CVE-2024-38474

apache2: This update for apache2 fixes the following issues: - CVE-2024-38474: Fixed substitution encoding issue in mod_rewri...

CVE-2024-38474 is fixed in 35 products on 1 platform, first by apache2 2.4.29-1ubuntu4.27+esm4, released July 1, 2024. It is not reported as exploited. Patch Radar priority: High.

High
CVSS
9.8
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0246
84th percentile

This update for apache2 fixes the following issues: - CVE-2024-38474: Fixed substitution encoding issue in mod_rewrite (bsc#1227278) - CVE-2024-38473: Fixed encoding problem in mod_proxy (bsc#1227276) - CVE-2024-39884: Fixed source code disclosure with handlers configured via AddType (bsc#1227353)

Where it's fixed

ProductFixed inFixReleased
Linux
apache2 · Debian 12.15 (bookworm) 2.4.61-1~deb12u1 DEBIAN-CVE-2024-38474 Jul 1, 2024
apache2 · Debian 13.5 (trixie) 2.4.60-1 DEBIAN-CVE-2024-38474 Jul 1, 2024
apache2 · Debian 14 2.4.60-1 DEBIAN-CVE-2024-38474 Jul 1, 2024
apache2 · Ubuntu 18.04.6 LTS (bionic) 2.4.29-1ubuntu4.27+esm4 apache2 2.4.29-1ubuntu4.27+esm4 Jul 1, 2024
apache2 · Ubuntu 20.04 LTS (focal) 2.4.41-4ubuntu3.23 apache2 2.4.41-4ubuntu3.23 Jul 1, 2024
apache2 · Ubuntu 22.04.1 LTS (jammy) 2.4.52-1ubuntu4.16 apache2 2.4.52-1ubuntu4.16 Jul 1, 2024
apache2 · Ubuntu 24.04.5 LTS (noble) 2.4.58-1ubuntu8.8 apache2 2.4.58-1ubuntu8.8 Jul 1, 2024
apache2 · Ubuntu 24.10 (oracular) 2.4.62-1ubuntu1.1 apache2 2.4.62-1ubuntu1.1 Jan 16, 2026
apache2 · Ubuntu 25.04 (plucky) 2.4.62-1ubuntu1 apache2 2.4.62-1ubuntu1 Jul 17, 2024
apache2 · opensuse-leap 15.6 2.4.58-150600.5.23.1 SUSE-SU-2024:3172-1 Sep 9, 2024
apache2 · sles 15.6 2.4.51-150400.6.34.1 SUSE-SU-2024:3173-1 Sep 9, 2024
apache2-bin · Ubuntu 18.04.6 LTS (bionic) 2.4.29-1ubuntu4.27+esm4 apache2-bin 2.4.29-1ubuntu4.27+esm4 Jul 1, 2024
apache2-bin · Ubuntu 20.04 LTS (focal) 2.4.41-4ubuntu3.23 apache2-bin 2.4.41-4ubuntu3.23 Jul 1, 2024
apache2-bin · Ubuntu 22.04.1 LTS (jammy) 2.4.52-1ubuntu4.16 apache2-bin 2.4.52-1ubuntu4.16 Jul 1, 2024
apache2-bin · Ubuntu 24.04.5 LTS (noble) 2.4.58-1ubuntu8.8 apache2-bin 2.4.58-1ubuntu8.8 Jul 1, 2024
apache2-bin · Ubuntu 24.10 (oracular) 2.4.62-1ubuntu1.1 apache2-bin 2.4.62-1ubuntu1.1 Jan 16, 2026
apache2-bin · Ubuntu 25.04 (plucky) 2.4.62-1ubuntu1 apache2-bin 2.4.62-1ubuntu1 Jul 17, 2024
apache2-data · Ubuntu 18.04.6 LTS (bionic) 2.4.29-1ubuntu4.27+esm4 apache2-data 2.4.29-1ubuntu4.27+esm4 Jul 1, 2024
apache2-data · Ubuntu 20.04 LTS (focal) 2.4.41-4ubuntu3.23 apache2-data 2.4.41-4ubuntu3.23 Jul 1, 2024
apache2-data · Ubuntu 22.04.1 LTS (jammy) 2.4.52-1ubuntu4.16 apache2-data 2.4.52-1ubuntu4.16 Jul 1, 2024
apache2-data · Ubuntu 24.04.5 LTS (noble) 2.4.58-1ubuntu8.8 apache2-data 2.4.58-1ubuntu8.8 Jul 1, 2024
apache2-data · Ubuntu 24.10 (oracular) 2.4.62-1ubuntu1.1 apache2-data 2.4.62-1ubuntu1.1 Jan 16, 2026
apache2-data · Ubuntu 25.04 (plucky) 2.4.62-1ubuntu1 apache2-data 2.4.62-1ubuntu1 Jul 17, 2024
apache2-devel · opensuse-leap 15.6 2.4.58-150600.5.23.1 SUSE-SU-2024:3172-1 Sep 9, 2024
apache2-devel · sles 15.6 2.4.58-150600.5.23.1 SUSE-SU-2024:3172-1 Sep 9, 2024
apache2-event · opensuse-leap 15.6 2.4.58-150600.5.23.1 SUSE-SU-2024:3172-1 Sep 9, 2024
apache2-event · sles 15.6 2.4.58-150600.5.23.1 SUSE-SU-2024:3172-1 Sep 9, 2024
apache2-manual · opensuse-leap 15.6 2.4.58-150600.5.23.1 SUSE-SU-2024:3172-1 Sep 9, 2024
apache2-prefork · opensuse-leap 15.6 2.4.58-150600.5.23.1 SUSE-SU-2024:3172-1 Sep 9, 2024
apache2-prefork · sles 15.6 2.4.58-150600.5.23.1 SUSE-SU-2024:3172-1 Sep 9, 2024
apache2-suexec-custom · Ubuntu 18.04.6 LTS (bionic) 2.4.29-1ubuntu4.27+esm4 apache2-suexec-custom 2.4.29-1ubuntu4.27+esm4 Jul 1, 2024
apache2-suexec-custom · Ubuntu 20.04 LTS (focal) 2.4.41-4ubuntu3.23 apache2-suexec-custom 2.4.41-4ubuntu3.23 Jul 1, 2024
apache2-suexec-custom · Ubuntu 22.04.1 LTS (jammy) 2.4.52-1ubuntu4.16 apache2-suexec-custom 2.4.52-1ubuntu4.16 Jul 1, 2024
apache2-suexec-custom · Ubuntu 24.04.5 LTS (noble) 2.4.58-1ubuntu8.8 apache2-suexec-custom 2.4.58-1ubuntu8.8 Jul 1, 2024
apache2-suexec-custom · Ubuntu 24.10 (oracular) 2.4.62-1ubuntu1.1 apache2-suexec-custom 2.4.62-1ubuntu1.1 Jan 16, 2026
apache2-suexec-custom · Ubuntu 25.04 (plucky) 2.4.62-1ubuntu1 apache2-suexec-custom 2.4.62-1ubuntu1 Jul 17, 2024
apache2-suexec-pristine · Ubuntu 18.04.6 LTS (bionic) 2.4.29-1ubuntu4.27+esm4 apache2-suexec-pristine 2.4.29-1ubuntu4.27+esm4 Jul 1, 2024
apache2-suexec-pristine · Ubuntu 20.04 LTS (focal) 2.4.41-4ubuntu3.23 apache2-suexec-pristine 2.4.41-4ubuntu3.23 Jul 1, 2024
apache2-suexec-pristine · Ubuntu 22.04.1 LTS (jammy) 2.4.52-1ubuntu4.16 apache2-suexec-pristine 2.4.52-1ubuntu4.16 Jul 1, 2024
apache2-suexec-pristine · Ubuntu 24.04.5 LTS (noble) 2.4.58-1ubuntu8.8 apache2-suexec-pristine 2.4.58-1ubuntu8.8 Jul 1, 2024
apache2-suexec-pristine · Ubuntu 24.10 (oracular) 2.4.62-1ubuntu1.1 apache2-suexec-pristine 2.4.62-1ubuntu1.1 Jan 16, 2026
apache2-suexec-pristine · Ubuntu 25.04 (plucky) 2.4.62-1ubuntu1 apache2-suexec-pristine 2.4.62-1ubuntu1 Jul 17, 2024
apache2-utils · Ubuntu 18.04.6 LTS (bionic) 2.4.29-1ubuntu4.27+esm4 apache2-utils 2.4.29-1ubuntu4.27+esm4 Jul 1, 2024
apache2-utils · Ubuntu 20.04 LTS (focal) 2.4.41-4ubuntu3.23 apache2-utils 2.4.41-4ubuntu3.23 Jul 1, 2024
apache2-utils · Ubuntu 22.04.1 LTS (jammy) 2.4.52-1ubuntu4.16 apache2-utils 2.4.52-1ubuntu4.16 Jul 1, 2024
apache2-utils · Ubuntu 24.04.5 LTS (noble) 2.4.58-1ubuntu8.8 apache2-utils 2.4.58-1ubuntu8.8 Jul 1, 2024
apache2-utils · Ubuntu 24.10 (oracular) 2.4.62-1ubuntu1.1 apache2-utils 2.4.62-1ubuntu1.1 Jan 16, 2026
apache2-utils · Ubuntu 25.04 (plucky) 2.4.62-1ubuntu1 apache2-utils 2.4.62-1ubuntu1 Jul 17, 2024
apache2-utils · opensuse-leap 15.6 2.4.58-150600.5.23.1 SUSE-SU-2024:3172-1 Sep 9, 2024
apache2-utils · sles 15.6 2.4.58-150600.5.23.1 SUSE-SU-2024:3172-1 Sep 9, 2024
apache2-worker · opensuse-leap 15.6 2.4.58-150600.5.23.1 SUSE-SU-2024:3172-1 Sep 9, 2024
apache2-worker · sles 15.6 2.4.58-150600.5.23.1 SUSE-SU-2024:3172-1 Sep 9, 2024
httpd · RHEL 8 0:2.4.37-65.module+el8.10.0+22069+b47f5c72.1 RHSA-2024:4720 Jul 23, 2024
httpd · RHEL 9 0:2.4.57-11.el9_4 RHSA-2024:4726 Jul 23, 2024
httpd · almalinux 8 2.4.37-65.module_el8.10.0+3872+9b8ab21e.1 ALSA-2024:4720 Jul 23, 2024
httpd · almalinux 9 2.4.57-11.el9_4 ALSA-2024:4726 Jul 23, 2024
httpd · amzn 2023 2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024
httpd · ol 8 0:2.4.37-65.0.1.module+el8.10.0+90368+a557a4bf.1 ELSA-2024-4720 Jul 23, 2024
httpd · ol 9 0:2.4.57-11.0.1.el9_4 ELSA-2024-4726 Jul 23, 2024
httpd · rocky 8 0:2.4.37-65.module+el8.10.0+1830+22f0c9e0 RLSA-2024:4720 May 7, 2025
httpd · rocky 9 0:2.4.57-11.el9_4 RLSA-2024:4726 Jul 26, 2024
httpd-core · RHEL 9 0:2.4.57-11.el9_4 RHSA-2024:4726 Jul 23, 2024
httpd-core · almalinux 9 2.4.57-11.el9_4 ALSA-2024:4726 Jul 23, 2024
httpd-core · amzn 2023 2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024
httpd-core · ol 9 0:2.4.57-11.0.1.el9_4 ELSA-2024-4726 Jul 23, 2024
httpd-core-debuginfo · amzn 2023 2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024
httpd-debuginfo · amzn 2023 2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024
httpd-debugsource · amzn 2023 2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024
httpd-devel · RHEL 8 0:2.4.37-65.module+el8.10.0+22069+b47f5c72.1 RHSA-2024:4720 Jul 23, 2024
httpd-devel · RHEL 9 0:2.4.57-11.el9_4 RHSA-2024:4726 Jul 23, 2024
httpd-devel · almalinux 8 2.4.37-65.module_el8.10.0+3872+9b8ab21e.1 ALSA-2024:4720 Jul 23, 2024
httpd-devel · almalinux 9 2.4.57-11.el9_4 ALSA-2024:4726 Jul 23, 2024
httpd-devel · amzn 2023 2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024
httpd-devel · ol 8 0:2.4.37-65.0.1.module+el8.10.0+90368+a557a4bf.1 ELSA-2024-4720 Jul 23, 2024
httpd-devel · ol 9 0:2.4.57-11.0.1.el9_4 ELSA-2024-4726 Jul 23, 2024
httpd-filesystem · RHEL 8 0:2.4.37-65.module+el8.10.0+22069+b47f5c72.1 RHSA-2024:4720 Jul 23, 2024
httpd-filesystem · RHEL 9 0:2.4.57-11.el9_4 RHSA-2024:4726 Jul 23, 2024
httpd-filesystem · almalinux 8 2.4.37-65.module_el8.10.0+3872+9b8ab21e.1 ALSA-2024:4720 Jul 23, 2024
httpd-filesystem · almalinux 9 2.4.57-11.el9_4 ALSA-2024:4726 Jul 23, 2024
httpd-filesystem · amzn 2023 2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024
httpd-filesystem · ol 8 0:2.4.37-65.0.1.module+el8.10.0+90368+a557a4bf.1 ELSA-2024-4720 Jul 23, 2024
httpd-filesystem · ol 9 0:2.4.57-11.0.1.el9_4 ELSA-2024-4726 Jul 23, 2024
httpd-manual · RHEL 8 0:2.4.37-65.module+el8.10.0+22069+b47f5c72.1 RHSA-2024:4720 Jul 23, 2024
httpd-manual · RHEL 9 0:2.4.57-11.el9_4 RHSA-2024:4726 Jul 23, 2024
httpd-manual · almalinux 8 2.4.37-65.module_el8.10.0+3872+9b8ab21e.1 ALSA-2024:4720 Jul 23, 2024
httpd-manual · almalinux 9 2.4.57-11.el9_4 ALSA-2024:4726 Jul 23, 2024
httpd-manual · amzn 2023 2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024
httpd-manual · ol 8 0:2.4.37-65.0.1.module+el8.10.0+90368+a557a4bf.1 ELSA-2024-4720 Jul 23, 2024
httpd-manual · ol 9 0:2.4.57-11.0.1.el9_4 ELSA-2024-4726 Jul 23, 2024
httpd-tools · RHEL 8 0:2.4.37-65.module+el8.10.0+22069+b47f5c72.1 RHSA-2024:4720 Jul 23, 2024
httpd-tools · RHEL 9 0:2.4.57-11.el9_4 RHSA-2024:4726 Jul 23, 2024
httpd-tools · almalinux 8 2.4.37-65.module_el8.10.0+3872+9b8ab21e.1 ALSA-2024:4720 Jul 23, 2024
httpd-tools · almalinux 9 2.4.57-11.el9_4 ALSA-2024:4726 Jul 23, 2024
httpd-tools · amzn 2023 2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024
httpd-tools · ol 8 0:2.4.37-65.0.1.module+el8.10.0+90368+a557a4bf.1 ELSA-2024-4720 Jul 23, 2024
httpd-tools · ol 9 0:2.4.57-11.0.1.el9_4 ELSA-2024-4726 Jul 23, 2024
httpd-tools-debuginfo · amzn 2023 2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024
libapache2-mod-md · Ubuntu 20.04 LTS (focal) 2.4.41-4ubuntu3.23 libapache2-mod-md 2.4.41-4ubuntu3.23 Jul 1, 2024
libapache2-mod-md · Ubuntu 22.04.1 LTS (jammy) 2.4.52-1ubuntu4.16 libapache2-mod-md 2.4.52-1ubuntu4.16 Jul 1, 2024
libapache2-mod-md · Ubuntu 24.04.5 LTS (noble) 2.4.58-1ubuntu8.8 libapache2-mod-md 2.4.58-1ubuntu8.8 Jul 1, 2024
libapache2-mod-proxy-uwsgi · Ubuntu 20.04 LTS (focal) 2.4.41-4ubuntu3.23 libapache2-mod-proxy-uwsgi 2.4.41-4ubuntu3.23 Jul 1, 2024
libapache2-mod-proxy-uwsgi · Ubuntu 22.04.1 LTS (jammy) 2.4.52-1ubuntu4.16 libapache2-mod-proxy-uwsgi 2.4.52-1ubuntu4.16 Jul 1, 2024
libapache2-mod-proxy-uwsgi · Ubuntu 24.04.5 LTS (noble) 2.4.58-1ubuntu8.8 libapache2-mod-proxy-uwsgi 2.4.58-1ubuntu8.8 Jul 1, 2024
mod_http2 · RHEL 8 0:1.15.7-10.module+el8.10.0+21653+eaff63f0 RHSA-2024:4720 Jul 23, 2024
mod_http2 · almalinux 8 1.15.7-10.module_el8.10.0+3832+564e7653 ALSA-2024:4720 Jul 23, 2024
mod_http2 · ol 8 0:1.15.7-10.module+el8.10.0+90327+96b8ea28 ELSA-2024-4720 Jul 23, 2024
mod_http2 · rocky 8 0:1.15.7-10.module+el8.10.0+1775+6b057638 RLSA-2024:4720 May 7, 2025
mod_ldap · RHEL 8 0:2.4.37-65.module+el8.10.0+22069+b47f5c72.1 RHSA-2024:4720 Jul 23, 2024
mod_ldap · RHEL 9 0:2.4.57-11.el9_4 RHSA-2024:4726 Jul 23, 2024
mod_ldap · almalinux 8 2.4.37-65.module_el8.10.0+3872+9b8ab21e.1 ALSA-2024:4720 Jul 23, 2024
mod_ldap · almalinux 9 2.4.57-11.el9_4 ALSA-2024:4726 Jul 23, 2024
mod_ldap · amzn 2023 2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024
mod_ldap · ol 8 0:2.4.37-65.0.1.module+el8.10.0+90368+a557a4bf.1 ELSA-2024-4720 Jul 23, 2024
mod_ldap · ol 9 0:2.4.57-11.0.1.el9_4 ELSA-2024-4726 Jul 23, 2024
mod_ldap-debuginfo · amzn 2023 2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024
mod_lua · RHEL 9 0:2.4.57-11.el9_4 RHSA-2024:4726 Jul 23, 2024
mod_lua · almalinux 9 2.4.57-11.el9_4 ALSA-2024:4726 Jul 23, 2024
mod_lua · amzn 2023 2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024
mod_lua · ol 9 0:2.4.57-11.0.1.el9_4 ELSA-2024-4726 Jul 23, 2024
mod_lua-debuginfo · amzn 2023 2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024
mod_md · RHEL 8 1:2.0.8-8.module+el8.9.0+19080+567b90f8 RHSA-2024:4720 Jul 23, 2024
mod_md · almalinux 8 1:2.0.8-8.module_el8.6.0+2872+fe0ff7aa ALSA-2024:4720 Jul 23, 2024
mod_md · ol 8 1:2.0.8-8.module+el8.9.0+90011+2f9c6a23 ELSA-2024-4720 Jul 23, 2024
mod_md · rocky 8 1:2.0.8-8.module+el8.9.0+1370+89cc8ad5 RLSA-2024:4720 May 7, 2025
mod_proxy_html · RHEL 8 1:2.4.37-65.module+el8.10.0+22069+b47f5c72.1 RHSA-2024:4720 Jul 23, 2024
mod_proxy_html · RHEL 9 1:2.4.57-11.el9_4 RHSA-2024:4726 Jul 23, 2024
mod_proxy_html · almalinux 8 1:2.4.37-65.module_el8.10.0+3872+9b8ab21e.1 ALSA-2024:4720 Jul 23, 2024
mod_proxy_html · almalinux 9 1:2.4.57-11.el9_4 ALSA-2024:4726 Jul 23, 2024
mod_proxy_html · amzn 2023 1:2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024
mod_proxy_html · ol 8 1:2.4.37-65.0.1.module+el8.10.0+90368+a557a4bf.1 ELSA-2024-4720 Jul 23, 2024
mod_proxy_html · ol 9 1:2.4.57-11.0.1.el9_4 ELSA-2024-4726 Jul 23, 2024
mod_proxy_html-debuginfo · amzn 2023 1:2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024
mod_session · RHEL 8 0:2.4.37-65.module+el8.10.0+22069+b47f5c72.1 RHSA-2024:4720 Jul 23, 2024
mod_session · RHEL 9 0:2.4.57-11.el9_4 RHSA-2024:4726 Jul 23, 2024
mod_session · almalinux 8 2.4.37-65.module_el8.10.0+3872+9b8ab21e.1 ALSA-2024:4720 Jul 23, 2024
mod_session · almalinux 9 2.4.57-11.el9_4 ALSA-2024:4726 Jul 23, 2024
mod_session · amzn 2023 2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024
mod_session · ol 8 0:2.4.37-65.0.1.module+el8.10.0+90368+a557a4bf.1 ELSA-2024-4720 Jul 23, 2024
mod_session · ol 9 0:2.4.57-11.0.1.el9_4 ELSA-2024-4726 Jul 23, 2024
mod_session-debuginfo · amzn 2023 2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024
mod_ssl · RHEL 8 1:2.4.37-65.module+el8.10.0+22069+b47f5c72.1 RHSA-2024:4720 Jul 23, 2024
mod_ssl · RHEL 9 1:2.4.57-11.el9_4 RHSA-2024:4726 Jul 23, 2024
mod_ssl · almalinux 8 1:2.4.37-65.module_el8.10.0+3872+9b8ab21e.1 ALSA-2024:4720 Jul 23, 2024
mod_ssl · almalinux 9 1:2.4.57-11.el9_4 ALSA-2024:4726 Jul 23, 2024
mod_ssl · amzn 2023 1:2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024
mod_ssl · ol 8 1:2.4.37-65.0.1.module+el8.10.0+90368+a557a4bf.1 ELSA-2024-4720 Jul 23, 2024
mod_ssl · ol 9 1:2.4.57-11.0.1.el9_4 ELSA-2024-4726 Jul 23, 2024
mod_ssl-debuginfo · amzn 2023 1:2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.