UBUNTU-CVE-2024-38475

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2024-38475

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-38475.json

JSON Data

https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2024-38475

Related

Published

2024-07-01T19:15:00Z

Modified

2024-12-18T16:40:31Z

Summary

[none]

Details

Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.

References

Affected packages

Ubuntu:Pro:14.04:LTS / apache2

Package

Name: apache2
Purl: pkg:deb/ubuntu/apache2?arch=src?distro=esm-infra-legacy/trusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.4.6-2ubuntu2

2.4.6-2ubuntu3

2.4.6-2ubuntu4

2.4.7-1ubuntu1

2.4.7-1ubuntu2

2.4.7-1ubuntu3

2.4.7-1ubuntu4

2.4.7-1ubuntu4.1

2.4.7-1ubuntu4.4

2.4.7-1ubuntu4.5

2.4.7-1ubuntu4.6

2.4.7-1ubuntu4.7

2.4.7-1ubuntu4.8

2.4.7-1ubuntu4.9

2.4.7-1ubuntu4.10

2.4.7-1ubuntu4.11

2.4.7-1ubuntu4.13

2.4.7-1ubuntu4.15

2.4.7-1ubuntu4.16

2.4.7-1ubuntu4.17

2.4.7-1ubuntu4.18

2.4.7-1ubuntu4.19

2.4.7-1ubuntu4.20

2.4.7-1ubuntu4.21

2.4.7-1ubuntu4.22

2.4.7-1ubuntu4.22+esm1

2.4.7-1ubuntu4.22+esm2

2.4.7-1ubuntu4.22+esm3

2.4.7-1ubuntu4.22+esm4

2.4.7-1ubuntu4.22+esm5

2.4.7-1ubuntu4.22+esm6

2.4.7-1ubuntu4.22+esm8

2.4.7-1ubuntu4.22+esm9

Ecosystem specific

{
    "ubuntu_priority": "medium"
}

Ubuntu:Pro:16.04:LTS / apache2

Package

Name: apache2
Purl: pkg:deb/ubuntu/apache2?arch=src?distro=esm-infra/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.18-2ubuntu3.17+esm13

Affected versions

2.*

2.4.12-2ubuntu2

2.4.17-1ubuntu1

2.4.17-2ubuntu1

2.4.17-3ubuntu1

2.4.18-1ubuntu1

2.4.18-2ubuntu1

2.4.18-2ubuntu2

2.4.18-2ubuntu3

2.4.18-2ubuntu3.1

2.4.18-2ubuntu3.2

2.4.18-2ubuntu3.3

2.4.18-2ubuntu3.4

2.4.18-2ubuntu3.5

2.4.18-2ubuntu3.7

2.4.18-2ubuntu3.8

2.4.18-2ubuntu3.9

2.4.18-2ubuntu3.10

2.4.18-2ubuntu3.12

2.4.18-2ubuntu3.13

2.4.18-2ubuntu3.14

2.4.18-2ubuntu3.15

2.4.18-2ubuntu3.17

2.4.18-2ubuntu3.17+esm1

2.4.18-2ubuntu3.17+esm2

2.4.18-2ubuntu3.17+esm3

2.4.18-2ubuntu3.17+esm4

2.4.18-2ubuntu3.17+esm5

2.4.18-2ubuntu3.17+esm6

2.4.18-2ubuntu3.17+esm7

2.4.18-2ubuntu3.17+esm8

2.4.18-2ubuntu3.17+esm9

2.4.18-2ubuntu3.17+esm10

2.4.18-2ubuntu3.17+esm11

2.4.18-2ubuntu3.17+esm12

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "2.4.18-2ubuntu3.17+esm13",
            "binary_name": "apache2"
        },
        {
            "binary_version": "2.4.18-2ubuntu3.17+esm13",
            "binary_name": "apache2-bin"
        },
        {
            "binary_version": "2.4.18-2ubuntu3.17+esm13",
            "binary_name": "apache2-bin-dbgsym"
        },
        {
            "binary_version": "2.4.18-2ubuntu3.17+esm13",
            "binary_name": "apache2-data"
        },
        {
            "binary_version": "2.4.18-2ubuntu3.17+esm13",
            "binary_name": "apache2-dbg"
        },
        {
            "binary_version": "2.4.18-2ubuntu3.17+esm13",
            "binary_name": "apache2-dbgsym"
        },
        {
            "binary_version": "2.4.18-2ubuntu3.17+esm13",
            "binary_name": "apache2-dev"
        },
        {
            "binary_version": "2.4.18-2ubuntu3.17+esm13",
            "binary_name": "apache2-dev-dbgsym"
        },
        {
            "binary_version": "2.4.18-2ubuntu3.17+esm13",
            "binary_name": "apache2-doc"
        },
        {
            "binary_version": "2.4.18-2ubuntu3.17+esm13",
            "binary_name": "apache2-suexec-custom"
        },
        {
            "binary_version": "2.4.18-2ubuntu3.17+esm13",
            "binary_name": "apache2-suexec-custom-dbgsym"
        },
        {
            "binary_version": "2.4.18-2ubuntu3.17+esm13",
            "binary_name": "apache2-suexec-pristine"
        },
        {
            "binary_version": "2.4.18-2ubuntu3.17+esm13",
            "binary_name": "apache2-suexec-pristine-dbgsym"
        },
        {
            "binary_version": "2.4.18-2ubuntu3.17+esm13",
            "binary_name": "apache2-utils"
        },
        {
            "binary_version": "2.4.18-2ubuntu3.17+esm13",
            "binary_name": "apache2-utils-dbgsym"
        }
    ]
}

Ubuntu:Pro:18.04:LTS / apache2

Package

Name: apache2
Purl: pkg:deb/ubuntu/apache2?arch=src?distro=esm-infra/bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.29-1ubuntu4.27+esm3

Affected versions

2.*

2.4.27-2ubuntu3

2.4.29-1ubuntu1

2.4.29-1ubuntu2

2.4.29-1ubuntu3

2.4.29-1ubuntu4

2.4.29-1ubuntu4.1

2.4.29-1ubuntu4.2

2.4.29-1ubuntu4.3

2.4.29-1ubuntu4.4

2.4.29-1ubuntu4.5

2.4.29-1ubuntu4.6

2.4.29-1ubuntu4.7

2.4.29-1ubuntu4.8

2.4.29-1ubuntu4.10

2.4.29-1ubuntu4.11

2.4.29-1ubuntu4.12

2.4.29-1ubuntu4.13

2.4.29-1ubuntu4.14

2.4.29-1ubuntu4.16

2.4.29-1ubuntu4.17

2.4.29-1ubuntu4.18

2.4.29-1ubuntu4.19

2.4.29-1ubuntu4.20

2.4.29-1ubuntu4.21

2.4.29-1ubuntu4.22

2.4.29-1ubuntu4.23

2.4.29-1ubuntu4.24

2.4.29-1ubuntu4.25

2.4.29-1ubuntu4.26

2.4.29-1ubuntu4.27

2.4.29-1ubuntu4.27+esm1

2.4.29-1ubuntu4.27+esm2

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "2.4.29-1ubuntu4.27+esm3",
            "binary_name": "apache2"
        },
        {
            "binary_version": "2.4.29-1ubuntu4.27+esm3",
            "binary_name": "apache2-bin"
        },
        {
            "binary_version": "2.4.29-1ubuntu4.27+esm3",
            "binary_name": "apache2-data"
        },
        {
            "binary_version": "2.4.29-1ubuntu4.27+esm3",
            "binary_name": "apache2-dbg"
        },
        {
            "binary_version": "2.4.29-1ubuntu4.27+esm3",
            "binary_name": "apache2-dev"
        },
        {
            "binary_version": "2.4.29-1ubuntu4.27+esm3",
            "binary_name": "apache2-doc"
        },
        {
            "binary_version": "2.4.29-1ubuntu4.27+esm3",
            "binary_name": "apache2-ssl-dev"
        },
        {
            "binary_version": "2.4.29-1ubuntu4.27+esm3",
            "binary_name": "apache2-suexec-custom"
        },
        {
            "binary_version": "2.4.29-1ubuntu4.27+esm3",
            "binary_name": "apache2-suexec-pristine"
        },
        {
            "binary_version": "2.4.29-1ubuntu4.27+esm3",
            "binary_name": "apache2-utils"
        }
    ]
}

Ubuntu:20.04:LTS / apache2

Package

Name: apache2
Purl: pkg:deb/ubuntu/apache2?arch=src?distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.41-4ubuntu3.19

Affected versions

2.*

2.4.41-1ubuntu1

2.4.41-4ubuntu1

2.4.41-4ubuntu2

2.4.41-4ubuntu3

2.4.41-4ubuntu3.1

2.4.41-4ubuntu3.3

2.4.41-4ubuntu3.4

2.4.41-4ubuntu3.5

2.4.41-4ubuntu3.6

2.4.41-4ubuntu3.7

2.4.41-4ubuntu3.8

2.4.41-4ubuntu3.9

2.4.41-4ubuntu3.10

2.4.41-4ubuntu3.11

2.4.41-4ubuntu3.12

2.4.41-4ubuntu3.13

2.4.41-4ubuntu3.14

2.4.41-4ubuntu3.15

2.4.41-4ubuntu3.16

2.4.41-4ubuntu3.17

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "2.4.41-4ubuntu3.19",
            "binary_name": "apache2"
        },
        {
            "binary_version": "2.4.41-4ubuntu3.19",
            "binary_name": "apache2-bin"
        },
        {
            "binary_version": "2.4.41-4ubuntu3.19",
            "binary_name": "apache2-bin-dbgsym"
        },
        {
            "binary_version": "2.4.41-4ubuntu3.19",
            "binary_name": "apache2-data"
        },
        {
            "binary_version": "2.4.41-4ubuntu3.19",
            "binary_name": "apache2-dev"
        },
        {
            "binary_version": "2.4.41-4ubuntu3.19",
            "binary_name": "apache2-doc"
        },
        {
            "binary_version": "2.4.41-4ubuntu3.19",
            "binary_name": "apache2-ssl-dev"
        },
        {
            "binary_version": "2.4.41-4ubuntu3.19",
            "binary_name": "apache2-suexec-custom"
        },
        {
            "binary_version": "2.4.41-4ubuntu3.19",
            "binary_name": "apache2-suexec-custom-dbgsym"
        },
        {
            "binary_version": "2.4.41-4ubuntu3.19",
            "binary_name": "apache2-suexec-pristine"
        },
        {
            "binary_version": "2.4.41-4ubuntu3.19",
            "binary_name": "apache2-suexec-pristine-dbgsym"
        },
        {
            "binary_version": "2.4.41-4ubuntu3.19",
            "binary_name": "apache2-utils"
        },
        {
            "binary_version": "2.4.41-4ubuntu3.19",
            "binary_name": "apache2-utils-dbgsym"
        },
        {
            "binary_version": "2.4.41-4ubuntu3.19",
            "binary_name": "libapache2-mod-md"
        },
        {
            "binary_version": "2.4.41-4ubuntu3.19",
            "binary_name": "libapache2-mod-proxy-uwsgi"
        }
    ]
}

Ubuntu:22.04:LTS / apache2

Package

Name: apache2
Purl: pkg:deb/ubuntu/apache2?arch=src?distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.52-1ubuntu4.10

Affected versions

2.*

2.4.48-3.1ubuntu3

2.4.48-3.1ubuntu4

2.4.51-2ubuntu1

2.4.52-1ubuntu1

2.4.52-1ubuntu2

2.4.52-1ubuntu4

2.4.52-1ubuntu4.1

2.4.52-1ubuntu4.2

2.4.52-1ubuntu4.3

2.4.52-1ubuntu4.4

2.4.52-1ubuntu4.5

2.4.52-1ubuntu4.6

2.4.52-1ubuntu4.7

2.4.52-1ubuntu4.8

2.4.52-1ubuntu4.9

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "2.4.52-1ubuntu4.10",
            "binary_name": "apache2"
        },
        {
            "binary_version": "2.4.52-1ubuntu4.10",
            "binary_name": "apache2-bin"
        },
        {
            "binary_version": "2.4.52-1ubuntu4.10",
            "binary_name": "apache2-bin-dbgsym"
        },
        {
            "binary_version": "2.4.52-1ubuntu4.10",
            "binary_name": "apache2-data"
        },
        {
            "binary_version": "2.4.52-1ubuntu4.10",
            "binary_name": "apache2-dev"
        },
        {
            "binary_version": "2.4.52-1ubuntu4.10",
            "binary_name": "apache2-doc"
        },
        {
            "binary_version": "2.4.52-1ubuntu4.10",
            "binary_name": "apache2-ssl-dev"
        },
        {
            "binary_version": "2.4.52-1ubuntu4.10",
            "binary_name": "apache2-suexec-custom"
        },
        {
            "binary_version": "2.4.52-1ubuntu4.10",
            "binary_name": "apache2-suexec-custom-dbgsym"
        },
        {
            "binary_version": "2.4.52-1ubuntu4.10",
            "binary_name": "apache2-suexec-pristine"
        },
        {
            "binary_version": "2.4.52-1ubuntu4.10",
            "binary_name": "apache2-suexec-pristine-dbgsym"
        },
        {
            "binary_version": "2.4.52-1ubuntu4.10",
            "binary_name": "apache2-utils"
        },
        {
            "binary_version": "2.4.52-1ubuntu4.10",
            "binary_name": "apache2-utils-dbgsym"
        },
        {
            "binary_version": "2.4.52-1ubuntu4.10",
            "binary_name": "libapache2-mod-md"
        },
        {
            "binary_version": "2.4.52-1ubuntu4.10",
            "binary_name": "libapache2-mod-proxy-uwsgi"
        }
    ]
}

Ubuntu:24.10 / apache2

Package

Name: apache2
Purl: pkg:deb/ubuntu/apache2?arch=src?distro=oracular

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.62-1ubuntu1

Affected versions

2.*

2.4.58-1ubuntu8

2.4.58-1ubuntu8.1

2.4.59-2ubuntu2

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "2.4.62-1ubuntu1",
            "binary_name": "apache2"
        },
        {
            "binary_version": "2.4.62-1ubuntu1",
            "binary_name": "apache2-bin"
        },
        {
            "binary_version": "2.4.62-1ubuntu1",
            "binary_name": "apache2-bin-dbgsym"
        },
        {
            "binary_version": "2.4.62-1ubuntu1",
            "binary_name": "apache2-data"
        },
        {
            "binary_version": "2.4.62-1ubuntu1",
            "binary_name": "apache2-dev"
        },
        {
            "binary_version": "2.4.62-1ubuntu1",
            "binary_name": "apache2-doc"
        },
        {
            "binary_version": "2.4.62-1ubuntu1",
            "binary_name": "apache2-ssl-dev"
        },
        {
            "binary_version": "2.4.62-1ubuntu1",
            "binary_name": "apache2-suexec-custom"
        },
        {
            "binary_version": "2.4.62-1ubuntu1",
            "binary_name": "apache2-suexec-custom-dbgsym"
        },
        {
            "binary_version": "2.4.62-1ubuntu1",
            "binary_name": "apache2-suexec-pristine"
        },
        {
            "binary_version": "2.4.62-1ubuntu1",
            "binary_name": "apache2-suexec-pristine-dbgsym"
        },
        {
            "binary_version": "2.4.62-1ubuntu1",
            "binary_name": "apache2-utils"
        },
        {
            "binary_version": "2.4.62-1ubuntu1",
            "binary_name": "apache2-utils-dbgsym"
        }
    ]
}

Ubuntu:24.04:LTS / apache2

Package

Name: apache2
Purl: pkg:deb/ubuntu/apache2?arch=src?distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.58-1ubuntu8.2

Affected versions

2.*

2.4.57-2ubuntu2

2.4.57-2ubuntu3

2.4.58-1ubuntu1

2.4.58-1ubuntu2

2.4.58-1ubuntu6

2.4.58-1ubuntu7

2.4.58-1ubuntu8

2.4.58-1ubuntu8.1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_version": "2.4.58-1ubuntu8.2",
            "binary_name": "apache2"
        },
        {
            "binary_version": "2.4.58-1ubuntu8.2",
            "binary_name": "apache2-bin"
        },
        {
            "binary_version": "2.4.58-1ubuntu8.2",
            "binary_name": "apache2-bin-dbgsym"
        },
        {
            "binary_version": "2.4.58-1ubuntu8.2",
            "binary_name": "apache2-data"
        },
        {
            "binary_version": "2.4.58-1ubuntu8.2",
            "binary_name": "apache2-dev"
        },
        {
            "binary_version": "2.4.58-1ubuntu8.2",
            "binary_name": "apache2-doc"
        },
        {
            "binary_version": "2.4.58-1ubuntu8.2",
            "binary_name": "apache2-ssl-dev"
        },
        {
            "binary_version": "2.4.58-1ubuntu8.2",
            "binary_name": "apache2-suexec-custom"
        },
        {
            "binary_version": "2.4.58-1ubuntu8.2",
            "binary_name": "apache2-suexec-custom-dbgsym"
        },
        {
            "binary_version": "2.4.58-1ubuntu8.2",
            "binary_name": "apache2-suexec-pristine"
        },
        {
            "binary_version": "2.4.58-1ubuntu8.2",
            "binary_name": "apache2-suexec-pristine-dbgsym"
        },
        {
            "binary_version": "2.4.58-1ubuntu8.2",
            "binary_name": "apache2-utils"
        },
        {
            "binary_version": "2.4.58-1ubuntu8.2",
            "binary_name": "apache2-utils-dbgsym"
        },
        {
            "binary_version": "2.4.58-1ubuntu8.2",
            "binary_name": "libapache2-mod-md"
        },
        {
            "binary_version": "2.4.58-1ubuntu8.2",
            "binary_name": "libapache2-mod-proxy-uwsgi"
        }
    ]
}