CVE-2024-38475

NameCVE-2024-38475
DescriptionImproper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected.  Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-5729-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
apache2 (PTS)bullseye2.4.62-1~deb11u1fixed
bullseye (security)2.4.62-1~deb11u2fixed
bookworm, bookworm (security)2.4.62-1~deb12u2fixed
trixie, sid2.4.62-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
apache2sourcebullseye2.4.61-1~deb11u1DSA-5729-1
apache2sourcebookworm2.4.61-1~deb12u1DSA-5729-1
apache2source(unstable)2.4.60-1

Notes

https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2024-38475
same fix as CVE-2024-28474
Fixed [1/2] https://github.com/apache/httpd/commit/1feb5e04a4f7b5f3f13cd40f9635144319dcf24a
need also log fix [2/2] https://github.com/apache/httpd/commit/4797330ad813d9f8a2bb1b3b8d03ceb523dc4884
regression: bug https://bz.apache.org/bugzilla/show_bug.cgi?id=69197
regression: tracked at https://bugs.debian.org/1079172
regression: Fixed by: https://github.com/apache/httpd/commit/a1a93beb58b81f1de2b713ae5f96c41ed5952a74 (trunk)
regression: Fixed by: https://github.com/apache/httpd/commit/a0a68b99d131741c1867cff321424892838fc4b3 (2.4.x)
(or https://svn.apache.org/viewvc?view=revision&revision=1918561)

Search for package or bug name: Reporting problems