CVE-2024-38473
Publication date 1 July 2024
Last updated 30 May 2025
Ubuntu priority
Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests. Users are recommended to upgrade to version 2.4.60, which fixes this issue.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| apache2 | 25.04 plucky |
Fixed 2.4.62-1ubuntu1
|
| 24.10 oracular |
Fixed 2.4.62-1ubuntu1
|
|
| 24.04 LTS noble |
Fixed 2.4.58-1ubuntu8.2
|
|
| 22.04 LTS jammy |
Fixed 2.4.52-1ubuntu4.10
|
|
| 20.04 LTS focal |
Fixed 2.4.41-4ubuntu3.19
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial |
Needs evaluation
|
|
| 14.04 LTS trusty |
Needs evaluation
|
Patch details
| Package | Patch details |
|---|---|
| apache2 |
|
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
8.1 · High
|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | None |
| Availability impact | High |
| Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
References
Related Ubuntu Security Notices (USN)
- USN-6885-1
- Apache HTTP Server vulnerabilities
- 8 July 2024