You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by co...@apache.org on 2024/07/01 12:32:04 UTC
(httpd-site) branch main updated: publishing release httpd-2.4.60
This is an automated email from the ASF dual-hosted git repository.
covener pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/httpd-site.git
The following commit(s) were added to refs/heads/main by this push:
new 7ed8413 publishing release httpd-2.4.60
7ed8413 is described below
commit 7ed84133d99fda0c7e2bc9a041f38b41c61f4b74
Author: Eric Covener <ec...@us.ibm.com>
AuthorDate: Mon Jul 1 08:32:00 2024 -0400
publishing release httpd-2.4.60
---
content/doap.rdf | 4 +-
content/download.md | 24 ++++----
content/index.md | 6 +-
content/security/json/CVE-2024-36387.json | 93 +++++++++++++++++++++++++++++++
content/security/json/CVE-2024-38472.json | 93 +++++++++++++++++++++++++++++++
content/security/json/CVE-2024-38473.json | 93 +++++++++++++++++++++++++++++++
content/security/json/CVE-2024-38474.json | 93 +++++++++++++++++++++++++++++++
content/security/json/CVE-2024-38475.json | 93 +++++++++++++++++++++++++++++++
content/security/json/CVE-2024-38476.json | 93 +++++++++++++++++++++++++++++++
content/security/json/CVE-2024-38477.json | 93 +++++++++++++++++++++++++++++++
content/security/json/CVE-2024-39573.json | 93 +++++++++++++++++++++++++++++++
11 files changed, 761 insertions(+), 17 deletions(-)
diff --git a/content/doap.rdf b/content/doap.rdf
index d477be0..16d0d96 100644
--- a/content/doap.rdf
+++ b/content/doap.rdf
@@ -38,8 +38,8 @@
<release>
<Version>
<name>Recommended current 2.4 release</name>
- <created>2024-04-04</created>
- <revision>2.4.59</revision>
+ <created>2024-07-01</created>
+ <revision>2.4.60</revision>
</Version>
</release>
diff --git a/content/download.md b/content/download.md
index 268173d..8c22f94 100644
--- a/content/download.md
+++ b/content/download.md
@@ -19,16 +19,16 @@ Apache httpd for Microsoft Windows is available from
Stable Release - Latest Version:
-- [2.4.59](#apache24) (released 2024-04-04)
+- [2.4.60](#apache24) (released 2024-07-01)
If you are downloading the Win32 distribution, please read these [important
notes]([preferred]httpd/binaries/win32/README.html).
-# Apache HTTP Server 2.4.59 (httpd): 2.4.59 is the latest available version <span>2024-04-04</span> {#apache24}
+# Apache HTTP Server 2.4.60 (httpd): 2.4.60 is the latest available version <span>2024-07-01</span> {#apache24}
The Apache HTTP Server Project is pleased to
[announce](//downloads.apache.org/httpd/Announcement2.4.txt) the
-release of version 2.4.59 of the Apache HTTP Server ("Apache" and "httpd").
+release of version 2.4.60 of the Apache HTTP Server ("Apache" and "httpd").
This version of Apache is our latest GA release of the new generation 2.4.x
branch of Apache HTTPD and represents fifteen years of innovation by the
project, and is recommended over all previous releases!
@@ -36,17 +36,17 @@ project, and is recommended over all previous releases!
For details, see the [Official
Announcement](//downloads.apache.org/httpd/Announcement2.4.html) and
the [CHANGES_2.4]([preferred]httpd/CHANGES_2.4) and
-[CHANGES_2.4.59]([preferred]httpd/CHANGES_2.4.59) lists.
+[CHANGES_2.4.60]([preferred]httpd/CHANGES_2.4.60) lists.
-- Source: [httpd-2.4.59.tar.bz2]([preferred]httpd/httpd-2.4.59.tar.bz2)
-[ [PGP](https://downloads.apache.org/httpd/httpd-2.4.59.tar.bz2.asc) ] [
-[SHA256](https://downloads.apache.org/httpd/httpd-2.4.59.tar.bz2.sha256) ] [
-[SHA512](https://downloads.apache.org/httpd/httpd-2.4.59.tar.bz2.sha512) ]
+- Source: [httpd-2.4.60.tar.bz2]([preferred]httpd/httpd-2.4.60.tar.bz2)
+[ [PGP](https://downloads.apache.org/httpd/httpd-2.4.60.tar.bz2.asc) ] [
+[SHA256](https://downloads.apache.org/httpd/httpd-2.4.60.tar.bz2.sha256) ] [
+[SHA512](https://downloads.apache.org/httpd/httpd-2.4.60.tar.bz2.sha512) ]
-- Source: [httpd-2.4.59.tar.gz]([preferred]httpd/httpd-2.4.59.tar.gz) [
-[PGP](https://downloads.apache.org/httpd/httpd-2.4.59.tar.gz.asc) ] [
-[SHA256](https://downloads.apache.org/httpd/httpd-2.4.59.tar.gz.sha256) ] [
-[SHA512](https://downloads.apache.org/httpd/httpd-2.4.59.tar.gz.sha512) ]
+- Source: [httpd-2.4.60.tar.gz]([preferred]httpd/httpd-2.4.60.tar.gz) [
+[PGP](https://downloads.apache.org/httpd/httpd-2.4.60.tar.gz.asc) ] [
+[SHA256](https://downloads.apache.org/httpd/httpd-2.4.60.tar.gz.sha256) ] [
+[SHA512](https://downloads.apache.org/httpd/httpd-2.4.60.tar.gz.sha512) ]
- [Security and official patches]([preferred]httpd/patches/)
diff --git a/content/index.md b/content/index.md
index c565c96..5b05b1c 100644
--- a/content/index.md
+++ b/content/index.md
@@ -14,11 +14,11 @@ April 1996. It has celebrated its 25th birthday as a project in February 2020.
The Apache HTTP Server is a project of [The Apache Software
Foundation](https://www.apache.org/).
-# Apache httpd 2.4.59 Released <span>2024-04-04</span>
+# Apache httpd 2.4.60 Released <span>2024-07-01</span>
The Apache Software Foundation and the Apache HTTP Server Project are
pleased to
[announce](https://downloads.apache.org/httpd/Announcement2.4.html) the
-release of version 2.4.59 of the Apache HTTP Server ("httpd").
+release of version 2.4.60 of the Apache HTTP Server ("httpd").
This latest release from the 2.4.x stable branch represents the best available
version of Apache HTTP Server.
@@ -27,7 +27,7 @@ version of Apache HTTP Server.
Apache HTTP Server version 2.<span>4</span>.43 or newer is required in order to operate a TLS 1.3 web server with OpenSSL 1.1.1.
[Download](download.cgi#apache24) | [ChangeLog for
-2.4.59](https://downloads.apache.org/httpd/CHANGES_2.4.59) | [Complete ChangeLog for
+2.4.60](https://downloads.apache.org/httpd/CHANGES_2.4.60) | [Complete ChangeLog for
2.4](https://downloads.apache.org/httpd/CHANGES_2.4) | [New Features in httpd
2.4](docs/trunk/new_features_2_4.html) {.centered}
diff --git a/content/security/json/CVE-2024-36387.json b/content/security/json/CVE-2024-36387.json
new file mode 100644
index 0000000..11e667f
--- /dev/null
+++ b/content/security/json/CVE-2024-36387.json
@@ -0,0 +1,93 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "product": "Apache HTTP Server",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThanOrEqual": "2.4.59",
+ "status": "affected",
+ "version": "2.4.55",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Marc Stern (<marc.stern approach.be>)"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance."
+ }
+ ],
+ "value": "Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance."
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "low"
+ },
+ "type": "Textual description of severity"
+ }
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-476",
+ "description": "CWE-476 NULL Pointer Dereference",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "timeline": [
+ {
+ "lang": "en",
+ "time": "2024-05-27T13:23:00.000Z",
+ "value": "fixed in r1918003 in trunk"
+ },
+ {
+ "lang": "eng",
+ "time": "2024-07-01",
+ "value": "2.4.60 released"
+ }
+ ],
+ "title": "Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2",
+ "x_generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2024-36387",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}
diff --git a/content/security/json/CVE-2024-38472.json b/content/security/json/CVE-2024-38472.json
new file mode 100644
index 0000000..9a3a1ce
--- /dev/null
+++ b/content/security/json/CVE-2024-38472.json
@@ -0,0 +1,93 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "product": "Apache HTTP Server",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThanOrEqual": "2.4.59",
+ "status": "affected",
+ "version": "2.4.0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Orange Tsai (@orange_8361) from DEVCORE"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "SSRF in Apache HTTP Server on Windows allows to potentially leak NTML hashes to a malicious server via SSRF and <span style=\"background-color: rgb(255, 255, 255);\">malicious requests or content </span><br>Users are recommended to upgrade to version 2.4.60 which fixes this issue. Note: Existing configurations that access UNC paths will have to configure new directive \"UNCList\" to allow access during request processing."
+ }
+ ],
+ "value": "SSRF in Apache HTTP Server on Windows allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests or content \nUsers are recommended to upgrade to version 2.4.60 which fixes this issue. Note: Existing configurations that access UNC paths will have to configure new directive \"UNCList\" to allow access during request processing."
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "important"
+ },
+ "type": "Textual description of severity"
+ }
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-918",
+ "description": "CWE-918 Server-Side Request Forgery (SSRF)",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "timeline": [
+ {
+ "lang": "en",
+ "time": "2024-04-01T12:00:00.000Z",
+ "value": "reported"
+ },
+ {
+ "lang": "eng",
+ "time": "2024-07-01",
+ "value": "2.4.60 released"
+ }
+ ],
+ "title": "Apache HTTP Server on WIndows UNC SSRF",
+ "x_generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2024-38472",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}
diff --git a/content/security/json/CVE-2024-38473.json b/content/security/json/CVE-2024-38473.json
new file mode 100644
index 0000000..2b4d1cf
--- /dev/null
+++ b/content/security/json/CVE-2024-38473.json
@@ -0,0 +1,93 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "product": "Apache HTTP Server",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThanOrEqual": "2.4.59",
+ "status": "affected",
+ "version": "2.4.0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Orange Tsai (@orange_8361) from DEVCORE"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests.<br>Users are recommended to upgrade to version 2.4.60, which fixes this issue."
+ }
+ ],
+ "value": "Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests.\nUsers are recommended to upgrade to version 2.4.60, which fixes this issue."
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "moderate"
+ },
+ "type": "Textual description of severity"
+ }
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-116",
+ "description": "CWE-116 Improper Encoding or Escaping of Output",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "timeline": [
+ {
+ "lang": "en",
+ "time": "2024-04-01T12:00:00.000Z",
+ "value": "reported"
+ },
+ {
+ "lang": "eng",
+ "time": "2024-07-01",
+ "value": "2.4.60 released"
+ }
+ ],
+ "title": "Apache HTTP Server proxy encoding problem",
+ "x_generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2024-38473",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}
diff --git a/content/security/json/CVE-2024-38474.json b/content/security/json/CVE-2024-38474.json
new file mode 100644
index 0000000..aef19dd
--- /dev/null
+++ b/content/security/json/CVE-2024-38474.json
@@ -0,0 +1,93 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "product": "Apache HTTP Server",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThanOrEqual": "2.4.59",
+ "status": "affected",
+ "version": "2.4.0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Orange Tsai (@orange_8361) from DEVCORE"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in<br>directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI.<br><br>Users are recommended to upgrade to version 2.4.59, which fixes this issue.<br><br>Some RewriteRules that capture and substitute unsafely will now fail unless rewrite flag \"UnsafeA [...]
+ }
+ ],
+ "value": "Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in\ndirectories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI.\n\nUsers are recommended to upgrade to version 2.4.60, which fixes this issue.\n\nSome RewriteRules that capture and substitute unsafely will now fail unless rewrite flag \"UnsafeAllow3F\" is specified."
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "important"
+ },
+ "type": "Textual description of severity"
+ }
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-116",
+ "description": "CWE-116 Improper Encoding or Escaping of Output",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "timeline": [
+ {
+ "lang": "en",
+ "time": "2024-04-01T12:00:00.000Z",
+ "value": "reported"
+ },
+ {
+ "lang": "eng",
+ "time": "2024-07-01",
+ "value": "2.4.60 released"
+ }
+ ],
+ "title": "Apache HTTP Server weakness with encoded question marks in backreferences",
+ "x_generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2024-38474",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}
diff --git a/content/security/json/CVE-2024-38475.json b/content/security/json/CVE-2024-38475.json
new file mode 100644
index 0000000..569735b
--- /dev/null
+++ b/content/security/json/CVE-2024-38475.json
@@ -0,0 +1,93 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "product": "Apache HTTP Server",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThanOrEqual": "2.4.59",
+ "status": "affected",
+ "version": "2.4.0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Orange Tsai (@orange_8361) from DEVCORE"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. <br><br>Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRul [...]
+ }
+ ],
+ "value": "Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. \n\nSubstitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by th [...]
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "important"
+ },
+ "type": "Textual description of severity"
+ }
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-116",
+ "description": "CWE-116 Improper Encoding or Escaping of Output",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "timeline": [
+ {
+ "lang": "en",
+ "time": "2024-04-01T12:00:00.000Z",
+ "value": "reported"
+ },
+ {
+ "lang": "eng",
+ "time": "2024-07-01",
+ "value": "2.4.60 released"
+ }
+ ],
+ "title": "Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.",
+ "x_generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2024-38475",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}
diff --git a/content/security/json/CVE-2024-38476.json b/content/security/json/CVE-2024-38476.json
new file mode 100644
index 0000000..867e2ba
--- /dev/null
+++ b/content/security/json/CVE-2024-38476.json
@@ -0,0 +1,93 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "product": "Apache HTTP Server",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThanOrEqual": "2.4.59",
+ "status": "affected",
+ "version": "2.4.0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Orange Tsai (@orange_8361) from DEVCORE"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via <span style=\"background-color: rgb(255, 255, 255);\">backend applications whose response headers are malicious or exploitable.</span><br><br>Users are recommended to upgrade to version 2.4.60, which fixes this issue."
+ }
+ ],
+ "value": "Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable.\n\nUsers are recommended to upgrade to version 2.4.60, which fixes this issue."
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "important"
+ },
+ "type": "Textual description of severity"
+ }
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-829",
+ "description": "CWE-829 Inclusion of Functionality from Untrusted Control Sphere",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "timeline": [
+ {
+ "lang": "en",
+ "time": "2024-04-01T12:00:00.000Z",
+ "value": "reported"
+ },
+ {
+ "lang": "eng",
+ "time": "2024-07-01",
+ "value": "2.4.60 released"
+ }
+ ],
+ "title": "Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect",
+ "x_generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2024-38476",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}
diff --git a/content/security/json/CVE-2024-38477.json b/content/security/json/CVE-2024-38477.json
new file mode 100644
index 0000000..eea15a3
--- /dev/null
+++ b/content/security/json/CVE-2024-38477.json
@@ -0,0 +1,93 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "product": "Apache HTTP Server",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThanOrEqual": "2.4.59",
+ "status": "affected",
+ "version": "2.4.0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Orange Tsai (@orange_8361) from DEVCORE"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request.<br>Users are recommended to upgrade to version 2.4.60, which fixes this issue."
+ }
+ ],
+ "value": "null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request.\nUsers are recommended to upgrade to version 2.4.60, which fixes this issue."
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "important"
+ },
+ "type": "Textual description of severity"
+ }
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-476",
+ "description": "CWE-476 NULL Pointer Dereference",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "timeline": [
+ {
+ "lang": "en",
+ "time": "2024-04-01T12:00:00.000Z",
+ "value": "Reported"
+ },
+ {
+ "lang": "eng",
+ "time": "2024-07-01",
+ "value": "2.4.60 released"
+ }
+ ],
+ "title": "Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request",
+ "x_generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2024-38477",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}
diff --git a/content/security/json/CVE-2024-39573.json b/content/security/json/CVE-2024-39573.json
new file mode 100644
index 0000000..04fc138
--- /dev/null
+++ b/content/security/json/CVE-2024-39573.json
@@ -0,0 +1,93 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "product": "Apache HTTP Server",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThanOrEqual": "2.4.59",
+ "status": "affected",
+ "version": "2.4.0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Orange Tsai (@orange_8361) from DEVCORE"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to cause unsafe RewriteRules to unexpectedly setup URL's to be handled by mod_proxy.<br>Users are recommended to upgrade to version 2.4.60, which fixes this issue."
+ }
+ ],
+ "value": "Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to cause unsafe RewriteRules to unexpectedly setup URL's to be handled by mod_proxy.\nUsers are recommended to upgrade to version 2.4.60, which fixes this issue."
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "moderate"
+ },
+ "type": "Textual description of severity"
+ }
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-20",
+ "description": "CWE-20 Improper Input Validation",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "timeline": [
+ {
+ "lang": "en",
+ "time": "2024-04-01T12:00:00.000Z",
+ "value": "reported"
+ },
+ {
+ "lang": "eng",
+ "time": "2024-07-01",
+ "value": "2.4.60 released"
+ }
+ ],
+ "title": "Apache HTTP Server: mod_rewrite proxy handler substitution",
+ "x_generator": {
+ "engine": "Vulnogram 0.1.0-dev"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2024-39573",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.0"
+}