openEuler update for httpd
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 3 |
| CVE-ID | CVE-2024-38475 CVE-2024-39573 CVE-2016-6431 |
| CWE-ID | CWE-20 CWE-918 |
| Exploitation vector | Network |
| Public exploit | Public exploit code for vulnerability #1 is available. |
| Vulnerable software |
openEuler Operating systems & Components / Operating system httpd-help Operating systems & Components / Operating system package or component httpd-filesystem Operating systems & Components / Operating system package or component mod_ssl Operating systems & Components / Operating system package or component mod_session Operating systems & Components / Operating system package or component mod_proxy_html Operating systems & Components / Operating system package or component mod_md Operating systems & Components / Operating system package or component mod_ldap Operating systems & Components / Operating system package or component httpd-tools Operating systems & Components / Operating system package or component httpd-devel Operating systems & Components / Operating system package or component httpd-debugsource Operating systems & Components / Operating system package or component httpd-debuginfo Operating systems & Components / Operating system package or component httpd Operating systems & Components / Operating system package or component |
| Vendor | openEuler |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) Input validation error
EUVDB-ID: #VU93542
Risk: High
CVSSv4.0: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]
CVE-ID: CVE-2024-38475
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to insufficient validation of user-supplied input in mod_rewrite when first segment of substitution matches filesystem path. A remote attacker can map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL and view contents of files or execute arbitrary code.
Install updates from vendor's repository.
Vulnerable software versionsopenEuler: 20.03 LTS SP4 - 24.03 LTS
httpd-help: before 2.4.51-22
httpd-filesystem: before 2.4.51-22
mod_ssl: before 2.4.51-22
mod_session: before 2.4.51-22
mod_proxy_html: before 2.4.51-22
mod_md: before 2.4.51-22
mod_ldap: before 2.4.51-22
httpd-tools: before 2.4.51-22
httpd-devel: before 2.4.51-22
httpd-debugsource: before 2.4.51-22
httpd-debuginfo: before 2.4.51-22
httpd: before 2.4.51-22
CPE2.3- cpe:2.3:o:openeuler:openeuler:20.03:LTS SP4:*:*:*:*:*:*
- cpe:2.3:o:openeuler:openeuler:22.03:LTS SP1:*:*:*:*:*:*
- cpe:2.3:o:openeuler:openeuler:22.03:LTS SP3:*:*:*:*:*:*
- cpe:2.3:a:openeuler:httpd-help:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:httpd-filesystem:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:mod_ssl:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:mod_session:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:mod_proxy_html:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:mod_md:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:mod_ldap:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:httpd-tools:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:httpd-devel:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:httpd-debugsource:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:httpd-debuginfo:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:httpd:*:*:*:*:*:openeuler:*:*
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1830
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
2) Server-Side Request Forgery (SSRF)
EUVDB-ID: #VU93545
Risk: Medium
CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2024-39573
CWE-ID:
CWE-918 - Server-Side Request Forgery (SSRF)
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote attacker to perform SSRF attacks.
The vulnerability exists due to insufficient validation of user-supplied input in mod_rewrite proxy handler substitution. A remote attacker can cause unsafe RewriteRules to unexpectedly setup URL's to be handled by mod_proxy.
MitigationInstall updates from vendor's repository.
Vulnerable software versionsopenEuler: 20.03 LTS SP4 - 24.03 LTS
httpd-help: before 2.4.51-22
httpd-filesystem: before 2.4.51-22
mod_ssl: before 2.4.51-22
mod_session: before 2.4.51-22
mod_proxy_html: before 2.4.51-22
mod_md: before 2.4.51-22
mod_ldap: before 2.4.51-22
httpd-tools: before 2.4.51-22
httpd-devel: before 2.4.51-22
httpd-debugsource: before 2.4.51-22
httpd-debuginfo: before 2.4.51-22
httpd: before 2.4.51-22
CPE2.3- cpe:2.3:o:openeuler:openeuler:20.03:LTS SP4:*:*:*:*:*:*
- cpe:2.3:o:openeuler:openeuler:22.03:LTS SP1:*:*:*:*:*:*
- cpe:2.3:o:openeuler:openeuler:22.03:LTS SP3:*:*:*:*:*:*
- cpe:2.3:a:openeuler:httpd-help:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:httpd-filesystem:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:mod_ssl:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:mod_session:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:mod_proxy_html:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:mod_md:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:mod_ldap:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:httpd-tools:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:httpd-devel:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:httpd-debugsource:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:httpd-debuginfo:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:httpd:*:*:*:*:*:openeuler:*:*
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1830
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Denial of service
EUVDB-ID: #VU1046
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2016-6431
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulneability allows a remote unauthenticated user to cause DoS conditions on the target system.
The weakness is due to insufficient input validation. By sending a specially crafted enrollment request to the target system via HTTPS, attackers can trigger flaw in the Certificate Authority (CA) enrollment feature that leads to the system reload.
Successful exploitation of the vulnerability results in denial of service on the vulnerable system.
Install updates from vendor's repository.
Vulnerable software versionsopenEuler: 20.03 LTS SP4 - 24.03 LTS
httpd-help: before 2.4.51-22
httpd-filesystem: before 2.4.51-22
mod_ssl: before 2.4.51-22
mod_session: before 2.4.51-22
mod_proxy_html: before 2.4.51-22
mod_md: before 2.4.51-22
mod_ldap: before 2.4.51-22
httpd-tools: before 2.4.51-22
httpd-devel: before 2.4.51-22
httpd-debugsource: before 2.4.51-22
httpd-debuginfo: before 2.4.51-22
httpd: before 2.4.51-22
CPE2.3- cpe:2.3:o:openeuler:openeuler:20.03:LTS SP4:*:*:*:*:*:*
- cpe:2.3:o:openeuler:openeuler:22.03:LTS SP1:*:*:*:*:*:*
- cpe:2.3:o:openeuler:openeuler:22.03:LTS SP3:*:*:*:*:*:*
- cpe:2.3:a:openeuler:httpd-help:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:httpd-filesystem:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:mod_ssl:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:mod_session:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:mod_proxy_html:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:mod_md:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:mod_ldap:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:httpd-tools:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:httpd-devel:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:httpd-debugsource:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:httpd-debuginfo:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:httpd:*:*:*:*:*:openeuler:*:*
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1830
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
