Security update for apache2 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2024:2560-1 Final 1 1 2024-07-18T13:57:20Z current 2024-07-18T13:57:20Z 2024-07-18T13:57:20Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for apache2 This update for apache2 fixes the following issues: - CVE-2024-38476: Fixed server may use exploitable/malicious backend application output to run local handlers via internal redirect (bsc#1227269) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2024-2560,SUSE-SLE-SDK-12-SP5-2024-2560,SUSE-SLE-SERVER-12-SP5-2024-2560 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2024/suse-su-20242560-1/ Link for SUSE-SU-2024:2560-1 https://lists.suse.com/pipermail/sle-security-updates/2024-July/019002.html E-Mail link for SUSE-SU-2024:2560-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1227269 SUSE Bug 1227269 https://www.suse.com/security/cve/CVE-2024-38476/ SUSE CVE CVE-2024-38476 page SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5 apache2-2.4.51-35.54.1 apache2-devel-2.4.51-35.54.1 apache2-doc-2.4.51-35.54.1 apache2-event-2.4.51-35.54.1 apache2-example-pages-2.4.51-35.54.1 apache2-prefork-2.4.51-35.54.1 apache2-tls13-2.4.51-35.54.1 apache2-tls13-devel-2.4.51-35.54.1 apache2-tls13-doc-2.4.51-35.54.1 apache2-tls13-event-2.4.51-35.54.1 apache2-tls13-example-pages-2.4.51-35.54.1 apache2-tls13-prefork-2.4.51-35.54.1 apache2-tls13-utils-2.4.51-35.54.1 apache2-tls13-worker-2.4.51-35.54.1 apache2-utils-2.4.51-35.54.1 apache2-worker-2.4.51-35.54.1 apache2-2.4.51-35.54.1 as a component of SUSE Linux Enterprise Server 12 SP5 apache2-doc-2.4.51-35.54.1 as a component of SUSE Linux Enterprise Server 12 SP5 apache2-example-pages-2.4.51-35.54.1 as a component of SUSE Linux Enterprise Server 12 SP5 apache2-prefork-2.4.51-35.54.1 as a component of SUSE Linux Enterprise Server 12 SP5 apache2-tls13-2.4.51-35.54.1 as a component of SUSE Linux Enterprise Server 12 SP5 apache2-tls13-doc-2.4.51-35.54.1 as a component of SUSE Linux Enterprise Server 12 SP5 apache2-tls13-example-pages-2.4.51-35.54.1 as a component of SUSE Linux Enterprise Server 12 SP5 apache2-tls13-prefork-2.4.51-35.54.1 as a component of SUSE Linux Enterprise Server 12 SP5 apache2-tls13-utils-2.4.51-35.54.1 as a component of SUSE Linux Enterprise Server 12 SP5 apache2-tls13-worker-2.4.51-35.54.1 as a component of SUSE Linux Enterprise Server 12 SP5 apache2-utils-2.4.51-35.54.1 as a component of SUSE Linux Enterprise Server 12 SP5 apache2-worker-2.4.51-35.54.1 as a component of SUSE Linux Enterprise Server 12 SP5 apache2-2.4.51-35.54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 apache2-doc-2.4.51-35.54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 apache2-example-pages-2.4.51-35.54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 apache2-prefork-2.4.51-35.54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 apache2-tls13-2.4.51-35.54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 apache2-tls13-doc-2.4.51-35.54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 apache2-tls13-example-pages-2.4.51-35.54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 apache2-tls13-prefork-2.4.51-35.54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 apache2-tls13-utils-2.4.51-35.54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 apache2-tls13-worker-2.4.51-35.54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 apache2-utils-2.4.51-35.54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 apache2-worker-2.4.51-35.54.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 apache2-devel-2.4.51-35.54.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 apache2-tls13-devel-2.4.51-35.54.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable. Users are recommended to upgrade to version 2.4.60, which fixes this issue. CVE-2024-38476 SUSE Linux Enterprise Server 12 SP5:apache2-2.4.51-35.54.1 SUSE Linux Enterprise Server 12 SP5:apache2-doc-2.4.51-35.54.1 SUSE Linux Enterprise Server 12 SP5:apache2-example-pages-2.4.51-35.54.1 SUSE Linux Enterprise Server 12 SP5:apache2-prefork-2.4.51-35.54.1 SUSE Linux Enterprise Server 12 SP5:apache2-tls13-2.4.51-35.54.1 SUSE Linux Enterprise Server 12 SP5:apache2-tls13-doc-2.4.51-35.54.1 SUSE Linux Enterprise Server 12 SP5:apache2-tls13-example-pages-2.4.51-35.54.1 SUSE Linux Enterprise Server 12 SP5:apache2-tls13-prefork-2.4.51-35.54.1 SUSE Linux Enterprise Server 12 SP5:apache2-tls13-utils-2.4.51-35.54.1 SUSE Linux Enterprise Server 12 SP5:apache2-tls13-worker-2.4.51-35.54.1 SUSE Linux Enterprise Server 12 SP5:apache2-utils-2.4.51-35.54.1 SUSE Linux Enterprise Server 12 SP5:apache2-worker-2.4.51-35.54.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:apache2-2.4.51-35.54.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:apache2-doc-2.4.51-35.54.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:apache2-example-pages-2.4.51-35.54.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:apache2-prefork-2.4.51-35.54.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:apache2-tls13-2.4.51-35.54.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:apache2-tls13-doc-2.4.51-35.54.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:apache2-tls13-example-pages-2.4.51-35.54.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:apache2-tls13-prefork-2.4.51-35.54.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:apache2-tls13-utils-2.4.51-35.54.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:apache2-tls13-worker-2.4.51-35.54.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:apache2-utils-2.4.51-35.54.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:apache2-worker-2.4.51-35.54.1 SUSE Linux Enterprise Software Development Kit 12 SP5:apache2-devel-2.4.51-35.54.1 SUSE Linux Enterprise Software Development Kit 12 SP5:apache2-tls13-devel-2.4.51-35.54.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2024/suse-su-20242560-1/ https://www.suse.com/security/cve/CVE-2024-38476.html CVE-2024-38476 https://bugzilla.suse.com/1227269 SUSE Bug 1227269