264 lines
26 KiB
XML
264 lines
26 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
||
<cvrfdoc xmlns="http://www.icasi.org/CVRF/schema/cvrf/1.1" xmlns:cvrf="http://www.icasi.org/CVRF/schema/cvrf/1.1">
|
||
<DocumentTitle xml:lang="en">An update for httpd is now available for openEuler-22.03-LTS-SP4,openEuler-22.03-LTS-SP1,openEuler-20.03-LTS-SP4,openEuler-24.03-LTS,openEuler-22.03-LTS-SP3</DocumentTitle>
|
||
<DocumentType>Security Advisory</DocumentType>
|
||
<DocumentPublisher Type="Vendor">
|
||
<ContactDetails>openeuler-security@openeuler.org</ContactDetails>
|
||
<IssuingAuthority>openEuler security committee</IssuingAuthority>
|
||
</DocumentPublisher>
|
||
<DocumentTracking>
|
||
<Identification>
|
||
<ID>openEuler-SA-2024-1830</ID>
|
||
</Identification>
|
||
<Status>Final</Status>
|
||
<Version>1.0</Version>
|
||
<RevisionHistory>
|
||
<Revision>
|
||
<Number>1.0</Number>
|
||
<Date>2024-07-12</Date>
|
||
<Description>Initial</Description>
|
||
</Revision>
|
||
</RevisionHistory>
|
||
<InitialReleaseDate>2024-07-12</InitialReleaseDate>
|
||
<CurrentReleaseDate>2024-07-12</CurrentReleaseDate>
|
||
<Generator>
|
||
<Engine>openEuler SA Tool V1.0</Engine>
|
||
<Date>2024-07-12</Date>
|
||
</Generator>
|
||
</DocumentTracking>
|
||
<DocumentNotes>
|
||
<Note Title="Synopsis" Type="General" Ordinal="1" xml:lang="en">httpd security update</Note>
|
||
<Note Title="Summary" Type="General" Ordinal="2" xml:lang="en">An update for httpd is now available for openEuler-22.03-LTS-SP4,openEuler-22.03-LTS-SP1,openEuler-20.03-LTS-SP4,openEuler-24.03-LTS,openEuler-22.03-LTS-SP3</Note>
|
||
<Note Title="Description" Type="General" Ordinal="3" xml:lang="en">Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server.
|
||
|
||
Security Fix(es):
|
||
|
||
Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure.
|
||
|
||
Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.(CVE-2024-38475)
|
||
|
||
Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to cause unsafe RewriteRules to unexpectedly setup URL's to be handled by mod_proxy.
|
||
Users are recommended to upgrade to version 2.4.60, which fixes this issue.(CVE-2024-39573)</Note>
|
||
<Note Title="Topic" Type="General" Ordinal="4" xml:lang="en">An update for httpd is now available for openEuler-22.03-LTS-SP4.
|
||
|
||
openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.</Note>
|
||
<Note Title="Severity" Type="General" Ordinal="5" xml:lang="en">Critical</Note>
|
||
<Note Title="Affected Component" Type="General" Ordinal="6" xml:lang="en">httpd</Note>
|
||
</DocumentNotes>
|
||
<DocumentReferences>
|
||
<Reference Type="Self">
|
||
<URL>https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1830</URL>
|
||
</Reference>
|
||
<Reference Type="openEuler CVE">
|
||
<URL>https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-38475</URL>
|
||
<URL>https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-39573</URL>
|
||
</Reference>
|
||
<Reference Type="Other">
|
||
<URL>https://nvd.nist.gov/vuln/detail/CVE-2024-38475</URL>
|
||
<URL>https://nvd.nist.gov/vuln/detail/CVE-2024-39573</URL>
|
||
</Reference>
|
||
</DocumentReferences>
|
||
<ProductTree xmlns="http://www.icasi.org/CVRF/schema/prod/1.1">
|
||
<Branch Type="Product Name" Name="openEuler">
|
||
<FullProductName ProductID="openEuler-22.03-LTS-SP4" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP4">openEuler-22.03-LTS-SP4</FullProductName>
|
||
<FullProductName ProductID="openEuler-22.03-LTS-SP1" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">openEuler-22.03-LTS-SP1</FullProductName>
|
||
<FullProductName ProductID="openEuler-20.03-LTS-SP4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP4">openEuler-20.03-LTS-SP4</FullProductName>
|
||
<FullProductName ProductID="openEuler-24.03-LTS" CPE="cpe:/a:openEuler:openEuler:24.03-LTS">openEuler-24.03-LTS</FullProductName>
|
||
<FullProductName ProductID="openEuler-22.03-LTS-SP3" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">openEuler-22.03-LTS-SP3</FullProductName>
|
||
</Branch>
|
||
<Branch Type="Package Arch" Name="aarch64">
|
||
<FullProductName ProductID="httpd-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP4">httpd-2.4.51-22.oe2203sp4.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-debuginfo-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP4">httpd-debuginfo-2.4.51-22.oe2203sp4.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-debugsource-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP4">httpd-debugsource-2.4.51-22.oe2203sp4.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-devel-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP4">httpd-devel-2.4.51-22.oe2203sp4.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-tools-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP4">httpd-tools-2.4.51-22.oe2203sp4.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_ldap-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP4">mod_ldap-2.4.51-22.oe2203sp4.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_md-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP4">mod_md-2.4.51-22.oe2203sp4.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_proxy_html-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP4">mod_proxy_html-2.4.51-22.oe2203sp4.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_session-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP4">mod_session-2.4.51-22.oe2203sp4.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_ssl-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP4">mod_ssl-2.4.51-22.oe2203sp4.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">httpd-2.4.51-22.oe2203sp1.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-debuginfo-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">httpd-debuginfo-2.4.51-22.oe2203sp1.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-debugsource-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">httpd-debugsource-2.4.51-22.oe2203sp1.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-devel-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">httpd-devel-2.4.51-22.oe2203sp1.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-tools-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">httpd-tools-2.4.51-22.oe2203sp1.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_ldap-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">mod_ldap-2.4.51-22.oe2203sp1.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_md-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">mod_md-2.4.51-22.oe2203sp1.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_proxy_html-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">mod_proxy_html-2.4.51-22.oe2203sp1.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_session-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">mod_session-2.4.51-22.oe2203sp1.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_ssl-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">mod_ssl-2.4.51-22.oe2203sp1.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-2.4.43-25" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP4">httpd-2.4.43-25.oe2003sp4.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-debuginfo-2.4.43-25" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP4">httpd-debuginfo-2.4.43-25.oe2003sp4.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-debugsource-2.4.43-25" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP4">httpd-debugsource-2.4.43-25.oe2003sp4.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-devel-2.4.43-25" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP4">httpd-devel-2.4.43-25.oe2003sp4.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-tools-2.4.43-25" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP4">httpd-tools-2.4.43-25.oe2003sp4.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_ldap-2.4.43-25" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP4">mod_ldap-2.4.43-25.oe2003sp4.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_md-2.4.43-25" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP4">mod_md-2.4.43-25.oe2003sp4.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_proxy_html-2.4.43-25" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP4">mod_proxy_html-2.4.43-25.oe2003sp4.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_session-2.4.43-25" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP4">mod_session-2.4.43-25.oe2003sp4.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_ssl-2.4.43-25" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP4">mod_ssl-2.4.43-25.oe2003sp4.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-2.4.58-6" CPE="cpe:/a:openEuler:openEuler:24.03-LTS">httpd-2.4.58-6.oe2403.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-debuginfo-2.4.58-6" CPE="cpe:/a:openEuler:openEuler:24.03-LTS">httpd-debuginfo-2.4.58-6.oe2403.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-debugsource-2.4.58-6" CPE="cpe:/a:openEuler:openEuler:24.03-LTS">httpd-debugsource-2.4.58-6.oe2403.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-devel-2.4.58-6" CPE="cpe:/a:openEuler:openEuler:24.03-LTS">httpd-devel-2.4.58-6.oe2403.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-tools-2.4.58-6" CPE="cpe:/a:openEuler:openEuler:24.03-LTS">httpd-tools-2.4.58-6.oe2403.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_ldap-2.4.58-6" CPE="cpe:/a:openEuler:openEuler:24.03-LTS">mod_ldap-2.4.58-6.oe2403.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_md-2.4.58-6" CPE="cpe:/a:openEuler:openEuler:24.03-LTS">mod_md-2.4.58-6.oe2403.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_proxy_html-2.4.58-6" CPE="cpe:/a:openEuler:openEuler:24.03-LTS">mod_proxy_html-2.4.58-6.oe2403.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_session-2.4.58-6" CPE="cpe:/a:openEuler:openEuler:24.03-LTS">mod_session-2.4.58-6.oe2403.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_ssl-2.4.58-6" CPE="cpe:/a:openEuler:openEuler:24.03-LTS">mod_ssl-2.4.58-6.oe2403.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">httpd-2.4.51-22.oe2203sp3.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-debuginfo-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">httpd-debuginfo-2.4.51-22.oe2203sp3.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-debugsource-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">httpd-debugsource-2.4.51-22.oe2203sp3.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-devel-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">httpd-devel-2.4.51-22.oe2203sp3.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-tools-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">httpd-tools-2.4.51-22.oe2203sp3.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_ldap-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">mod_ldap-2.4.51-22.oe2203sp3.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_md-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">mod_md-2.4.51-22.oe2203sp3.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_proxy_html-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">mod_proxy_html-2.4.51-22.oe2203sp3.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_session-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">mod_session-2.4.51-22.oe2203sp3.aarch64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_ssl-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">mod_ssl-2.4.51-22.oe2203sp3.aarch64.rpm</FullProductName>
|
||
</Branch>
|
||
<Branch Type="Package Arch" Name="src">
|
||
<FullProductName ProductID="httpd-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP4">httpd-2.4.51-22.oe2203sp4.src.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">httpd-2.4.51-22.oe2203sp1.src.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-2.4.43-25" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP4">httpd-2.4.43-25.oe2003sp4.src.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-2.4.58-6" CPE="cpe:/a:openEuler:openEuler:24.03-LTS">httpd-2.4.58-6.oe2403.src.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">httpd-2.4.51-22.oe2203sp3.src.rpm</FullProductName>
|
||
</Branch>
|
||
<Branch Type="Package Arch" Name="x86_64">
|
||
<FullProductName ProductID="httpd-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP4">httpd-2.4.51-22.oe2203sp4.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-debuginfo-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP4">httpd-debuginfo-2.4.51-22.oe2203sp4.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-debugsource-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP4">httpd-debugsource-2.4.51-22.oe2203sp4.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-devel-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP4">httpd-devel-2.4.51-22.oe2203sp4.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-tools-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP4">httpd-tools-2.4.51-22.oe2203sp4.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_ldap-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP4">mod_ldap-2.4.51-22.oe2203sp4.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_md-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP4">mod_md-2.4.51-22.oe2203sp4.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_proxy_html-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP4">mod_proxy_html-2.4.51-22.oe2203sp4.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_session-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP4">mod_session-2.4.51-22.oe2203sp4.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_ssl-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP4">mod_ssl-2.4.51-22.oe2203sp4.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">httpd-2.4.51-22.oe2203sp1.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-debuginfo-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">httpd-debuginfo-2.4.51-22.oe2203sp1.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-debugsource-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">httpd-debugsource-2.4.51-22.oe2203sp1.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-devel-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">httpd-devel-2.4.51-22.oe2203sp1.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-tools-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">httpd-tools-2.4.51-22.oe2203sp1.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_ldap-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">mod_ldap-2.4.51-22.oe2203sp1.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_md-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">mod_md-2.4.51-22.oe2203sp1.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_proxy_html-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">mod_proxy_html-2.4.51-22.oe2203sp1.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_session-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">mod_session-2.4.51-22.oe2203sp1.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_ssl-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">mod_ssl-2.4.51-22.oe2203sp1.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-2.4.43-25" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP4">httpd-2.4.43-25.oe2003sp4.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-debuginfo-2.4.43-25" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP4">httpd-debuginfo-2.4.43-25.oe2003sp4.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-debugsource-2.4.43-25" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP4">httpd-debugsource-2.4.43-25.oe2003sp4.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-devel-2.4.43-25" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP4">httpd-devel-2.4.43-25.oe2003sp4.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-tools-2.4.43-25" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP4">httpd-tools-2.4.43-25.oe2003sp4.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_ldap-2.4.43-25" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP4">mod_ldap-2.4.43-25.oe2003sp4.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_md-2.4.43-25" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP4">mod_md-2.4.43-25.oe2003sp4.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_proxy_html-2.4.43-25" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP4">mod_proxy_html-2.4.43-25.oe2003sp4.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_session-2.4.43-25" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP4">mod_session-2.4.43-25.oe2003sp4.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_ssl-2.4.43-25" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP4">mod_ssl-2.4.43-25.oe2003sp4.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-2.4.58-6" CPE="cpe:/a:openEuler:openEuler:24.03-LTS">httpd-2.4.58-6.oe2403.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-debuginfo-2.4.58-6" CPE="cpe:/a:openEuler:openEuler:24.03-LTS">httpd-debuginfo-2.4.58-6.oe2403.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-debugsource-2.4.58-6" CPE="cpe:/a:openEuler:openEuler:24.03-LTS">httpd-debugsource-2.4.58-6.oe2403.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-devel-2.4.58-6" CPE="cpe:/a:openEuler:openEuler:24.03-LTS">httpd-devel-2.4.58-6.oe2403.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-tools-2.4.58-6" CPE="cpe:/a:openEuler:openEuler:24.03-LTS">httpd-tools-2.4.58-6.oe2403.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_ldap-2.4.58-6" CPE="cpe:/a:openEuler:openEuler:24.03-LTS">mod_ldap-2.4.58-6.oe2403.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_md-2.4.58-6" CPE="cpe:/a:openEuler:openEuler:24.03-LTS">mod_md-2.4.58-6.oe2403.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_proxy_html-2.4.58-6" CPE="cpe:/a:openEuler:openEuler:24.03-LTS">mod_proxy_html-2.4.58-6.oe2403.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_session-2.4.58-6" CPE="cpe:/a:openEuler:openEuler:24.03-LTS">mod_session-2.4.58-6.oe2403.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_ssl-2.4.58-6" CPE="cpe:/a:openEuler:openEuler:24.03-LTS">mod_ssl-2.4.58-6.oe2403.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">httpd-2.4.51-22.oe2203sp3.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-debuginfo-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">httpd-debuginfo-2.4.51-22.oe2203sp3.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-debugsource-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">httpd-debugsource-2.4.51-22.oe2203sp3.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-devel-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">httpd-devel-2.4.51-22.oe2203sp3.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-tools-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">httpd-tools-2.4.51-22.oe2203sp3.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_ldap-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">mod_ldap-2.4.51-22.oe2203sp3.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_md-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">mod_md-2.4.51-22.oe2203sp3.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_proxy_html-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">mod_proxy_html-2.4.51-22.oe2203sp3.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_session-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">mod_session-2.4.51-22.oe2203sp3.x86_64.rpm</FullProductName>
|
||
<FullProductName ProductID="mod_ssl-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">mod_ssl-2.4.51-22.oe2203sp3.x86_64.rpm</FullProductName>
|
||
</Branch>
|
||
<Branch Type="Package Arch" Name="noarch">
|
||
<FullProductName ProductID="httpd-filesystem-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP4">httpd-filesystem-2.4.51-22.oe2203sp4.noarch.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-help-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP4">httpd-help-2.4.51-22.oe2203sp4.noarch.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-filesystem-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">httpd-filesystem-2.4.51-22.oe2203sp1.noarch.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-help-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP1">httpd-help-2.4.51-22.oe2203sp1.noarch.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-filesystem-2.4.43-25" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP4">httpd-filesystem-2.4.43-25.oe2003sp4.noarch.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-help-2.4.43-25" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP4">httpd-help-2.4.43-25.oe2003sp4.noarch.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-filesystem-2.4.58-6" CPE="cpe:/a:openEuler:openEuler:24.03-LTS">httpd-filesystem-2.4.58-6.oe2403.noarch.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-help-2.4.58-6" CPE="cpe:/a:openEuler:openEuler:24.03-LTS">httpd-help-2.4.58-6.oe2403.noarch.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-filesystem-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">httpd-filesystem-2.4.51-22.oe2203sp3.noarch.rpm</FullProductName>
|
||
<FullProductName ProductID="httpd-help-2.4.51-22" CPE="cpe:/a:openEuler:openEuler:22.03-LTS-SP3">httpd-help-2.4.51-22.oe2203sp3.noarch.rpm</FullProductName>
|
||
</Branch>
|
||
</ProductTree>
|
||
<Vulnerability Ordinal="1" xmlns="http://www.icasi.org/CVRF/schema/vuln/1.1">
|
||
<Notes>
|
||
<Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure.
|
||
|
||
Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected. Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.</Note>
|
||
</Notes>
|
||
<ReleaseDate>2024-07-12</ReleaseDate>
|
||
<CVE>CVE-2024-38475</CVE>
|
||
<ProductStatuses>
|
||
<Status Type="Fixed">
|
||
<ProductID>openEuler-22.03-LTS-SP4</ProductID>
|
||
<ProductID>openEuler-22.03-LTS-SP1</ProductID>
|
||
<ProductID>openEuler-20.03-LTS-SP4</ProductID>
|
||
<ProductID>openEuler-24.03-LTS</ProductID>
|
||
<ProductID>openEuler-22.03-LTS-SP3</ProductID>
|
||
</Status>
|
||
</ProductStatuses>
|
||
<Threats>
|
||
<Threat Type="Impact">
|
||
<Description>Critical</Description>
|
||
</Threat>
|
||
</Threats>
|
||
<CVSSScoreSets>
|
||
<ScoreSet>
|
||
<BaseScore>8.2</BaseScore>
|
||
<Vector>AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N</Vector>
|
||
</ScoreSet>
|
||
</CVSSScoreSets>
|
||
<Remediations>
|
||
<Remediation Type="Vendor Fix">
|
||
<Description>httpd security update</Description>
|
||
<DATE>2024-07-12</DATE>
|
||
<URL>https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1830</URL>
|
||
</Remediation>
|
||
</Remediations>
|
||
</Vulnerability>
|
||
<Vulnerability Ordinal="2" xmlns="http://www.icasi.org/CVRF/schema/vuln/1.1">
|
||
<Notes>
|
||
<Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to cause unsafe RewriteRules to unexpectedly setup URL's to be handled by mod_proxy.
|
||
Users are recommended to upgrade to version 2.4.60, which fixes this issue.</Note>
|
||
</Notes>
|
||
<ReleaseDate>2024-07-12</ReleaseDate>
|
||
<CVE>CVE-2024-39573</CVE>
|
||
<ProductStatuses>
|
||
<Status Type="Fixed">
|
||
<ProductID>openEuler-22.03-LTS-SP4</ProductID>
|
||
<ProductID>openEuler-22.03-LTS-SP1</ProductID>
|
||
<ProductID>openEuler-20.03-LTS-SP4</ProductID>
|
||
<ProductID>openEuler-24.03-LTS</ProductID>
|
||
<ProductID>openEuler-22.03-LTS-SP3</ProductID>
|
||
</Status>
|
||
</ProductStatuses>
|
||
<Threats>
|
||
<Threat Type="Impact">
|
||
<Description>High</Description>
|
||
</Threat>
|
||
</Threats>
|
||
<CVSSScoreSets>
|
||
<ScoreSet>
|
||
<BaseScore>7.5</BaseScore>
|
||
<Vector>AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N</Vector>
|
||
</ScoreSet>
|
||
</CVSSScoreSets>
|
||
<Remediations>
|
||
<Remediation Type="Vendor Fix">
|
||
<Description>httpd security update</Description>
|
||
<DATE>2024-07-12</DATE>
|
||
<URL>https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1830</URL>
|
||
</Remediation>
|
||
</Remediations>
|
||
</Vulnerability>
|
||
</cvrfdoc> |