An update for httpd is now available for openEuler-24.03-LTS,openEuler-22.03-LTS-SP4,openEuler-22.03-LTS-SP3,openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP1 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2024-2051 Final 1.0 1.0 2024-08-23 Initial 2024-08-23 2024-08-23 openEuler SA Tool V1.0 2024-08-23 httpd security update An update for httpd is now available for openEuler-24.03-LTS,openEuler-22.03-LTS-SP4,openEuler-22.03-LTS-SP3,openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP1 Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fix(es): Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests. Users are recommended to upgrade to version 2.4.60, which fixes this issue.(CVE-2024-38473) An update for httpd is now available for openEuler-24.03-LTS,openEuler-22.03-LTS-SP4,openEuler-22.03-LTS-SP3,openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP1. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High httpd https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2051 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2024-38473 https://nvd.nist.gov/vuln/detail/CVE-2024-38473 openEuler-24.03-LTS openEuler-22.03-LTS-SP4 openEuler-22.03-LTS-SP3 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP1 httpd-2.4.58-6.oe2403.aarch64.rpm httpd-debuginfo-2.4.58-6.oe2403.aarch64.rpm httpd-debugsource-2.4.58-6.oe2403.aarch64.rpm httpd-devel-2.4.58-6.oe2403.aarch64.rpm httpd-tools-2.4.58-6.oe2403.aarch64.rpm mod_ldap-2.4.58-6.oe2403.aarch64.rpm mod_md-2.4.58-6.oe2403.aarch64.rpm mod_proxy_html-2.4.58-6.oe2403.aarch64.rpm mod_session-2.4.58-6.oe2403.aarch64.rpm mod_ssl-2.4.58-6.oe2403.aarch64.rpm httpd-2.4.51-22.oe2203sp4.aarch64.rpm httpd-debuginfo-2.4.51-22.oe2203sp4.aarch64.rpm httpd-debugsource-2.4.51-22.oe2203sp4.aarch64.rpm httpd-devel-2.4.51-22.oe2203sp4.aarch64.rpm httpd-tools-2.4.51-22.oe2203sp4.aarch64.rpm mod_ldap-2.4.51-22.oe2203sp4.aarch64.rpm mod_md-2.4.51-22.oe2203sp4.aarch64.rpm mod_proxy_html-2.4.51-22.oe2203sp4.aarch64.rpm mod_session-2.4.51-22.oe2203sp4.aarch64.rpm mod_ssl-2.4.51-22.oe2203sp4.aarch64.rpm httpd-2.4.51-22.oe2203sp3.aarch64.rpm httpd-debuginfo-2.4.51-22.oe2203sp3.aarch64.rpm httpd-debugsource-2.4.51-22.oe2203sp3.aarch64.rpm httpd-devel-2.4.51-22.oe2203sp3.aarch64.rpm httpd-tools-2.4.51-22.oe2203sp3.aarch64.rpm mod_ldap-2.4.51-22.oe2203sp3.aarch64.rpm mod_md-2.4.51-22.oe2203sp3.aarch64.rpm mod_proxy_html-2.4.51-22.oe2203sp3.aarch64.rpm mod_session-2.4.51-22.oe2203sp3.aarch64.rpm mod_ssl-2.4.51-22.oe2203sp3.aarch64.rpm httpd-2.4.43-25.oe2003sp4.aarch64.rpm httpd-debuginfo-2.4.43-25.oe2003sp4.aarch64.rpm httpd-debugsource-2.4.43-25.oe2003sp4.aarch64.rpm httpd-devel-2.4.43-25.oe2003sp4.aarch64.rpm httpd-tools-2.4.43-25.oe2003sp4.aarch64.rpm mod_ldap-2.4.43-25.oe2003sp4.aarch64.rpm mod_md-2.4.43-25.oe2003sp4.aarch64.rpm mod_proxy_html-2.4.43-25.oe2003sp4.aarch64.rpm mod_session-2.4.43-25.oe2003sp4.aarch64.rpm mod_ssl-2.4.43-25.oe2003sp4.aarch64.rpm httpd-2.4.51-22.oe2203sp1.aarch64.rpm httpd-debuginfo-2.4.51-22.oe2203sp1.aarch64.rpm httpd-debugsource-2.4.51-22.oe2203sp1.aarch64.rpm httpd-devel-2.4.51-22.oe2203sp1.aarch64.rpm httpd-tools-2.4.51-22.oe2203sp1.aarch64.rpm mod_ldap-2.4.51-22.oe2203sp1.aarch64.rpm mod_md-2.4.51-22.oe2203sp1.aarch64.rpm mod_proxy_html-2.4.51-22.oe2203sp1.aarch64.rpm mod_session-2.4.51-22.oe2203sp1.aarch64.rpm mod_ssl-2.4.51-22.oe2203sp1.aarch64.rpm httpd-2.4.58-6.oe2403.src.rpm httpd-2.4.51-22.oe2203sp4.src.rpm httpd-2.4.51-22.oe2203sp3.src.rpm httpd-2.4.43-25.oe2003sp4.src.rpm httpd-2.4.51-22.oe2203sp1.src.rpm httpd-2.4.58-6.oe2403.x86_64.rpm httpd-debuginfo-2.4.58-6.oe2403.x86_64.rpm httpd-debugsource-2.4.58-6.oe2403.x86_64.rpm httpd-devel-2.4.58-6.oe2403.x86_64.rpm httpd-tools-2.4.58-6.oe2403.x86_64.rpm mod_ldap-2.4.58-6.oe2403.x86_64.rpm mod_md-2.4.58-6.oe2403.x86_64.rpm mod_proxy_html-2.4.58-6.oe2403.x86_64.rpm mod_session-2.4.58-6.oe2403.x86_64.rpm mod_ssl-2.4.58-6.oe2403.x86_64.rpm httpd-2.4.51-22.oe2203sp4.x86_64.rpm httpd-debuginfo-2.4.51-22.oe2203sp4.x86_64.rpm httpd-debugsource-2.4.51-22.oe2203sp4.x86_64.rpm httpd-devel-2.4.51-22.oe2203sp4.x86_64.rpm httpd-tools-2.4.51-22.oe2203sp4.x86_64.rpm mod_ldap-2.4.51-22.oe2203sp4.x86_64.rpm mod_md-2.4.51-22.oe2203sp4.x86_64.rpm mod_proxy_html-2.4.51-22.oe2203sp4.x86_64.rpm mod_session-2.4.51-22.oe2203sp4.x86_64.rpm mod_ssl-2.4.51-22.oe2203sp4.x86_64.rpm httpd-2.4.51-22.oe2203sp3.x86_64.rpm httpd-debuginfo-2.4.51-22.oe2203sp3.x86_64.rpm httpd-debugsource-2.4.51-22.oe2203sp3.x86_64.rpm httpd-devel-2.4.51-22.oe2203sp3.x86_64.rpm httpd-tools-2.4.51-22.oe2203sp3.x86_64.rpm mod_ldap-2.4.51-22.oe2203sp3.x86_64.rpm mod_md-2.4.51-22.oe2203sp3.x86_64.rpm mod_proxy_html-2.4.51-22.oe2203sp3.x86_64.rpm mod_session-2.4.51-22.oe2203sp3.x86_64.rpm mod_ssl-2.4.51-22.oe2203sp3.x86_64.rpm httpd-2.4.43-25.oe2003sp4.x86_64.rpm httpd-debuginfo-2.4.43-25.oe2003sp4.x86_64.rpm httpd-debugsource-2.4.43-25.oe2003sp4.x86_64.rpm httpd-devel-2.4.43-25.oe2003sp4.x86_64.rpm httpd-tools-2.4.43-25.oe2003sp4.x86_64.rpm mod_ldap-2.4.43-25.oe2003sp4.x86_64.rpm mod_md-2.4.43-25.oe2003sp4.x86_64.rpm mod_proxy_html-2.4.43-25.oe2003sp4.x86_64.rpm mod_session-2.4.43-25.oe2003sp4.x86_64.rpm mod_ssl-2.4.43-25.oe2003sp4.x86_64.rpm httpd-2.4.51-22.oe2203sp1.x86_64.rpm httpd-debuginfo-2.4.51-22.oe2203sp1.x86_64.rpm httpd-debugsource-2.4.51-22.oe2203sp1.x86_64.rpm httpd-devel-2.4.51-22.oe2203sp1.x86_64.rpm httpd-tools-2.4.51-22.oe2203sp1.x86_64.rpm mod_ldap-2.4.51-22.oe2203sp1.x86_64.rpm mod_md-2.4.51-22.oe2203sp1.x86_64.rpm mod_proxy_html-2.4.51-22.oe2203sp1.x86_64.rpm mod_session-2.4.51-22.oe2203sp1.x86_64.rpm mod_ssl-2.4.51-22.oe2203sp1.x86_64.rpm httpd-filesystem-2.4.58-6.oe2403.noarch.rpm httpd-help-2.4.58-6.oe2403.noarch.rpm httpd-filesystem-2.4.51-22.oe2203sp4.noarch.rpm httpd-help-2.4.51-22.oe2203sp4.noarch.rpm httpd-filesystem-2.4.51-22.oe2203sp3.noarch.rpm httpd-help-2.4.51-22.oe2203sp3.noarch.rpm httpd-filesystem-2.4.43-25.oe2003sp4.noarch.rpm httpd-help-2.4.43-25.oe2003sp4.noarch.rpm httpd-filesystem-2.4.51-22.oe2203sp1.noarch.rpm httpd-help-2.4.51-22.oe2203sp1.noarch.rpm Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests. Users are recommended to upgrade to version 2.4.60, which fixes this issue. 2024-08-23 CVE-2024-38473 openEuler-24.03-LTS openEuler-22.03-LTS-SP4 openEuler-22.03-LTS-SP3 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP1 High 8.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H httpd security update 2024-08-23 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2051