Improper Input Validation Affecting httpd:2.4/mod_http2 package, versions <0:1.15.7-10.module_el8.10.0+3832+564e7653

Q: How to fix?

<p>Upgrade <code>AlmaLinux:8</code> <code>httpd:2.4/mod_http2</code> to version 0:1.15.7-10.module_el8.10.0+3832+564e7653 or higher.<br>This issue was patched in <code>ALSA-2024:4720</code>.</p>

Threat Intelligence

0.04% (10^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-ALMALINUX8-HTTPD-7558100
published 24 Jul 2024
disclosed 23 Jul 2024

Report a new vulnerability Found a mistake?

Introduced: 23 Jul 2024

CVE-2024-39573 Open this link in a new tab CWE-20 Open this link in a new tab

How to fix?

Upgrade AlmaLinux:8 httpd:2.4/mod_http2 to version 0:1.15.7-10.module_el8.10.0+3832+564e7653 or higher.
This issue was patched in ALSA-2024:4720.

NVD Description

Note: Versions mentioned in the description apply only to the upstream httpd:2.4/mod_http2 package and not the httpd:2.4/mod_http2 package as distributed by AlmaLinux. See How to fix? for AlmaLinux:8 relevant fixed versions and status.

Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to cause unsafe RewriteRules to unexpectedly setup URL's to be handled by mod_proxy. Users are recommended to upgrade to version 2.4.60, which fixes this issue.

References

CVSS Scores

version 3.1

Attack Vector (AV)

Network
Attack Complexity (AC)

High
Privileges Required (PR)

None
User Interaction (UI)

None

Scope (S)

Unchanged

Confidentiality (C)

High
Integrity (I)

High
Availability (A)

None

Improper Input Validation Affecting httpd:2.4/mod_http2 package, versions <0:1.15.7-10.module_el8.10.0+3832+564e7653

Severity

Based on AlmaLinux security rating