Bug 2295014 (CVE-2024-38475)
| Summary: | CVE-2024-38475 httpd: Improper escaping of output in mod_rewrite | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | akapse, alex.wang, charles.koprowski, csutherl, hmatsumo, jclere, pjindal, plodge, szappis |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
A flaw was found in the mod_rewrite module of httpd. Improper escaping of output allows an attacker to map URLs to filesystem locations permitted to be served by the server but are not intentionally or directly reachable by any URL. This issue results in code execution or source code disclosure.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2295108 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2024-07-01 19:22:07 UTC
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2024:4720 https://access.redhat.com/errata/RHSA-2024:4720 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Extended Update Support Via RHSA-2024:4719 https://access.redhat.com/errata/RHSA-2024:4719 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:4726 https://access.redhat.com/errata/RHSA-2024:4726 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Advanced Update Support Via RHSA-2024:4820 https://access.redhat.com/errata/RHSA-2024:4820 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions Red Hat Enterprise Linux 8.6 Telecommunications Update Service Via RHSA-2024:4827 https://access.redhat.com/errata/RHSA-2024:4827 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions Red Hat Enterprise Linux 8.4 Telecommunications Update Service Via RHSA-2024:4830 https://access.redhat.com/errata/RHSA-2024:4830 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Via RHSA-2024:4863 https://access.redhat.com/errata/RHSA-2024:4863 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Extended Update Support Via RHSA-2024:4862 https://access.redhat.com/errata/RHSA-2024:4862 This issue has been addressed in the following products: Red Hat Enterprise Linux 7.7 Advanced Update Support Via RHSA-2024:4938 https://access.redhat.com/errata/RHSA-2024:4938 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2024:4943 https://access.redhat.com/errata/RHSA-2024:4943 This issue has been addressed in the following products: Red Hat JBoss Core Services Via RHSA-2024:5240 https://access.redhat.com/errata/RHSA-2024:5240 This issue has been addressed in the following products: JBoss Core Services on RHEL 7 JBoss Core Services for RHEL 8 Via RHSA-2024:5239 https://access.redhat.com/errata/RHSA-2024:5239 |