CVE-2024-39884
Apache HTTP Server: source code disclosure with handlers configured via AddType
概要
Apache HTTP Server: source code disclosure with handlers configured via AddType
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted.
Users are recommended to upgrade to version 2.4.61, which fixes this issue.
影響パッケージ
Bitnami
apache
[{"type":"SEMVER","events":[{"introduced":"2.4.60"},{"fixed":"2.4.61"}]}]
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Alpine Linux ALPINE-CVE-2024-39884 apache2 修正版: 2.4.61-r0
- Debian DEBIAN-CVE-2024-39884 apache2 修正版: 2.4.61-1
- Ubuntu UBUNTU-CVE-2024-39884 apache2
参照URL
- advisory httpd.apache.org
- advisory security.netapp.com
- web openwall.com
- web openwall.com
- web nvd.nist.gov