You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by co...@apache.org on 2024/07/01 19:03:00 UTC
(httpd-site) branch main updated: add note
This is an automated email from the ASF dual-hosted git repository.
covener pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/httpd-site.git
The following commit(s) were added to refs/heads/main by this push:
new c934b17 add note
c934b17 is described below
commit c934b17a61b4dc1c284aea3950b6ed5687aebc1a
Author: Eric Covener <ec...@us.ibm.com>
AuthorDate: Mon Jul 1 15:02:53 2024 -0400
add note
---
content/security/json/CVE-2024-38476.json | 179 +++++++++++++++---------------
1 file changed, 91 insertions(+), 88 deletions(-)
diff --git a/content/security/json/CVE-2024-38476.json b/content/security/json/CVE-2024-38476.json
index 867e2ba..a800074 100644
--- a/content/security/json/CVE-2024-38476.json
+++ b/content/security/json/CVE-2024-38476.json
@@ -1,93 +1,96 @@
{
- "containers": {
- "cna": {
- "affected": [
- {
- "defaultStatus": "unaffected",
- "product": "Apache HTTP Server",
- "vendor": "Apache Software Foundation",
- "versions": [
- {
- "lessThanOrEqual": "2.4.59",
- "status": "affected",
- "version": "2.4.0",
- "versionType": "semver"
- }
- ]
- }
- ],
- "credits": [
- {
- "lang": "en",
- "type": "finder",
- "value": "Orange Tsai (@orange_8361) from DEVCORE"
- }
- ],
- "descriptions": [
- {
- "lang": "en",
- "supportingMedia": [
- {
- "base64": false,
- "type": "text/html",
- "value": "Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via <span style=\"background-color: rgb(255, 255, 255);\">backend applications whose response headers are malicious or exploitable.</span><br><br>Users are recommended to upgrade to version 2.4.60, which fixes this issue."
- }
- ],
- "value": "Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable.\n\nUsers are recommended to upgrade to version 2.4.60, which fixes this issue."
- }
- ],
- "metrics": [
- {
- "other": {
- "content": {
- "text": "important"
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "product": "Apache HTTP Server",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThanOrEqual": "2.4.59",
+ "status": "affected",
+ "version": "2.4.0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Orange Tsai (@orange_8361) from DEVCORE"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via <span style=\"background-color: rgb(255, 255, 255);\">backend applications whose response headers are malicious or exploitable.</span><br><br>Note: Some legacy uses of the 'AddType' directive to connect a request to a handler must be ported to 'SetHandler' after this fix.<br><br>Users are recommended to [...]
+ }
+ ],
+ "value": "Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable.\n\nNote: Some legacy uses of the 'AddType' directive to connect a request to a handler must be ported to 'SetHandler' after this fix.\n\nUsers are recommended to upgrade to version 2.4.60, which fixes this issue."
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "important"
+ },
+ "type": "Textual description of severity"
+ }
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-829",
+ "description": "CWE-829 Inclusion of Functionality from Untrusted Control Sphere",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
},
- "type": "Textual description of severity"
- }
- }
- ],
- "problemTypes": [
- {
- "descriptions": [
- {
- "cweId": "CWE-829",
- "description": "CWE-829 Inclusion of Functionality from Untrusted Control Sphere",
- "lang": "en",
- "type": "CWE"
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "timeline": [
+ {
+ "lang": "en",
+ "time": "2024-04-01T12:00:00.000Z",
+ "value": "reported"
+ }
+ ],
+ "title": "Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect",
+ "x_generator": {
+ "engine": "Vulnogram 0.1.0-dev"
}
- ]
- }
- ],
- "providerMetadata": {
- "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
- },
- "source": {
- "discovery": "UNKNOWN"
- },
- "timeline": [
- {
- "lang": "en",
- "time": "2024-04-01T12:00:00.000Z",
- "value": "reported"
- },
- {
- "lang": "eng",
- "time": "2024-07-01",
- "value": "2.4.60 released"
}
- ],
- "title": "Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect",
- "x_generator": {
- "engine": "Vulnogram 0.1.0-dev"
- }
- }
- },
- "cveMetadata": {
- "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
- "cveId": "CVE-2024-38476",
- "serial": 1,
- "state": "PUBLISHED"
- },
- "dataType": "CVE_RECORD",
- "dataVersion": "5.0"
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2024-38476",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
}