.2.0+22128+68c62a5c.8.x86_64.rpm SHA-256: 678992f9a1df2cfef4f9e24417d424e58b8ba7a0c8f2ba10fc6c0111f7263066

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.