apache2-2.4.61-1.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:14116-1 Final 1 1 2024-07-09T00:00:00Z current 2024-07-09T00:00:00Z 2024-07-09T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z apache2-2.4.61-1.1 on GA media These are all security issues fixed in the apache2-2.4.61-1.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-14116 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2024-36387/ SUSE CVE CVE-2024-36387 page https://www.suse.com/security/cve/CVE-2024-38472/ SUSE CVE CVE-2024-38472 page https://www.suse.com/security/cve/CVE-2024-38473/ SUSE CVE CVE-2024-38473 page https://www.suse.com/security/cve/CVE-2024-38474/ SUSE CVE CVE-2024-38474 page https://www.suse.com/security/cve/CVE-2024-38475/ SUSE CVE CVE-2024-38475 page https://www.suse.com/security/cve/CVE-2024-38476/ SUSE CVE CVE-2024-38476 page https://www.suse.com/security/cve/CVE-2024-38477/ SUSE CVE CVE-2024-38477 page https://www.suse.com/security/cve/CVE-2024-39573/ SUSE CVE CVE-2024-39573 page https://www.suse.com/security/cve/CVE-2024-39884/ SUSE CVE CVE-2024-39884 page openSUSE Tumbleweed apache2-2.4.61-1.1 apache2-2.4.61-1.1 as a component of openSUSE Tumbleweed Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance. CVE-2024-36387 openSUSE Tumbleweed:apache2-2.4.61-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2024-36387.html CVE-2024-36387 https://bugzilla.suse.com/1227272 SUSE Bug 1227272 SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue. Note: Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing. CVE-2024-38472 openSUSE Tumbleweed:apache2-2.4.61-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2024-38472.html CVE-2024-38472 https://bugzilla.suse.com/1227267 SUSE Bug 1227267 Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests. Users are recommended to upgrade to version 2.4.60, which fixes this issue. CVE-2024-38473 openSUSE Tumbleweed:apache2-2.4.61-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2024-38473.html CVE-2024-38473 https://bugzilla.suse.com/1227276 SUSE Bug 1227276 Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI. Users are recommended to upgrade to version 2.4.60, which fixes this issue. Some RewriteRules that capture and substitute unsafely will now fail unless rewrite flag "UnsafeAllow3F" is specified. CVE-2024-38474 openSUSE Tumbleweed:apache2-2.4.61-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2024-38474.html CVE-2024-38474 https://bugzilla.suse.com/1227278 SUSE Bug 1227278 Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained. CVE-2024-38475 openSUSE Tumbleweed:apache2-2.4.61-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2024-38475.html CVE-2024-38475 https://bugzilla.suse.com/1227268 SUSE Bug 1227268 Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable. Users are recommended to upgrade to version 2.4.60, which fixes this issue. CVE-2024-38476 openSUSE Tumbleweed:apache2-2.4.61-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2024-38476.html CVE-2024-38476 https://bugzilla.suse.com/1227269 SUSE Bug 1227269 null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request. Users are recommended to upgrade to version 2.4.60, which fixes this issue. CVE-2024-38477 openSUSE Tumbleweed:apache2-2.4.61-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2024-38477.html CVE-2024-38477 https://bugzilla.suse.com/1227270 SUSE Bug 1227270 Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to cause unsafe RewriteRules to unexpectedly setup URL's to be handled by mod_proxy. Users are recommended to upgrade to version 2.4.60, which fixes this issue. CVE-2024-39573 openSUSE Tumbleweed:apache2-2.4.61-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2024-39573.html CVE-2024-39573 https://bugzilla.suse.com/1227271 SUSE Bug 1227271 A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted. Users are recommended to upgrade to version 2.4.61, which fixes this issue. CVE-2024-39884 openSUSE Tumbleweed:apache2-2.4.61-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2024-39884.html CVE-2024-39884 https://bugzilla.suse.com/1227353 SUSE Bug 1227353 https://bugzilla.suse.com/1228097 SUSE Bug 1228097