Vulnerability-Lookup

ubuntu-cve-2024-38473

Vulnerability from osv_ubuntu

Published

2024-07-01 19:15

Modified

2026-05-29 10:27

Summary

Details

Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests. Users are recommended to upgrade to version 2.4.60, which fixes this issue.

Severity

8.1 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2024-38473	REPORT
	https://www.cve.org/CVERecord?id=CVE-2024-38473	REPORT
	https://httpd.apache.org/security/vulnerabilities…	REPORT
	https://httpd.apache.org/security/vulnerabilities…	REPORT
	https://ubuntu.com/security/notices/USN-6885-1	ADVISORY
	https://ubuntu.com/security/notices/USN-8338-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "apache2",
            "binary_version": "2.4.18-2ubuntu3.17+esm17"
          },
          {
            "binary_name": "apache2-bin",
            "binary_version": "2.4.18-2ubuntu3.17+esm17"
          },
          {
            "binary_name": "apache2-data",
            "binary_version": "2.4.18-2ubuntu3.17+esm17"
          },
          {
            "binary_name": "apache2-suexec-custom",
            "binary_version": "2.4.18-2ubuntu3.17+esm17"
          },
          {
            "binary_name": "apache2-suexec-pristine",
            "binary_version": "2.4.18-2ubuntu3.17+esm17"
          },
          {
            "binary_name": "apache2-utils",
            "binary_version": "2.4.18-2ubuntu3.17+esm17"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "apache2",
        "purl": "pkg:deb/ubuntu/apache2@2.4.18-2ubuntu3.17+esm17?arch=source\u0026distro=esm-infra-legacy/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.18-2ubuntu3.17+esm17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.4.12-2ubuntu2",
        "2.4.17-1ubuntu1",
        "2.4.17-2ubuntu1",
        "2.4.17-3ubuntu1",
        "2.4.18-1ubuntu1",
        "2.4.18-2ubuntu1",
        "2.4.18-2ubuntu2",
        "2.4.18-2ubuntu3",
        "2.4.18-2ubuntu3.1",
        "2.4.18-2ubuntu3.2",
        "2.4.18-2ubuntu3.3",
        "2.4.18-2ubuntu3.4",
        "2.4.18-2ubuntu3.5",
        "2.4.18-2ubuntu3.7",
        "2.4.18-2ubuntu3.8",
        "2.4.18-2ubuntu3.9",
        "2.4.18-2ubuntu3.10",
        "2.4.18-2ubuntu3.12",
        "2.4.18-2ubuntu3.13",
        "2.4.18-2ubuntu3.14",
        "2.4.18-2ubuntu3.15",
        "2.4.18-2ubuntu3.17",
        "2.4.18-2ubuntu3.17+esm1",
        "2.4.18-2ubuntu3.17+esm2",
        "2.4.18-2ubuntu3.17+esm3",
        "2.4.18-2ubuntu3.17+esm4",
        "2.4.18-2ubuntu3.17+esm5",
        "2.4.18-2ubuntu3.17+esm6",
        "2.4.18-2ubuntu3.17+esm7",
        "2.4.18-2ubuntu3.17+esm8",
        "2.4.18-2ubuntu3.17+esm9",
        "2.4.18-2ubuntu3.17+esm10",
        "2.4.18-2ubuntu3.17+esm11",
        "2.4.18-2ubuntu3.17+esm12",
        "2.4.18-2ubuntu3.17+esm13",
        "2.4.18-2ubuntu3.17+esm14",
        "2.4.18-2ubuntu3.17+esm16"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "apache2",
            "binary_version": "2.4.29-1ubuntu4.27+esm7"
          },
          {
            "binary_name": "apache2-bin",
            "binary_version": "2.4.29-1ubuntu4.27+esm7"
          },
          {
            "binary_name": "apache2-data",
            "binary_version": "2.4.29-1ubuntu4.27+esm7"
          },
          {
            "binary_name": "apache2-suexec-custom",
            "binary_version": "2.4.29-1ubuntu4.27+esm7"
          },
          {
            "binary_name": "apache2-suexec-pristine",
            "binary_version": "2.4.29-1ubuntu4.27+esm7"
          },
          {
            "binary_name": "apache2-utils",
            "binary_version": "2.4.29-1ubuntu4.27+esm7"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "apache2",
        "purl": "pkg:deb/ubuntu/apache2@2.4.29-1ubuntu4.27+esm7?arch=source\u0026distro=esm-infra/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.29-1ubuntu4.27+esm7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.4.27-2ubuntu3",
        "2.4.29-1ubuntu1",
        "2.4.29-1ubuntu2",
        "2.4.29-1ubuntu3",
        "2.4.29-1ubuntu4",
        "2.4.29-1ubuntu4.1",
        "2.4.29-1ubuntu4.2",
        "2.4.29-1ubuntu4.3",
        "2.4.29-1ubuntu4.4",
        "2.4.29-1ubuntu4.5",
        "2.4.29-1ubuntu4.6",
        "2.4.29-1ubuntu4.7",
        "2.4.29-1ubuntu4.8",
        "2.4.29-1ubuntu4.10",
        "2.4.29-1ubuntu4.11",
        "2.4.29-1ubuntu4.12",
        "2.4.29-1ubuntu4.13",
        "2.4.29-1ubuntu4.14",
        "2.4.29-1ubuntu4.16",
        "2.4.29-1ubuntu4.17",
        "2.4.29-1ubuntu4.18",
        "2.4.29-1ubuntu4.19",
        "2.4.29-1ubuntu4.20",
        "2.4.29-1ubuntu4.21",
        "2.4.29-1ubuntu4.22",
        "2.4.29-1ubuntu4.23",
        "2.4.29-1ubuntu4.24",
        "2.4.29-1ubuntu4.25",
        "2.4.29-1ubuntu4.26",
        "2.4.29-1ubuntu4.27",
        "2.4.29-1ubuntu4.27+esm1",
        "2.4.29-1ubuntu4.27+esm2",
        "2.4.29-1ubuntu4.27+esm3",
        "2.4.29-1ubuntu4.27+esm4",
        "2.4.29-1ubuntu4.27+esm6"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "apache2",
            "binary_version": "2.4.41-4ubuntu3.19"
          },
          {
            "binary_name": "apache2-bin",
            "binary_version": "2.4.41-4ubuntu3.19"
          },
          {
            "binary_name": "apache2-data",
            "binary_version": "2.4.41-4ubuntu3.19"
          },
          {
            "binary_name": "apache2-suexec-custom",
            "binary_version": "2.4.41-4ubuntu3.19"
          },
          {
            "binary_name": "apache2-suexec-pristine",
            "binary_version": "2.4.41-4ubuntu3.19"
          },
          {
            "binary_name": "apache2-utils",
            "binary_version": "2.4.41-4ubuntu3.19"
          },
          {
            "binary_name": "libapache2-mod-md",
            "binary_version": "2.4.41-4ubuntu3.19"
          },
          {
            "binary_name": "libapache2-mod-proxy-uwsgi",
            "binary_version": "2.4.41-4ubuntu3.19"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "apache2",
        "purl": "pkg:deb/ubuntu/apache2@2.4.41-4ubuntu3.19?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.41-4ubuntu3.19"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.4.41-1ubuntu1",
        "2.4.41-4ubuntu1",
        "2.4.41-4ubuntu2",
        "2.4.41-4ubuntu3",
        "2.4.41-4ubuntu3.1",
        "2.4.41-4ubuntu3.3",
        "2.4.41-4ubuntu3.4",
        "2.4.41-4ubuntu3.5",
        "2.4.41-4ubuntu3.6",
        "2.4.41-4ubuntu3.7",
        "2.4.41-4ubuntu3.8",
        "2.4.41-4ubuntu3.9",
        "2.4.41-4ubuntu3.10",
        "2.4.41-4ubuntu3.11",
        "2.4.41-4ubuntu3.12",
        "2.4.41-4ubuntu3.13",
        "2.4.41-4ubuntu3.14",
        "2.4.41-4ubuntu3.15",
        "2.4.41-4ubuntu3.16",
        "2.4.41-4ubuntu3.17"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "apache2",
            "binary_version": "2.4.52-1ubuntu4.10"
          },
          {
            "binary_name": "apache2-bin",
            "binary_version": "2.4.52-1ubuntu4.10"
          },
          {
            "binary_name": "apache2-data",
            "binary_version": "2.4.52-1ubuntu4.10"
          },
          {
            "binary_name": "apache2-suexec-custom",
            "binary_version": "2.4.52-1ubuntu4.10"
          },
          {
            "binary_name": "apache2-suexec-pristine",
            "binary_version": "2.4.52-1ubuntu4.10"
          },
          {
            "binary_name": "apache2-utils",
            "binary_version": "2.4.52-1ubuntu4.10"
          },
          {
            "binary_name": "libapache2-mod-md",
            "binary_version": "2.4.52-1ubuntu4.10"
          },
          {
            "binary_name": "libapache2-mod-proxy-uwsgi",
            "binary_version": "2.4.52-1ubuntu4.10"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "apache2",
        "purl": "pkg:deb/ubuntu/apache2@2.4.52-1ubuntu4.10?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.52-1ubuntu4.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.4.48-3.1ubuntu3",
        "2.4.48-3.1ubuntu4",
        "2.4.51-2ubuntu1",
        "2.4.52-1ubuntu1",
        "2.4.52-1ubuntu2",
        "2.4.52-1ubuntu4",
        "2.4.52-1ubuntu4.1",
        "2.4.52-1ubuntu4.2",
        "2.4.52-1ubuntu4.3",
        "2.4.52-1ubuntu4.4",
        "2.4.52-1ubuntu4.5",
        "2.4.52-1ubuntu4.6",
        "2.4.52-1ubuntu4.7",
        "2.4.52-1ubuntu4.8",
        "2.4.52-1ubuntu4.9"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "apache2",
            "binary_version": "2.4.58-1ubuntu8.2"
          },
          {
            "binary_name": "apache2-bin",
            "binary_version": "2.4.58-1ubuntu8.2"
          },
          {
            "binary_name": "apache2-data",
            "binary_version": "2.4.58-1ubuntu8.2"
          },
          {
            "binary_name": "apache2-suexec-custom",
            "binary_version": "2.4.58-1ubuntu8.2"
          },
          {
            "binary_name": "apache2-suexec-pristine",
            "binary_version": "2.4.58-1ubuntu8.2"
          },
          {
            "binary_name": "apache2-utils",
            "binary_version": "2.4.58-1ubuntu8.2"
          },
          {
            "binary_name": "libapache2-mod-md",
            "binary_version": "2.4.58-1ubuntu8.2"
          },
          {
            "binary_name": "libapache2-mod-proxy-uwsgi",
            "binary_version": "2.4.58-1ubuntu8.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "apache2",
        "purl": "pkg:deb/ubuntu/apache2@2.4.58-1ubuntu8.2?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.58-1ubuntu8.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.4.57-2ubuntu2",
        "2.4.57-2ubuntu3",
        "2.4.58-1ubuntu1",
        "2.4.58-1ubuntu2",
        "2.4.58-1ubuntu6",
        "2.4.58-1ubuntu7",
        "2.4.58-1ubuntu8",
        "2.4.58-1ubuntu8.1"
      ]
    }
  ],
  "aliases": [],
  "details": "Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests. Users are recommended to upgrade to version 2.4.60, which fixes this issue.",
  "id": "UBUNTU-CVE-2024-38473",
  "modified": "2026-05-29T10:27:18Z",
  "published": "2024-07-01T19:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-38473"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-38473"
    },
    {
      "type": "REPORT",
      "url": "https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2024-38473"
    },
    {
      "type": "REPORT",
      "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-6885-1"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8338-1"
    }
  ],
  "related": [
    "USN-6885-1",
    "USN-8338-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2024-38473"
  ]
}

CVE-2024-38473 (GCVE-0-2024-38473)

Vulnerability from cvelistv5 – Published: 2024-07-01 18:14 – Updated: 2025-02-13 17:53

Title

Apache HTTP Server proxy encoding problem

Summary

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-116 - Improper Encoding or Escaping of Output

Assigner

apache

References

3 references

URL	Tags
https://httpd.apache.org/security/vulnerabilities…	vendor-advisory
https://security.netapp.com/advisory/ntap-2024071…
http://www.openwall.com/lists/oss-security/2024/07/01/6

Impacted products

2 products

Vendor	Product	Version
Apache Software Foundation	Apache HTTP Server	Affected: 2.4.0 , ≤ 2.4.59 (semver)
apache_software_foundation	apache_http_server	Affected: 2.4.0 , ≤ 2.4.59 (semver) cpe:2.3:a:apache_software_foundation:apache_http_server::::::::

Credits

Orange Tsai (@orange_8361) from DEVCORE

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:apache_software_foundation:apache_http_server:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "apache_http_server",
            "vendor": "apache_software_foundation",
            "versions": [
              {
                "lessThanOrEqual": "2.4.59",
                "status": "affected",
                "version": "2.4.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-38473",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-24T13:55:35.300035Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-24T14:02:38.927Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-09-13T17:04:54.566Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240712-0001/"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2024/07/01/6"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache HTTP Server",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "2.4.59",
              "status": "affected",
              "version": "2.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Orange Tsai (@orange_8361) from DEVCORE"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests.\u003cbr\u003eUsers are recommended to upgrade to version 2.4.60, which fixes this issue."
            }
          ],
          "value": "Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests.\nUsers are recommended to upgrade to version 2.4.60, which fixes this issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-116",
              "description": "CWE-116 Improper Encoding or Escaping of Output",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-12T14:06:08.211Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240712-0001/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2024-04-01T12:00:00.000Z",
          "value": "reported"
        }
      ],
      "title": "Apache HTTP Server proxy encoding problem",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2024-38473",
    "datePublished": "2024-07-01T18:14:21.520Z",
    "dateReserved": "2024-06-17T11:05:01.135Z",
    "dateUpdated": "2025-02-13T17:53:12.372Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

usn-6885-1

Vulnerability from osv_ubuntu

Published

2024-07-08 17:56

Modified

2026-04-27 14:11

Summary

apache2 vulnerabilities

Details

Marc Stern discovered that the Apache HTTP Server incorrectly handled serving WebSocket protocol upgrades over HTTP/2 connections. A remote attacker could possibly use this issue to cause the server to crash, resulting in a denial of service. (CVE-2024-36387)

Orange Tsai discovered that the Apache HTTP Server mod_proxy module incorrectly sent certain request URLs with incorrect encodings to backends. A remote attacker could possibly use this issue to bypass authentication. (CVE-2024-38473)

Orange Tsai discovered that the Apache HTTP Server mod_rewrite module incorrectly handled certain substitutions. A remote attacker could possibly use this issue to execute scripts in directories not directly reachable by any URL, or cause a denial of service. Some environments may require using the new UnsafeAllow3F flag to handle unsafe substitutions. (CVE-2024-38474, CVE-2024-38475, CVE-2024-39573)

Orange Tsai discovered that the Apache HTTP Server incorrectly handled certain response headers. A remote attacker could possibly use this issue to obtain sensitive information, execute local scripts, or perform SSRF attacks. (CVE-2024-38476)

Orange Tsai discovered that the Apache HTTP Server mod_proxy module incorrectly handled certain requests. A remote attacker could possibly use this issue to cause the server to crash, resulting in a denial of service. (CVE-2024-38477)

It was discovered that the Apache HTTP Server incorrectly handled certain handlers configured via AddType. A remote attacker could possibly use this issue to obtain source code. (CVE-2024-39884)

References

URL

Type

	https://ubuntu.com/security/notices/USN-6885-1	ADVISORY
	https://ubuntu.com/security/CVE-2024-36387	REPORT
	https://ubuntu.com/security/CVE-2024-38473	REPORT
	https://ubuntu.com/security/CVE-2024-38474	REPORT
	https://ubuntu.com/security/CVE-2024-38475	REPORT
	https://ubuntu.com/security/CVE-2024-38476	REPORT
	https://ubuntu.com/security/CVE-2024-38477	REPORT
	https://ubuntu.com/security/CVE-2024-39573	REPORT
	https://ubuntu.com/security/CVE-2024-39884	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2024-36387",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-38473",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-38475",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "high",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-38476",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-38477",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-39573",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-39884",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:20.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "apache2",
            "binary_version": "2.4.41-4ubuntu3.19"
          },
          {
            "binary_name": "apache2-bin",
            "binary_version": "2.4.41-4ubuntu3.19"
          },
          {
            "binary_name": "apache2-data",
            "binary_version": "2.4.41-4ubuntu3.19"
          },
          {
            "binary_name": "apache2-suexec-custom",
            "binary_version": "2.4.41-4ubuntu3.19"
          },
          {
            "binary_name": "apache2-suexec-pristine",
            "binary_version": "2.4.41-4ubuntu3.19"
          },
          {
            "binary_name": "apache2-utils",
            "binary_version": "2.4.41-4ubuntu3.19"
          },
          {
            "binary_name": "libapache2-mod-md",
            "binary_version": "2.4.41-4ubuntu3.19"
          },
          {
            "binary_name": "libapache2-mod-proxy-uwsgi",
            "binary_version": "2.4.41-4ubuntu3.19"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "apache2",
        "purl": "pkg:deb/ubuntu/apache2@2.4.41-4ubuntu3.19?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.41-4ubuntu3.19"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.4.41-1ubuntu1",
        "2.4.41-4ubuntu1",
        "2.4.41-4ubuntu2",
        "2.4.41-4ubuntu3",
        "2.4.41-4ubuntu3.1",
        "2.4.41-4ubuntu3.3",
        "2.4.41-4ubuntu3.4",
        "2.4.41-4ubuntu3.5",
        "2.4.41-4ubuntu3.6",
        "2.4.41-4ubuntu3.7",
        "2.4.41-4ubuntu3.8",
        "2.4.41-4ubuntu3.9",
        "2.4.41-4ubuntu3.10",
        "2.4.41-4ubuntu3.11",
        "2.4.41-4ubuntu3.12",
        "2.4.41-4ubuntu3.13",
        "2.4.41-4ubuntu3.14",
        "2.4.41-4ubuntu3.15",
        "2.4.41-4ubuntu3.16",
        "2.4.41-4ubuntu3.17"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2024-36387",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-38473",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-38475",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "high",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-38476",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-38477",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-39573",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-39884",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:22.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "apache2",
            "binary_version": "2.4.52-1ubuntu4.10"
          },
          {
            "binary_name": "apache2-bin",
            "binary_version": "2.4.52-1ubuntu4.10"
          },
          {
            "binary_name": "apache2-data",
            "binary_version": "2.4.52-1ubuntu4.10"
          },
          {
            "binary_name": "apache2-suexec-custom",
            "binary_version": "2.4.52-1ubuntu4.10"
          },
          {
            "binary_name": "apache2-suexec-pristine",
            "binary_version": "2.4.52-1ubuntu4.10"
          },
          {
            "binary_name": "apache2-utils",
            "binary_version": "2.4.52-1ubuntu4.10"
          },
          {
            "binary_name": "libapache2-mod-md",
            "binary_version": "2.4.52-1ubuntu4.10"
          },
          {
            "binary_name": "libapache2-mod-proxy-uwsgi",
            "binary_version": "2.4.52-1ubuntu4.10"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "apache2",
        "purl": "pkg:deb/ubuntu/apache2@2.4.52-1ubuntu4.10?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.52-1ubuntu4.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.4.48-3.1ubuntu3",
        "2.4.48-3.1ubuntu4",
        "2.4.51-2ubuntu1",
        "2.4.52-1ubuntu1",
        "2.4.52-1ubuntu2",
        "2.4.52-1ubuntu4",
        "2.4.52-1ubuntu4.1",
        "2.4.52-1ubuntu4.2",
        "2.4.52-1ubuntu4.3",
        "2.4.52-1ubuntu4.4",
        "2.4.52-1ubuntu4.5",
        "2.4.52-1ubuntu4.6",
        "2.4.52-1ubuntu4.7",
        "2.4.52-1ubuntu4.8",
        "2.4.52-1ubuntu4.9"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2024-36387",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-38473",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-38475",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "high",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-38476",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-38477",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-39573",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-39884",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:24.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "apache2",
            "binary_version": "2.4.58-1ubuntu8.2"
          },
          {
            "binary_name": "apache2-bin",
            "binary_version": "2.4.58-1ubuntu8.2"
          },
          {
            "binary_name": "apache2-data",
            "binary_version": "2.4.58-1ubuntu8.2"
          },
          {
            "binary_name": "apache2-suexec-custom",
            "binary_version": "2.4.58-1ubuntu8.2"
          },
          {
            "binary_name": "apache2-suexec-pristine",
            "binary_version": "2.4.58-1ubuntu8.2"
          },
          {
            "binary_name": "apache2-utils",
            "binary_version": "2.4.58-1ubuntu8.2"
          },
          {
            "binary_name": "libapache2-mod-md",
            "binary_version": "2.4.58-1ubuntu8.2"
          },
          {
            "binary_name": "libapache2-mod-proxy-uwsgi",
            "binary_version": "2.4.58-1ubuntu8.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "apache2",
        "purl": "pkg:deb/ubuntu/apache2@2.4.58-1ubuntu8.2?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.58-1ubuntu8.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.4.57-2ubuntu2",
        "2.4.57-2ubuntu3",
        "2.4.58-1ubuntu1",
        "2.4.58-1ubuntu2",
        "2.4.58-1ubuntu6",
        "2.4.58-1ubuntu7",
        "2.4.58-1ubuntu8",
        "2.4.58-1ubuntu8.1"
      ]
    }
  ],
  "aliases": [],
  "details": "Marc Stern discovered that the Apache HTTP Server incorrectly handled\nserving WebSocket protocol upgrades over HTTP/2 connections. A remote\nattacker could possibly use this issue to cause the server to crash,\nresulting in a denial of service. (CVE-2024-36387)\n\nOrange Tsai discovered that the Apache HTTP Server mod_proxy module\nincorrectly sent certain request URLs with incorrect encodings to backends.\nA remote attacker could possibly use this issue to bypass authentication.\n(CVE-2024-38473)\n\nOrange Tsai discovered that the Apache HTTP Server mod_rewrite module\nincorrectly handled certain substitutions. A remote attacker could possibly\nuse this issue to execute scripts in directories not directly reachable\nby any URL, or cause a denial of service. Some environments may require\nusing the new UnsafeAllow3F flag to handle unsafe substitutions.\n(CVE-2024-38474, CVE-2024-38475, CVE-2024-39573)\n\nOrange Tsai discovered that the Apache HTTP Server incorrectly handled\ncertain response headers. A remote attacker could possibly use this issue\nto obtain sensitive information, execute local scripts, or perform SSRF\nattacks. (CVE-2024-38476)\n\nOrange Tsai discovered that the Apache HTTP Server mod_proxy module\nincorrectly handled certain requests. A remote attacker could possibly use\nthis issue to cause the server to crash, resulting in a denial of service.\n(CVE-2024-38477)\n\nIt was discovered that the Apache HTTP Server incorrectly handled certain\nhandlers configured via AddType. A remote attacker could possibly use this\nissue to obtain source code. (CVE-2024-39884)\n",
  "id": "USN-6885-1",
  "modified": "2026-04-27T14:11:34Z",
  "published": "2024-07-08T17:56:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-6885-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-36387"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-38473"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-38474"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-38475"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-38476"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-38477"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-39573"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-39884"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "apache2 vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2024-36387",
    "UBUNTU-CVE-2024-38473",
    "UBUNTU-CVE-2024-38474",
    "UBUNTU-CVE-2024-38475",
    "UBUNTU-CVE-2024-38476",
    "UBUNTU-CVE-2024-38477",
    "UBUNTU-CVE-2024-39573",
    "UBUNTU-CVE-2024-39884"
  ]
}

usn-8338-1

Vulnerability from osv_ubuntu

Published

2026-05-28 14:51

Modified

2026-05-28 14:51

Summary

apache2 vulnerabilities

Details

It was discovered that Apache HTTP Server incorrectly handled certain response headers. An attacker could possibly use this issue to perform HTTP response splitting attacks. This issue only affected Ubuntu 14.04 LTS. (CVE-2023-38709)

Will Dormann and David Warren discovered that Apache HTTP Server's HTTP/2 implementation did not properly reclaim memory when streams were reset by clients. A remote attacker could possibly use this issue to cause Apache HTTP Server to consume resources, leading to a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2023-45802)

Keran Mu and Jianjun Chen discovered that Apache HTTP Server incorrectly handled certain response headers. An attacker could possibly use this issue to perform HTTP response splitting attacks. This issue only affected Ubuntu 14.04 LTS. (CVE-2024-24795)

Orange Tsai discovered that Apache HTTP Server mod_proxy incorrectly handled URL encoding. A remote attacker could possibly use this issue to bypass authentication via crafted requests. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2024-38473)

Orange Tsai discovered that Apache HTTP Server could be caused to perform server-side request forgery (SSRF) via malicious backend response headers. A remote attacker could possibly use this issue to conduct SSRF attacks or disclose sensitive information. This issue only affected Ubuntu 14.04 LTS. (CVE-2024-38476)

Orange Tsai discovered that Apache HTTP Server mod_proxy did not properly handle certain null pointer conditions. A remote attacker could possibly use this issue to cause Apache HTTP Server to crash, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS. (CVE-2024-38477)

Orange Tsai discovered that Apache HTTP Server mod_rewrite could be made to perform server-side request forgery (SSRF) via unsafe RewriteRules. A remote attacker could possibly use this issue to conduct SSRF attacks. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2024-39573)

It was discovered that Apache HTTP Server could be caused to perform server-side request forgery (SSRF) via mod_headers modifying Content-Type headers. A remote attacker could possibly use this issue to conduct SSRF attacks. This issue only affected Ubuntu 14.04 LTS. (CVE-2024-43204)

John Runyon discovered that Apache HTTP Server mod_ssl did not properly escape user-supplied data before writing log entries. A remote attacker could possibly use this issue to insert escape sequences into log files. This issue only affected Ubuntu 14.04 LTS. (CVE-2024-47252)

Robert Merget discovered that Apache HTTP Server with SSLEngine optional was vulnerable to HTTP desynchronisation attacks. An attacker in a privileged network position could possibly use this issue to hijack HTTP sessions. This issue only affected Ubuntu 14.04 LTS. (CVE-2025-49812)

It was discovered that Apache HTTP Server mod_md had an integer overflow in the ACME certificate renewal backoff timer. An attacker could possibly use this issue to cause excessive certificate renewal requests. This issue only affected Ubuntu 20.04 LTS. (CVE-2025-55753)

Anthony Parfenov discovered that Apache HTTP Server with SSI enabled and mod_cgid passed shell-escaped query strings to #exec cmd directives. A remote attacker could possibly use this issue to perform command injection. (CVE-2025-58098)

Mattias Åsander discovered that Apache HTTP Server incorrectly gave precedence to environment variables from HTTP headers over server-calculated CGI variables. A remote attacker could possibly use this issue to influence the environment of CGI programs. (CVE-2025-65082)

Mattias Åsander discovered that Apache HTTP Server mod_userdir with suexec could be caused to run CGI scripts under an unexpected user ID via RequestHeader directives in .htaccess files. An attacker with .htaccess write access could possibly use this issue to bypass suexec user restrictions. (CVE-2025-66200)

References

URL

Type

	https://ubuntu.com/security/notices/USN-8338-1	ADVISORY
	https://ubuntu.com/security/CVE-2023-38709	REPORT
	https://ubuntu.com/security/CVE-2023-45802	REPORT
	https://ubuntu.com/security/CVE-2024-24795	REPORT
	https://ubuntu.com/security/CVE-2024-38473	REPORT
	https://ubuntu.com/security/CVE-2024-38476	REPORT
	https://ubuntu.com/security/CVE-2024-38477	REPORT
	https://ubuntu.com/security/CVE-2024-39573	REPORT
	https://ubuntu.com/security/CVE-2024-42516	REPORT
	https://ubuntu.com/security/CVE-2024-43204	REPORT
	https://ubuntu.com/security/CVE-2024-47252	REPORT
	https://ubuntu.com/security/CVE-2025-49812	REPORT
	https://ubuntu.com/security/CVE-2025-55753	REPORT
	https://ubuntu.com/security/CVE-2025-58098	REPORT
	https://ubuntu.com/security/CVE-2025-65082	REPORT
	https://ubuntu.com/security/CVE-2025-66200	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2023-38709",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-24795",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-38476",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-38477",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-39573",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-42516",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-43204",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-47252",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-49812",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-58098",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-65082",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-66200",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:14.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "apache2",
            "binary_version": "2.4.7-1ubuntu4.22+esm12"
          },
          {
            "binary_name": "apache2-bin",
            "binary_version": "2.4.7-1ubuntu4.22+esm12"
          },
          {
            "binary_name": "apache2-data",
            "binary_version": "2.4.7-1ubuntu4.22+esm12"
          },
          {
            "binary_name": "apache2-mpm-event",
            "binary_version": "2.4.7-1ubuntu4.22+esm12"
          },
          {
            "binary_name": "apache2-mpm-itk",
            "binary_version": "2.4.7-1ubuntu4.22+esm12"
          },
          {
            "binary_name": "apache2-mpm-prefork",
            "binary_version": "2.4.7-1ubuntu4.22+esm12"
          },
          {
            "binary_name": "apache2-mpm-worker",
            "binary_version": "2.4.7-1ubuntu4.22+esm12"
          },
          {
            "binary_name": "apache2-suexec",
            "binary_version": "2.4.7-1ubuntu4.22+esm12"
          },
          {
            "binary_name": "apache2-suexec-custom",
            "binary_version": "2.4.7-1ubuntu4.22+esm12"
          },
          {
            "binary_name": "apache2-suexec-pristine",
            "binary_version": "2.4.7-1ubuntu4.22+esm12"
          },
          {
            "binary_name": "apache2-utils",
            "binary_version": "2.4.7-1ubuntu4.22+esm12"
          },
          {
            "binary_name": "apache2.2-bin",
            "binary_version": "2.4.7-1ubuntu4.22+esm12"
          },
          {
            "binary_name": "libapache2-mod-macro",
            "binary_version": "1:2.4.7-1ubuntu4.22+esm12"
          },
          {
            "binary_name": "libapache2-mod-proxy-html",
            "binary_version": "1:2.4.7-1ubuntu4.22+esm12"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "apache2",
        "purl": "pkg:deb/ubuntu/apache2@2.4.7-1ubuntu4.22+esm12?arch=source\u0026distro=esm-infra-legacy/trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.7-1ubuntu4.22+esm12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.4.6-2ubuntu2",
        "2.4.6-2ubuntu3",
        "2.4.6-2ubuntu4",
        "2.4.7-1ubuntu1",
        "2.4.7-1ubuntu2",
        "2.4.7-1ubuntu3",
        "2.4.7-1ubuntu4",
        "2.4.7-1ubuntu4.1",
        "2.4.7-1ubuntu4.4",
        "2.4.7-1ubuntu4.5",
        "2.4.7-1ubuntu4.6",
        "2.4.7-1ubuntu4.7",
        "2.4.7-1ubuntu4.8",
        "2.4.7-1ubuntu4.9",
        "2.4.7-1ubuntu4.10",
        "2.4.7-1ubuntu4.11",
        "2.4.7-1ubuntu4.13",
        "2.4.7-1ubuntu4.15",
        "2.4.7-1ubuntu4.16",
        "2.4.7-1ubuntu4.17",
        "2.4.7-1ubuntu4.18",
        "2.4.7-1ubuntu4.19",
        "2.4.7-1ubuntu4.20",
        "2.4.7-1ubuntu4.21",
        "2.4.7-1ubuntu4.22",
        "2.4.7-1ubuntu4.22+esm1",
        "2.4.7-1ubuntu4.22+esm2",
        "2.4.7-1ubuntu4.22+esm3",
        "2.4.7-1ubuntu4.22+esm4",
        "2.4.7-1ubuntu4.22+esm5",
        "2.4.7-1ubuntu4.22+esm6",
        "2.4.7-1ubuntu4.22+esm8",
        "2.4.7-1ubuntu4.22+esm9",
        "2.4.7-1ubuntu4.22+esm10"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2024-38473",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-39573",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-58098",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-65082",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-66200",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:16.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "apache2",
            "binary_version": "2.4.18-2ubuntu3.17+esm17"
          },
          {
            "binary_name": "apache2-bin",
            "binary_version": "2.4.18-2ubuntu3.17+esm17"
          },
          {
            "binary_name": "apache2-data",
            "binary_version": "2.4.18-2ubuntu3.17+esm17"
          },
          {
            "binary_name": "apache2-suexec-custom",
            "binary_version": "2.4.18-2ubuntu3.17+esm17"
          },
          {
            "binary_name": "apache2-suexec-pristine",
            "binary_version": "2.4.18-2ubuntu3.17+esm17"
          },
          {
            "binary_name": "apache2-utils",
            "binary_version": "2.4.18-2ubuntu3.17+esm17"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "apache2",
        "purl": "pkg:deb/ubuntu/apache2@2.4.18-2ubuntu3.17+esm17?arch=source\u0026distro=esm-infra-legacy/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.18-2ubuntu3.17+esm17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.4.12-2ubuntu2",
        "2.4.17-1ubuntu1",
        "2.4.17-2ubuntu1",
        "2.4.17-3ubuntu1",
        "2.4.18-1ubuntu1",
        "2.4.18-2ubuntu1",
        "2.4.18-2ubuntu2",
        "2.4.18-2ubuntu3",
        "2.4.18-2ubuntu3.1",
        "2.4.18-2ubuntu3.2",
        "2.4.18-2ubuntu3.3",
        "2.4.18-2ubuntu3.4",
        "2.4.18-2ubuntu3.5",
        "2.4.18-2ubuntu3.7",
        "2.4.18-2ubuntu3.8",
        "2.4.18-2ubuntu3.9",
        "2.4.18-2ubuntu3.10",
        "2.4.18-2ubuntu3.12",
        "2.4.18-2ubuntu3.13",
        "2.4.18-2ubuntu3.14",
        "2.4.18-2ubuntu3.15",
        "2.4.18-2ubuntu3.17",
        "2.4.18-2ubuntu3.17+esm1",
        "2.4.18-2ubuntu3.17+esm2",
        "2.4.18-2ubuntu3.17+esm3",
        "2.4.18-2ubuntu3.17+esm4",
        "2.4.18-2ubuntu3.17+esm5",
        "2.4.18-2ubuntu3.17+esm6",
        "2.4.18-2ubuntu3.17+esm7",
        "2.4.18-2ubuntu3.17+esm8",
        "2.4.18-2ubuntu3.17+esm9",
        "2.4.18-2ubuntu3.17+esm10",
        "2.4.18-2ubuntu3.17+esm11",
        "2.4.18-2ubuntu3.17+esm12",
        "2.4.18-2ubuntu3.17+esm13",
        "2.4.18-2ubuntu3.17+esm14",
        "2.4.18-2ubuntu3.17+esm16"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2023-45802",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-38473",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2024-39573",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-58098",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-65082",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-66200",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:18.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "apache2",
            "binary_version": "2.4.29-1ubuntu4.27+esm7"
          },
          {
            "binary_name": "apache2-bin",
            "binary_version": "2.4.29-1ubuntu4.27+esm7"
          },
          {
            "binary_name": "apache2-data",
            "binary_version": "2.4.29-1ubuntu4.27+esm7"
          },
          {
            "binary_name": "apache2-suexec-custom",
            "binary_version": "2.4.29-1ubuntu4.27+esm7"
          },
          {
            "binary_name": "apache2-suexec-pristine",
            "binary_version": "2.4.29-1ubuntu4.27+esm7"
          },
          {
            "binary_name": "apache2-utils",
            "binary_version": "2.4.29-1ubuntu4.27+esm7"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "apache2",
        "purl": "pkg:deb/ubuntu/apache2@2.4.29-1ubuntu4.27+esm7?arch=source\u0026distro=esm-infra/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.29-1ubuntu4.27+esm7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.4.27-2ubuntu3",
        "2.4.29-1ubuntu1",
        "2.4.29-1ubuntu2",
        "2.4.29-1ubuntu3",
        "2.4.29-1ubuntu4",
        "2.4.29-1ubuntu4.1",
        "2.4.29-1ubuntu4.2",
        "2.4.29-1ubuntu4.3",
        "2.4.29-1ubuntu4.4",
        "2.4.29-1ubuntu4.5",
        "2.4.29-1ubuntu4.6",
        "2.4.29-1ubuntu4.7",
        "2.4.29-1ubuntu4.8",
        "2.4.29-1ubuntu4.10",
        "2.4.29-1ubuntu4.11",
        "2.4.29-1ubuntu4.12",
        "2.4.29-1ubuntu4.13",
        "2.4.29-1ubuntu4.14",
        "2.4.29-1ubuntu4.16",
        "2.4.29-1ubuntu4.17",
        "2.4.29-1ubuntu4.18",
        "2.4.29-1ubuntu4.19",
        "2.4.29-1ubuntu4.20",
        "2.4.29-1ubuntu4.21",
        "2.4.29-1ubuntu4.22",
        "2.4.29-1ubuntu4.23",
        "2.4.29-1ubuntu4.24",
        "2.4.29-1ubuntu4.25",
        "2.4.29-1ubuntu4.26",
        "2.4.29-1ubuntu4.27",
        "2.4.29-1ubuntu4.27+esm1",
        "2.4.29-1ubuntu4.27+esm2",
        "2.4.29-1ubuntu4.27+esm3",
        "2.4.29-1ubuntu4.27+esm4",
        "2.4.29-1ubuntu4.27+esm6"
      ]
    },
    {
      "database_specific": {
        "cves_map": {
          "cves": [
            {
              "id": "CVE-2025-55753",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-58098",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-65082",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
                  "type": "CVSS_V3"
                },
                {
                  "score": "low",
                  "type": "Ubuntu"
                }
              ]
            },
            {
              "id": "CVE-2025-66200",
              "severity": [
                {
                  "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
                  "type": "CVSS_V3"
                },
                {
                  "score": "medium",
                  "type": "Ubuntu"
                }
              ]
            }
          ],
          "ecosystem": "Ubuntu:Pro:20.04:LTS"
        }
      },
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "apache2",
            "binary_version": "2.4.41-4ubuntu3.23+esm3"
          },
          {
            "binary_name": "apache2-bin",
            "binary_version": "2.4.41-4ubuntu3.23+esm3"
          },
          {
            "binary_name": "apache2-data",
            "binary_version": "2.4.41-4ubuntu3.23+esm3"
          },
          {
            "binary_name": "apache2-suexec-custom",
            "binary_version": "2.4.41-4ubuntu3.23+esm3"
          },
          {
            "binary_name": "apache2-suexec-pristine",
            "binary_version": "2.4.41-4ubuntu3.23+esm3"
          },
          {
            "binary_name": "apache2-utils",
            "binary_version": "2.4.41-4ubuntu3.23+esm3"
          },
          {
            "binary_name": "libapache2-mod-md",
            "binary_version": "2.4.41-4ubuntu3.23+esm3"
          },
          {
            "binary_name": "libapache2-mod-proxy-uwsgi",
            "binary_version": "2.4.41-4ubuntu3.23+esm3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "apache2",
        "purl": "pkg:deb/ubuntu/apache2@2.4.41-4ubuntu3.23+esm3?arch=source\u0026distro=esm-infra/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.4.41-4ubuntu3.23+esm3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.4.41-1ubuntu1",
        "2.4.41-4ubuntu1",
        "2.4.41-4ubuntu2",
        "2.4.41-4ubuntu3",
        "2.4.41-4ubuntu3.1",
        "2.4.41-4ubuntu3.3",
        "2.4.41-4ubuntu3.4",
        "2.4.41-4ubuntu3.5",
        "2.4.41-4ubuntu3.6",
        "2.4.41-4ubuntu3.7",
        "2.4.41-4ubuntu3.8",
        "2.4.41-4ubuntu3.9",
        "2.4.41-4ubuntu3.10",
        "2.4.41-4ubuntu3.11",
        "2.4.41-4ubuntu3.12",
        "2.4.41-4ubuntu3.13",
        "2.4.41-4ubuntu3.14",
        "2.4.41-4ubuntu3.15",
        "2.4.41-4ubuntu3.16",
        "2.4.41-4ubuntu3.17",
        "2.4.41-4ubuntu3.19",
        "2.4.41-4ubuntu3.20",
        "2.4.41-4ubuntu3.21",
        "2.4.41-4ubuntu3.23",
        "2.4.41-4ubuntu3.23+esm2"
      ]
    }
  ],
  "aliases": [],
  "details": "It was discovered that Apache HTTP Server incorrectly handled certain\nresponse headers. An attacker could possibly use this issue to perform\nHTTP response splitting attacks. This issue only affected Ubuntu 14.04\nLTS. (CVE-2023-38709)\n\nWill Dormann and David Warren discovered that Apache HTTP Server\u0027s HTTP/2\nimplementation did not properly reclaim memory when streams were reset by\nclients. A remote attacker could possibly use this issue to cause Apache\nHTTP Server to consume resources, leading to a denial of service. This\nissue only affected Ubuntu 18.04 LTS. (CVE-2023-45802)\n\nKeran Mu and Jianjun Chen discovered that Apache HTTP Server incorrectly\nhandled certain response headers. An attacker could possibly use this issue\nto perform HTTP response splitting attacks. This issue only affected Ubuntu\n14.04 LTS. (CVE-2024-24795)\n\nOrange Tsai discovered that Apache HTTP Server mod_proxy incorrectly\nhandled URL encoding. A remote attacker could possibly use this issue to\nbypass authentication via crafted requests. This issue only affected\nUbuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2024-38473)\n\nOrange Tsai discovered that Apache HTTP Server could be caused to perform\nserver-side request forgery (SSRF) via malicious backend response headers.\nA remote attacker could possibly use this issue to conduct SSRF attacks or\ndisclose sensitive information. This issue only affected Ubuntu 14.04 LTS.\n(CVE-2024-38476)\n\nOrange Tsai discovered that Apache HTTP Server mod_proxy did not properly\nhandle certain null pointer conditions. A remote attacker could possibly use this\nissue to cause Apache HTTP Server to crash, resulting in a denial of\nservice. This issue only affected Ubuntu 14.04 LTS. (CVE-2024-38477)\n\nOrange Tsai discovered that Apache HTTP Server mod_rewrite could be made\nto perform server-side request forgery (SSRF) via unsafe RewriteRules. A\nremote attacker could possibly use this issue to conduct SSRF attacks. This\nissue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2024-39573)\n\nIt was discovered that Apache HTTP Server incorrectly handled certain\nresponse headers. An attacker could possibly use this issue to perform\nHTTP response splitting attacks. This issue only affected Ubuntu 14.04 LTS.\n(CVE-2024-42516)\n\nIt was discovered that Apache HTTP Server could be caused to perform\nserver-side request forgery (SSRF) via mod_headers modifying Content-Type\nheaders. A remote attacker could possibly use this issue to conduct SSRF\nattacks. This issue only affected Ubuntu 14.04 LTS. (CVE-2024-43204)\n\nJohn Runyon discovered that Apache HTTP Server mod_ssl did not properly\nescape user-supplied data before writing log entries. A remote attacker\ncould possibly use this issue to insert escape sequences into log files.\nThis issue only affected Ubuntu 14.04 LTS. (CVE-2024-47252)\n\nRobert Merget discovered that Apache HTTP Server with SSLEngine optional was\nvulnerable to HTTP desynchronisation attacks. An attacker in a privileged\nnetwork position could possibly use this issue to hijack HTTP sessions. This issue\nonly affected Ubuntu 14.04 LTS. (CVE-2025-49812)\n\nIt was discovered that Apache HTTP Server mod_md had an integer overflow in\nthe ACME certificate renewal backoff timer. An attacker could possibly use\nthis issue to cause excessive certificate renewal requests. This issue only\naffected Ubuntu 20.04 LTS. (CVE-2025-55753)\n\nAnthony Parfenov discovered that Apache HTTP Server with SSI enabled and\nmod_cgid passed shell-escaped query strings to #exec cmd directives. A\nremote attacker could possibly use this issue to perform command injection.\n(CVE-2025-58098)\n\nMattias \u00c5sander discovered that Apache HTTP Server incorrectly gave\nprecedence to environment variables from HTTP headers over server-calculated\nCGI variables. A remote attacker could possibly use this issue to influence\nthe environment of CGI programs. (CVE-2025-65082)\n\nMattias \u00c5sander discovered that Apache HTTP Server mod_userdir with suexec\ncould be caused to run CGI scripts under an unexpected user ID via\nRequestHeader directives in .htaccess files. An attacker with .htaccess\nwrite access could possibly use this issue to bypass suexec user restrictions.\n(CVE-2025-66200)",
  "id": "USN-8338-1",
  "modified": "2026-05-28T14:51:58Z",
  "published": "2026-05-28T14:51:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8338-1"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-38709"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2023-45802"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-24795"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-38473"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-38476"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-38477"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-39573"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-42516"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-43204"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-47252"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-49812"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-55753"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-58098"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-65082"
    },
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-66200"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "summary": "apache2 vulnerabilities",
  "upstream": [
    "UBUNTU-CVE-2023-38709",
    "UBUNTU-CVE-2023-45802",
    "UBUNTU-CVE-2024-24795",
    "UBUNTU-CVE-2024-38473",
    "UBUNTU-CVE-2024-38476",
    "UBUNTU-CVE-2024-38477",
    "UBUNTU-CVE-2024-39573",
    "UBUNTU-CVE-2024-42516",
    "UBUNTU-CVE-2024-43204",
    "UBUNTU-CVE-2024-47252",
    "UBUNTU-CVE-2025-49812",
    "UBUNTU-CVE-2025-55753",
    "UBUNTU-CVE-2025-58098",
    "UBUNTU-CVE-2025-65082",
    "UBUNTU-CVE-2025-66200"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

ubuntu-cve-2024-38473

Vulnerability from osv_ubuntu

CVE-2024-38473 (GCVE-0-2024-38473)

usn-6885-1

Vulnerability from osv_ubuntu

usn-8338-1

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature