httpd security update

2024-08-0800:00:00

linux.oracle.com

httpd

update

2.4.57

security

index.html

oracle

rhel-46047

cve-2024-38476

rhel-53021

regression

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

Low

EPSS

0.018

Percentile

88.5%

JSON

[2.4.57-11.0.1.el9_4.1]

Replace index.html with Oracle’s index page oracle_index.html.
[2.4.57-11.1]
Resolves: RHEL-46047 - httpd: Security issues via backend applications whose
response headers are malicious or exploitable (CVE-2024-38476)
Resolves: RHEL-53021 - Regression introduced by CVE-2024-38474 fix

OSVersionArchitecturePackageVersionFilename
oracle linux9srchttpd< 2.4.57-11.0.1.el9_4.1httpd-2.4.57-11.0.1.el9_4.1.src.rpm
oracle linux9aarch64httpd< 2.4.57-11.0.1.el9_4.1httpd-2.4.57-11.0.1.el9_4.1.aarch64.rpm
oracle linux9aarch64httpd-core< 2.4.57-11.0.1.el9_4.1httpd-core-2.4.57-11.0.1.el9_4.1.aarch64.rpm
oracle linux9aarch64httpd-devel< 2.4.57-11.0.1.el9_4.1httpd-devel-2.4.57-11.0.1.el9_4.1.aarch64.rpm
oracle linux9noarchhttpd-filesystem< 2.4.57-11.0.1.el9_4.1httpd-filesystem-2.4.57-11.0.1.el9_4.1.noarch.rpm
oracle linux9noarchhttpd-manual< 2.4.57-11.0.1.el9_4.1httpd-manual-2.4.57-11.0.1.el9_4.1.noarch.rpm
oracle linux9aarch64httpd-tools< 2.4.57-11.0.1.el9_4.1httpd-tools-2.4.57-11.0.1.el9_4.1.aarch64.rpm
oracle linux9aarch64mod_ldap< 2.4.57-11.0.1.el9_4.1mod_ldap-2.4.57-11.0.1.el9_4.1.aarch64.rpm
oracle linux9aarch64mod_lua< 2.4.57-11.0.1.el9_4.1mod_lua-2.4.57-11.0.1.el9_4.1.aarch64.rpm
oracle linux9aarch64mod_proxy_html< 2.4.57-11.0.1.el9_4.1mod_proxy_html-2.4.57-11.0.1.el9_4.1.aarch64.rpm

OS	Version	Architecture	Package	Version	Filename
oracle linux	9	src	httpd	< 2.4.57-11.0.1.el9_4.1	httpd-2.4.57-11.0.1.el9_4.1.src.rpm
oracle linux	9	aarch64	httpd	< 2.4.57-11.0.1.el9_4.1	httpd-2.4.57-11.0.1.el9_4.1.aarch64.rpm
oracle linux	9	aarch64	httpd-core	< 2.4.57-11.0.1.el9_4.1	httpd-core-2.4.57-11.0.1.el9_4.1.aarch64.rpm
oracle linux	9	aarch64	httpd-devel	< 2.4.57-11.0.1.el9_4.1	httpd-devel-2.4.57-11.0.1.el9_4.1.aarch64.rpm
oracle linux	9	noarch	httpd-filesystem	< 2.4.57-11.0.1.el9_4.1	httpd-filesystem-2.4.57-11.0.1.el9_4.1.noarch.rpm
oracle linux	9	noarch	httpd-manual	< 2.4.57-11.0.1.el9_4.1	httpd-manual-2.4.57-11.0.1.el9_4.1.noarch.rpm
oracle linux	9	aarch64	httpd-tools	< 2.4.57-11.0.1.el9_4.1	httpd-tools-2.4.57-11.0.1.el9_4.1.aarch64.rpm
oracle linux	9	aarch64	mod_ldap	< 2.4.57-11.0.1.el9_4.1	mod_ldap-2.4.57-11.0.1.el9_4.1.aarch64.rpm
oracle linux	9	aarch64	mod_lua	< 2.4.57-11.0.1.el9_4.1	mod_lua-2.4.57-11.0.1.el9_4.1.aarch64.rpm
oracle linux	9	aarch64	mod_proxy_html	< 2.4.57-11.0.1.el9_4.1	mod_proxy_html-2.4.57-11.0.1.el9_4.1.aarch64.rpm