[USN-6885-2] Apache HTTP Server regression

[Marc Deslauriers]

==========================================================================
Ubuntu Security Notice USN-6885-2
July 11, 2024

apache2 regression
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

USN-6885-1 introduced a regression in Apache HTTP Server.

Software Description:
- apache2: Apache HTTP server

Details:

USN-6885-1 fixed vulnerabilities in Apache HTTP Server. One of the security
fixes introduced a regression when proxying requests to a HTTP/2 server.
This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

  Marc Stern discovered that the Apache HTTP Server incorrectly handled
  serving WebSocket protocol upgrades over HTTP/2 connections. A remote
  attacker could possibly use this issue to cause the server to crash,
  resulting in a denial of service. (CVE-2024-36387)
   Orange Tsai discovered that the Apache HTTP Server mod_proxy module
  incorrectly sent certain request URLs with incorrect encodings to backends.
  A remote attacker could possibly use this issue to bypass authentication.
  (CVE-2024-38473)
   Orange Tsai discovered that the Apache HTTP Server mod_rewrite module
  incorrectly handled certain substitutions. A remote attacker could possibly
  use this issue to execute scripts in directories not directly reachable
  by any URL, or cause a denial of service. Some environments may require
  using the new UnsafeAllow3F flag to handle unsafe substitutions.
  (CVE-2024-38474, CVE-2024-38475, CVE-2024-39573)
   Orange Tsai discovered that the Apache HTTP Server incorrectly handled
  certain response headers. A remote attacker could possibly use this issue
  to obtain sensitive information, execute local scripts, or perform SSRF
  attacks. (CVE-2024-38476)
   Orange Tsai discovered that the Apache HTTP Server mod_proxy module
  incorrectly handled certain requests. A remote attacker could possibly use
  this issue to cause the server to crash, resulting in a denial of service.
  (CVE-2024-38477)
   It was discovered that the Apache HTTP Server incorrectly handled certain
  handlers configured via AddType. A remote attacker could possibly use this
  issue to obtain source code. (CVE-2024-39884)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
   apache2                         2.4.58-1ubuntu8.3

Ubuntu 22.04 LTS
   apache2                         2.4.52-1ubuntu4.11

Ubuntu 20.04 LTS
   apache2                         2.4.41-4ubuntu3.20

In general, a standard system update will make all the necessary changes.

References:
   https://ubuntu.com/security/notices/USN-6885-2
   https://ubuntu.com/security/notices/USN-6885-1
   https://launchpad.net/bugs/2072648

Package Information:
   https://launchpad.net/ubuntu/+source/apache2/2.4.58-1ubuntu8.3
   https://launchpad.net/ubuntu/+source/apache2/2.4.52-1ubuntu4.11
   https://launchpad.net/ubuntu/+source/apache2/2.4.41-4ubuntu3.20

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20240711/862c2d9c/attachment-0001.sig>