httpd:2.4 security update

2024-08-1300:00:00

linux.oracle.com

httpd

update

security

mod_http2

cve-2024-38476

cve-2024-27316

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

Low

EPSS

0.018

Percentile

88.5%

JSON

httpd
[2.4.37-65.2.0.1]

Replace index.html with Oracle’s index page oracle_index.html
[2.4.37-65.2]
Resolves: RHEL-46040 - httpd:2.4/httpd: Security issues via backend
applications whose response headers are malicious or exploitable (CVE-2024-38476)
Resolves: RHEL-53022 - Regression introduced by CVE-2024-38474 fix
mod_http2
[1.15.7-10]
Resolves: RHEL-29817 - httpd:2.4/mod_http2: httpd: CONTINUATION frames
DoS (CVE-2024-27316)
mod_md

OSVersionArchitecturePackageVersionFilename
oracle linux8srchttpd< 2.4.37-65.0.1.modulehttpd-2.4.37-65.0.1.module+el8.10.0+90383+734f7ffb.2.src.rpm
oracle linux8srcmod_http2< 1.15.7-10.modulemod_http2-1.15.7-10.module+el8.10.0+90327+96b8ea28.src.rpm
oracle linux8srcmod_md< 2.0.8-8.modulemod_md-2.0.8-8.module+el8.9.0+90011+2f9c6a23.src.rpm
oracle linux8aarch64httpd< 2.4.37-65.0.1.modulehttpd-2.4.37-65.0.1.module+el8.10.0+90383+734f7ffb.2.aarch64.rpm
oracle linux8aarch64httpd-devel< 2.4.37-65.0.1.modulehttpd-devel-2.4.37-65.0.1.module+el8.10.0+90383+734f7ffb.2.aarch64.rpm
oracle linux8noarchhttpd-filesystem< 2.4.37-65.0.1.modulehttpd-filesystem-2.4.37-65.0.1.module+el8.10.0+90383+734f7ffb.2.noarch.rpm
oracle linux8noarchhttpd-manual< 2.4.37-65.0.1.modulehttpd-manual-2.4.37-65.0.1.module+el8.10.0+90383+734f7ffb.2.noarch.rpm
oracle linux8aarch64httpd-tools< 2.4.37-65.0.1.modulehttpd-tools-2.4.37-65.0.1.module+el8.10.0+90383+734f7ffb.2.aarch64.rpm
oracle linux8aarch64mod_http2< 1.15.7-10.modulemod_http2-1.15.7-10.module+el8.10.0+90327+96b8ea28.aarch64.rpm
oracle linux8aarch64mod_ldap< 2.4.37-65.0.1.modulemod_ldap-2.4.37-65.0.1.module+el8.10.0+90383+734f7ffb.2.aarch64.rpm

OS	Version	Architecture	Package	Version	Filename
oracle linux	8	src	httpd	< 2.4.37-65.0.1.module	httpd-2.4.37-65.0.1.module+el8.10.0+90383+734f7ffb.2.src.rpm
oracle linux	8	src	mod_http2	< 1.15.7-10.module	mod_http2-1.15.7-10.module+el8.10.0+90327+96b8ea28.src.rpm
oracle linux	8	src	mod_md	< 2.0.8-8.module	mod_md-2.0.8-8.module+el8.9.0+90011+2f9c6a23.src.rpm
oracle linux	8	aarch64	httpd	< 2.4.37-65.0.1.module	httpd-2.4.37-65.0.1.module+el8.10.0+90383+734f7ffb.2.aarch64.rpm
oracle linux	8	aarch64	httpd-devel	< 2.4.37-65.0.1.module	httpd-devel-2.4.37-65.0.1.module+el8.10.0+90383+734f7ffb.2.aarch64.rpm
oracle linux	8	noarch	httpd-filesystem	< 2.4.37-65.0.1.module	httpd-filesystem-2.4.37-65.0.1.module+el8.10.0+90383+734f7ffb.2.noarch.rpm
oracle linux	8	noarch	httpd-manual	< 2.4.37-65.0.1.module	httpd-manual-2.4.37-65.0.1.module+el8.10.0+90383+734f7ffb.2.noarch.rpm
oracle linux	8	aarch64	httpd-tools	< 2.4.37-65.0.1.module	httpd-tools-2.4.37-65.0.1.module+el8.10.0+90383+734f7ffb.2.aarch64.rpm
oracle linux	8	aarch64	mod_http2	< 1.15.7-10.module	mod_http2-1.15.7-10.module+el8.10.0+90327+96b8ea28.aarch64.rpm
oracle linux	8	aarch64	mod_ldap	< 2.4.37-65.0.1.module	mod_ldap-2.4.37-65.0.1.module+el8.10.0+90383+734f7ffb.2.aarch64.rpm