Patchwire CVEs, their patch status, and feeds to follow them

CVE-2024-38473

Fixed in a distro release EPSS 26%CVSS 8.1

Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests. Users are recommended to upgrade to version 2.4.60, which fixes this issue.

Published 2024-07-01 · CVE record · OSV

Products: Apache Software Foundation Apache HTTP Server

Distro releases

ReleasePackageFixed in
AlmaLinux 8httpd2.4.37-65.module_el8.10.0+3872+9b8ab21e.1
AlmaLinux 8httpd-devel2.4.37-65.module_el8.10.0+3872+9b8ab21e.1
AlmaLinux 8httpd-filesystem2.4.37-65.module_el8.10.0+3872+9b8ab21e.1
AlmaLinux 8httpd-manual2.4.37-65.module_el8.10.0+3872+9b8ab21e.1
AlmaLinux 8httpd-tools2.4.37-65.module_el8.10.0+3872+9b8ab21e.1
AlmaLinux 8mod_http21.15.7-10.module_el8.10.0+3832+564e7653
AlmaLinux 8mod_ldap2.4.37-65.module_el8.10.0+3872+9b8ab21e.1
AlmaLinux 8mod_md1:2.0.8-8.module_el8.6.0+3031+fb177b09
AlmaLinux 8mod_md1:2.0.8-8.module_el8.6.0+2872+fe0ff7aa
AlmaLinux 8mod_proxy_html1:2.4.37-65.module_el8.10.0+3872+9b8ab21e.1
AlmaLinux 8mod_session2.4.37-65.module_el8.10.0+3872+9b8ab21e.1
AlmaLinux 8mod_ssl1:2.4.37-65.module_el8.10.0+3872+9b8ab21e.1
AlmaLinux 9httpd2.4.57-11.el9_4
AlmaLinux 9httpd-core2.4.57-11.el9_4
AlmaLinux 9httpd-devel2.4.57-11.el9_4
AlmaLinux 9httpd-filesystem2.4.57-11.el9_4
AlmaLinux 9httpd-manual2.4.57-11.el9_4
AlmaLinux 9httpd-tools2.4.57-11.el9_4
AlmaLinux 9mod_ldap2.4.57-11.el9_4
AlmaLinux 9mod_lua2.4.57-11.el9_4
AlmaLinux 9mod_proxy_html1:2.4.57-11.el9_4
AlmaLinux 9mod_session2.4.57-11.el9_4
AlmaLinux 9mod_ssl1:2.4.57-11.el9_4
Alpine 3.17apache22.4.60-r0
Alpine 3.18apache22.4.60-r0
Alpine 3.19apache22.4.60-r0
Alpine 3.20apache22.4.60-r0
Alpine 3.21apache22.4.60-r0
Alpine 3.22apache22.4.60-r0
Alpine 3.23apache22.4.60-r0
Alpine 3.24apache22.4.60-r0
Debian 11apache22.4.61-1~deb11u1
Debian 12apache22.4.61-1~deb12u1
Debian 13apache22.4.60-1
Debian 14apache22.4.60-1
Red Hat Enterprise Linux 8httpd0:2.4.37-65.module+el8.10.0+22069+b47f5c72.1
Red Hat Enterprise Linux 8httpd-debuginfo0:2.4.37-65.module+el8.10.0+22069+b47f5c72.1
Red Hat Enterprise Linux 8httpd-debugsource0:2.4.37-65.module+el8.10.0+22069+b47f5c72.1
Red Hat Enterprise Linux 8httpd-devel0:2.4.37-65.module+el8.10.0+22069+b47f5c72.1
Red Hat Enterprise Linux 8httpd-filesystem0:2.4.37-65.module+el8.10.0+22069+b47f5c72.1
Red Hat Enterprise Linux 8httpd-manual0:2.4.37-65.module+el8.10.0+22069+b47f5c72.1
Red Hat Enterprise Linux 8httpd-tools0:2.4.37-65.module+el8.10.0+22069+b47f5c72.1
Red Hat Enterprise Linux 8httpd-tools-debuginfo0:2.4.37-65.module+el8.10.0+22069+b47f5c72.1
Red Hat Enterprise Linux 8mod_http20:1.15.7-10.module+el8.10.0+21653+eaff63f0
Red Hat Enterprise Linux 8mod_http2-debuginfo0:1.15.7-10.module+el8.10.0+21653+eaff63f0
Red Hat Enterprise Linux 8mod_http2-debugsource0:1.15.7-10.module+el8.10.0+21653+eaff63f0
Red Hat Enterprise Linux 8mod_ldap0:2.4.37-65.module+el8.10.0+22069+b47f5c72.1
Red Hat Enterprise Linux 8mod_ldap-debuginfo0:2.4.37-65.module+el8.10.0+22069+b47f5c72.1
Red Hat Enterprise Linux 8mod_md1:2.0.8-8.module+el8.9.0+19080+567b90f8
Red Hat Enterprise Linux 8mod_md-debuginfo1:2.0.8-8.module+el8.9.0+19080+567b90f8
Red Hat Enterprise Linux 8mod_md-debugsource1:2.0.8-8.module+el8.9.0+19080+567b90f8
Red Hat Enterprise Linux 8mod_proxy_html1:2.4.37-65.module+el8.10.0+22069+b47f5c72.1
Red Hat Enterprise Linux 8mod_proxy_html-debuginfo1:2.4.37-65.module+el8.10.0+22069+b47f5c72.1
Red Hat Enterprise Linux 8mod_session0:2.4.37-65.module+el8.10.0+22069+b47f5c72.1
Red Hat Enterprise Linux 8mod_session-debuginfo0:2.4.37-65.module+el8.10.0+22069+b47f5c72.1
Red Hat Enterprise Linux 8mod_ssl1:2.4.37-65.module+el8.10.0+22069+b47f5c72.1
Red Hat Enterprise Linux 8mod_ssl-debuginfo1:2.4.37-65.module+el8.10.0+22069+b47f5c72.1
Red Hat Enterprise Linux 9httpd0:2.4.57-11.el9_4
Red Hat Enterprise Linux 9httpd-core0:2.4.57-11.el9_4
Red Hat Enterprise Linux 9httpd-core-debuginfo0:2.4.57-11.el9_4
Red Hat Enterprise Linux 9httpd-debuginfo0:2.4.57-11.el9_4
Red Hat Enterprise Linux 9httpd-debugsource0:2.4.57-11.el9_4
Red Hat Enterprise Linux 9httpd-devel0:2.4.57-11.el9_4
Red Hat Enterprise Linux 9httpd-filesystem0:2.4.57-11.el9_4
Red Hat Enterprise Linux 9httpd-manual0:2.4.57-11.el9_4
Red Hat Enterprise Linux 9httpd-tools0:2.4.57-11.el9_4
Red Hat Enterprise Linux 9httpd-tools-debuginfo0:2.4.57-11.el9_4
Red Hat Enterprise Linux 9mod_ldap0:2.4.57-11.el9_4
Red Hat Enterprise Linux 9mod_ldap-debuginfo0:2.4.57-11.el9_4
Red Hat Enterprise Linux 9mod_lua0:2.4.57-11.el9_4
Red Hat Enterprise Linux 9mod_lua-debuginfo0:2.4.57-11.el9_4
Red Hat Enterprise Linux 9mod_proxy_html1:2.4.57-11.el9_4
Red Hat Enterprise Linux 9mod_proxy_html-debuginfo1:2.4.57-11.el9_4
Red Hat Enterprise Linux 9mod_session0:2.4.57-11.el9_4
Red Hat Enterprise Linux 9mod_session-debuginfo0:2.4.57-11.el9_4
Red Hat Enterprise Linux 9mod_ssl1:2.4.57-11.el9_4
Red Hat Enterprise Linux 9mod_ssl-debuginfo1:2.4.57-11.el9_4
Red Hat jboss core services 1jbcs-httpd24-httpd0:2.4.57-13.el8jbcs
Red Hat jboss core services 1jbcs-httpd24-httpd0:2.4.57-13.el7jbcs
Red Hat jboss core services 1jbcs-httpd24-httpd-debuginfo0:2.4.57-13.el8jbcs
Red Hat jboss core services 1jbcs-httpd24-httpd-debuginfo0:2.4.57-13.el7jbcs
Red Hat jboss core services 1jbcs-httpd24-httpd-devel0:2.4.57-13.el7jbcs
Red Hat jboss core services 1jbcs-httpd24-httpd-devel0:2.4.57-13.el8jbcs
Red Hat jboss core services 1jbcs-httpd24-httpd-manual0:2.4.57-13.el7jbcs
Red Hat jboss core services 1jbcs-httpd24-httpd-manual0:2.4.57-13.el8jbcs
Red Hat jboss core services 1jbcs-httpd24-httpd-selinux0:2.4.57-13.el7jbcs
Red Hat jboss core services 1jbcs-httpd24-httpd-selinux0:2.4.57-13.el8jbcs
Red Hat jboss core services 1jbcs-httpd24-httpd-tools0:2.4.57-13.el8jbcs
Red Hat jboss core services 1jbcs-httpd24-httpd-tools0:2.4.57-13.el7jbcs
Red Hat jboss core services 1jbcs-httpd24-httpd-tools-debuginfo0:2.4.57-13.el8jbcs
Red Hat jboss core services 1jbcs-httpd24-mod_http20:1.15.19-41.el8jbcs
Red Hat jboss core services 1jbcs-httpd24-mod_http20:1.15.19-41.el7jbcs
Red Hat jboss core services 1jbcs-httpd24-mod_http2-debuginfo0:1.15.19-41.el8jbcs
Red Hat jboss core services 1jbcs-httpd24-mod_http2-debuginfo0:1.15.19-41.el7jbcs
Red Hat jboss core services 1jbcs-httpd24-mod_jk0:1.2.49-11.redhat_1.el8jbcs
Red Hat jboss core services 1jbcs-httpd24-mod_jk0:1.2.49-11.redhat_1.el7jbcs
Red Hat jboss core services 1jbcs-httpd24-mod_jk-ap240:1.2.49-11.redhat_1.el8jbcs
Red Hat jboss core services 1jbcs-httpd24-mod_jk-ap240:1.2.49-11.redhat_1.el7jbcs
Red Hat jboss core services 1jbcs-httpd24-mod_jk-ap24-debuginfo0:1.2.49-11.redhat_1.el8jbcs
Red Hat jboss core services 1jbcs-httpd24-mod_jk-debuginfo0:1.2.49-11.redhat_1.el7jbcs
Red Hat jboss core services 1jbcs-httpd24-mod_ldap0:2.4.57-13.el8jbcs
Red Hat jboss core services 1jbcs-httpd24-mod_ldap0:2.4.57-13.el7jbcs
Red Hat jboss core services 1jbcs-httpd24-mod_ldap-debuginfo0:2.4.57-13.el8jbcs
Red Hat jboss core services 1jbcs-httpd24-mod_md1:2.4.24-11.el7jbcs
Red Hat jboss core services 1jbcs-httpd24-mod_md1:2.4.24-11.el8jbcs
Red Hat jboss core services 1jbcs-httpd24-mod_md-debuginfo1:2.4.24-11.el8jbcs
Red Hat jboss core services 1jbcs-httpd24-mod_md-debuginfo1:2.4.24-11.el7jbcs
Red Hat jboss core services 1jbcs-httpd24-mod_proxy_cluster0:1.3.20-8.el7jbcs
Red Hat jboss core services 1jbcs-httpd24-mod_proxy_cluster0:1.3.20-8.el8jbcs
Red Hat jboss core services 1jbcs-httpd24-mod_proxy_cluster-debuginfo0:1.3.20-8.el8jbcs
Red Hat jboss core services 1jbcs-httpd24-mod_proxy_cluster-debuginfo0:1.3.20-8.el7jbcs
Red Hat jboss core services 1jbcs-httpd24-mod_proxy_html1:2.4.57-13.el7jbcs
Red Hat jboss core services 1jbcs-httpd24-mod_proxy_html1:2.4.57-13.el8jbcs
Red Hat jboss core services 1jbcs-httpd24-mod_proxy_html-debuginfo1:2.4.57-13.el8jbcs
Red Hat jboss core services 1jbcs-httpd24-mod_security0:2.9.3-40.el7jbcs
Red Hat jboss core services 1jbcs-httpd24-mod_security0:2.9.3-40.el8jbcs
Red Hat jboss core services 1jbcs-httpd24-mod_security-debuginfo0:2.9.3-40.el8jbcs
Red Hat jboss core services 1jbcs-httpd24-mod_security-debuginfo0:2.9.3-40.el7jbcs
Red Hat jboss core services 1jbcs-httpd24-mod_session0:2.4.57-13.el7jbcs
Red Hat jboss core services 1jbcs-httpd24-mod_session0:2.4.57-13.el8jbcs
Red Hat jboss core services 1jbcs-httpd24-mod_session-debuginfo0:2.4.57-13.el8jbcs
Red Hat jboss core services 1jbcs-httpd24-mod_ssl1:2.4.57-13.el7jbcs
Red Hat jboss core services 1jbcs-httpd24-mod_ssl1:2.4.57-13.el8jbcs
Red Hat jboss core services 1jbcs-httpd24-mod_ssl-debuginfo1:2.4.57-13.el8jbcs
Red Hat rhel eus 9.2httpd0:2.4.53-11.el9_2.10
Red Hat rhel eus 9.2httpd-core0:2.4.53-11.el9_2.10
Red Hat rhel eus 9.2httpd-core-debuginfo0:2.4.53-11.el9_2.10
Red Hat rhel eus 9.2httpd-debuginfo0:2.4.53-11.el9_2.10
Red Hat rhel eus 9.2httpd-debugsource0:2.4.53-11.el9_2.10
Red Hat rhel eus 9.2httpd-devel0:2.4.53-11.el9_2.10
Red Hat rhel eus 9.2httpd-filesystem0:2.4.53-11.el9_2.10
Red Hat rhel eus 9.2httpd-manual0:2.4.53-11.el9_2.10
Red Hat rhel eus 9.2httpd-tools0:2.4.53-11.el9_2.10
Red Hat rhel eus 9.2httpd-tools-debuginfo0:2.4.53-11.el9_2.10
Red Hat rhel eus 9.2mod_ldap0:2.4.53-11.el9_2.10
Red Hat rhel eus 9.2mod_ldap-debuginfo0:2.4.53-11.el9_2.10
Red Hat rhel eus 9.2mod_lua0:2.4.53-11.el9_2.10
Red Hat rhel eus 9.2mod_lua-debuginfo0:2.4.53-11.el9_2.10
Red Hat rhel eus 9.2mod_proxy_html1:2.4.53-11.el9_2.10
Red Hat rhel eus 9.2mod_proxy_html-debuginfo1:2.4.53-11.el9_2.10
Red Hat rhel eus 9.2mod_session0:2.4.53-11.el9_2.10
Red Hat rhel eus 9.2mod_session-debuginfo0:2.4.53-11.el9_2.10
Red Hat rhel eus 9.2mod_ssl1:2.4.53-11.el9_2.10
Red Hat rhel eus 9.2mod_ssl-debuginfo1:2.4.53-11.el9_2.10
Rocky Linux 8httpd0:2.4.37-65.module+el8.10.0+1938+3b7755d4.3
Rocky Linux 8httpd0:2.4.37-65.module+el8.10.0+1830+22f0c9e0
Rocky Linux 8httpd0:2.4.37-65.module+el8.10.0+1840+b070a976.1
Rocky Linux 8httpd0:2.4.37-65.module+el8.10.0+1842+4a9649e8.2
Rocky Linux 8mod_http20:1.15.7-10.module+el8.10.0+1938+3b7755d4.3
Rocky Linux 8mod_http20:1.15.7-10.module+el8.10.0+1883+38ed6c58.1
Rocky Linux 8mod_http20:1.15.7-10.module+el8.10.0+1775+6b057638
Rocky Linux 8mod_http20:1.15.7-10.module+el8.10.0+1830+22f0c9e0
Rocky Linux 8mod_md1:2.0.8-8.module+el8.9.0+1370+89cc8ad5
Rocky Linux 9httpd0:2.4.57-11.el9_4
SUSE Enterprise Storage 7.1apache22.4.51-150200.3.73.1
SUSE Linux Enterprise High Performance Computing 15 SP2-LTSSapache22.4.51-150200.3.73.1
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSSapache22.4.51-150200.3.73.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSapache22.4.66-150400.6.57.1
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSapache22.4.51-150400.6.34.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSSapache22.4.66-150400.6.57.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSSapache22.4.51-150400.6.34.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSapache22.4.66-150400.6.57.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSSapache22.4.66-150400.6.57.1
SUSE Linux Enterprise Module for Basesystem 15 SP5apache22.4.51-150400.6.34.1
SUSE Linux Enterprise Module for Basesystem 15 SP6apache22.4.58-150600.5.23.1
SUSE Linux Enterprise Module for Basesystem 15 SP6apache2-prefork2.4.58-150600.5.23.1
SUSE Linux Enterprise Module for Package Hub 15 SP5apache22.4.51-150400.6.34.1
SUSE Linux Enterprise Module for Package Hub 15 SP6apache22.4.58-150600.5.23.1
SUSE Linux Enterprise Module for Package Hub 15 SP6apache2-event2.4.58-150600.5.23.1
SUSE Linux Enterprise Module for Server Applications 15 SP5apache22.4.51-150400.6.34.1
SUSE Linux Enterprise Module for Server Applications 15 SP6apache22.4.51-150400.6.34.1
SUSE Linux Enterprise Module for Server Applications 15 SP6apache2-devel2.4.58-150600.5.23.1
SUSE Linux Enterprise Module for Server Applications 15 SP6apache2-utils2.4.58-150600.5.23.1
SUSE Linux Enterprise Module for Server Applications 15 SP6apache2-worker2.4.58-150600.5.23.1
SUSE Linux Enterprise Server 12 SP5apache22.4.51-35.57.1
SUSE Linux Enterprise Server 12 SP5apache2-tls132.4.51-35.57.2
SUSE Linux Enterprise Server 15 SP2-LTSSapache22.4.51-150200.3.73.1
SUSE Linux Enterprise Server 15 SP3-LTSSapache22.4.51-150200.3.73.1
SUSE Linux Enterprise Server 15 SP4-LTSSapache22.4.51-150400.6.34.1
SUSE Linux Enterprise Server 15 SP4-LTSSapache22.4.66-150400.6.57.1
SUSE Linux Enterprise Server 15 SP5-LTSSapache22.4.66-150400.6.57.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5apache22.4.51-35.57.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5apache2-tls132.4.51-35.57.2
SUSE Linux Enterprise Server for SAP Applications 15 SP2apache22.4.51-150200.3.73.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3apache22.4.51-150200.3.73.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4apache22.4.51-150400.6.34.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4apache22.4.66-150400.6.57.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5apache22.4.66-150400.6.57.1
SUSE Linux Enterprise Software Development Kit 12 SP5apache22.4.51-35.57.1
SUSE Linux Enterprise Software Development Kit 12 SP5apache2-tls132.4.51-35.57.2
SUSE Manager Proxy 4.3apache22.4.51-150400.6.34.1
SUSE Manager Server 4.3apache22.4.51-150400.6.34.1
Ubuntu 20.04 LTSapache22.4.41-4ubuntu3.19
Ubuntu 22.04 LTSapache22.4.52-1ubuntu4.10
Ubuntu 24.04 LTSapache22.4.58-1ubuntu8.2
Ubuntu Pro 14.04 LTSapache22.4.7-1ubuntu4.22+esm12
Ubuntu Pro 16.04 LTSapache22.4.18-2ubuntu3.17+esm17
Ubuntu Pro 18.04 LTSapache22.4.29-1ubuntu4.27+esm7
Ubuntu Pro 20.04 LTSapache22.4.41-4ubuntu3.23+esm3
openSUSE Leap 15.5apache22.4.51-150400.6.34.1
openSUSE Leap 15.6apache22.4.58-150600.5.23.1
openSUSE Leap 15.6apache2-devel2.4.58-150600.5.23.1
openSUSE Leap 15.6apache2-event2.4.58-150600.5.23.1
openSUSE Leap 15.6apache2-manual2.4.58-150600.5.23.1
openSUSE Leap 15.6apache2-prefork2.4.58-150600.5.23.1
openSUSE Leap 15.6apache2-utils2.4.58-150600.5.23.1
openSUSE Leap 15.6apache2-worker2.4.58-150600.5.23.1
openSUSE Tumbleweedapache22.4.61-1.1