CVE-2024-38475

apache2: This update for apache2 fixes the following issues: - CVE-2024-38475: Fixed improper escaping of output in mod_rewri...

CVE-2024-38475 is fixed in 35 products on 1 platform, first by apache2 2.4.29-1ubuntu4.27+esm3, released July 1, 2024. It is being exploited: CISA added it to the Known Exploited Vulnerabilities catalog on May 1, 2025. Patch Radar priority: Patch now.

Patch nowCISA KEV
CVSS
9.8
High
Exploitation
Exploited
Listed by CISA
CISA KEV
May 1, 2025
Federal due date May 22, 2025
EPSS
0.9996
99th percentile

This update for apache2 fixes the following issues: - CVE-2024-38475: Fixed improper escaping of output in mod_rewrite (bsc#1227268) - CVE-2024-38476: Fixed server may use exploitable/malicious backend application output to run local handlers via internal redirect (bsc#1227269) - CVE-2024-38477: Fixed null pointer dereference in mod_proxy (bsc#1227270) - CVE-2024-39573: Fixed potential SSRF in mod_rewrite (bsc#1227271)

Where it's fixed

ProductFixed inFixReleased
Linux
apache2 · Debian 12.15 (bookworm) 2.4.61-1~deb12u1 DEBIAN-CVE-2024-38475 Jul 1, 2024
apache2 · Debian 13.5 (trixie) 2.4.60-1 DEBIAN-CVE-2024-38475 Jul 1, 2024
apache2 · Debian 14 2.4.60-1 DEBIAN-CVE-2024-38475 Jul 1, 2024
apache2 · Ubuntu 18.04.6 LTS (bionic) 2.4.29-1ubuntu4.27+esm3 apache2 2.4.29-1ubuntu4.27+esm3 Jul 1, 2024
apache2 · Ubuntu 20.04 LTS (focal) 2.4.41-4ubuntu3.19 apache2 2.4.41-4ubuntu3.19 Jul 3, 2024
apache2 · Ubuntu 22.04.1 LTS (jammy) 2.4.52-1ubuntu4.10 apache2 2.4.52-1ubuntu4.10 Jul 3, 2024
apache2 · Ubuntu 24.04.5 LTS (noble) 2.4.58-1ubuntu8.2 apache2 2.4.58-1ubuntu8.2 Jul 3, 2024
apache2 · Ubuntu 24.10 (oracular) 2.4.62-1ubuntu1 apache2 2.4.62-1ubuntu1 Jul 17, 2024
apache2 · Ubuntu 25.04 (plucky) 2.4.62-1ubuntu1 apache2 2.4.62-1ubuntu1 Jul 17, 2024
apache2 · opensuse-leap 15.6 2.4.58-150600.5.18.1 SUSE-SU-2024:2597-1 Jul 23, 2024
apache2 · sles 15.6 2.4.51-150400.6.29.1 SUSE-SU-2024:2624-1 Jul 30, 2024
apache2 · sles 15.6 2.4.58-150600.5.18.1 SUSE-SU-2024:2597-1 Jul 23, 2024
apache2-bin · Ubuntu 18.04.6 LTS (bionic) 2.4.29-1ubuntu4.27+esm3 apache2-bin 2.4.29-1ubuntu4.27+esm3 Jul 1, 2024
apache2-bin · Ubuntu 20.04 LTS (focal) 2.4.41-4ubuntu3.19 apache2-bin 2.4.41-4ubuntu3.19 Jul 3, 2024
apache2-bin · Ubuntu 22.04.1 LTS (jammy) 2.4.52-1ubuntu4.10 apache2-bin 2.4.52-1ubuntu4.10 Jul 3, 2024
apache2-bin · Ubuntu 24.04.5 LTS (noble) 2.4.58-1ubuntu8.2 apache2-bin 2.4.58-1ubuntu8.2 Jul 3, 2024
apache2-bin · Ubuntu 24.10 (oracular) 2.4.62-1ubuntu1 apache2-bin 2.4.62-1ubuntu1 Jul 17, 2024
apache2-bin · Ubuntu 25.04 (plucky) 2.4.62-1ubuntu1 apache2-bin 2.4.62-1ubuntu1 Jul 17, 2024
apache2-data · Ubuntu 18.04.6 LTS (bionic) 2.4.29-1ubuntu4.27+esm3 apache2-data 2.4.29-1ubuntu4.27+esm3 Jul 1, 2024
apache2-data · Ubuntu 20.04 LTS (focal) 2.4.41-4ubuntu3.19 apache2-data 2.4.41-4ubuntu3.19 Jul 3, 2024
apache2-data · Ubuntu 22.04.1 LTS (jammy) 2.4.52-1ubuntu4.10 apache2-data 2.4.52-1ubuntu4.10 Jul 3, 2024
apache2-data · Ubuntu 24.04.5 LTS (noble) 2.4.58-1ubuntu8.2 apache2-data 2.4.58-1ubuntu8.2 Jul 3, 2024
apache2-data · Ubuntu 24.10 (oracular) 2.4.62-1ubuntu1 apache2-data 2.4.62-1ubuntu1 Jul 17, 2024
apache2-data · Ubuntu 25.04 (plucky) 2.4.62-1ubuntu1 apache2-data 2.4.62-1ubuntu1 Jul 17, 2024
apache2-devel · opensuse-leap 15.6 2.4.58-150600.5.18.1 SUSE-SU-2024:2597-1 Jul 23, 2024
apache2-devel · sles 15.6 2.4.58-150600.5.18.1 SUSE-SU-2024:2597-1 Jul 23, 2024
apache2-event · opensuse-leap 15.6 2.4.58-150600.5.18.1 SUSE-SU-2024:2597-1 Jul 23, 2024
apache2-event · sles 15.6 2.4.58-150600.5.18.1 SUSE-SU-2024:2597-1 Jul 23, 2024
apache2-manual · opensuse-leap 15.6 2.4.58-150600.5.18.1 SUSE-SU-2024:2597-1 Jul 23, 2024
apache2-prefork · opensuse-leap 15.6 2.4.58-150600.5.18.1 SUSE-SU-2024:2597-1 Jul 23, 2024
apache2-prefork · sles 15.6 2.4.58-150600.5.18.1 SUSE-SU-2024:2597-1 Jul 23, 2024
apache2-suexec-custom · Ubuntu 18.04.6 LTS (bionic) 2.4.29-1ubuntu4.27+esm3 apache2-suexec-custom 2.4.29-1ubuntu4.27+esm3 Jul 1, 2024
apache2-suexec-custom · Ubuntu 20.04 LTS (focal) 2.4.41-4ubuntu3.19 apache2-suexec-custom 2.4.41-4ubuntu3.19 Jul 3, 2024
apache2-suexec-custom · Ubuntu 22.04.1 LTS (jammy) 2.4.52-1ubuntu4.10 apache2-suexec-custom 2.4.52-1ubuntu4.10 Jul 3, 2024
apache2-suexec-custom · Ubuntu 24.04.5 LTS (noble) 2.4.58-1ubuntu8.2 apache2-suexec-custom 2.4.58-1ubuntu8.2 Jul 3, 2024
apache2-suexec-custom · Ubuntu 24.10 (oracular) 2.4.62-1ubuntu1 apache2-suexec-custom 2.4.62-1ubuntu1 Jul 17, 2024
apache2-suexec-custom · Ubuntu 25.04 (plucky) 2.4.62-1ubuntu1 apache2-suexec-custom 2.4.62-1ubuntu1 Jul 17, 2024
apache2-suexec-pristine · Ubuntu 18.04.6 LTS (bionic) 2.4.29-1ubuntu4.27+esm3 apache2-suexec-pristine 2.4.29-1ubuntu4.27+esm3 Jul 1, 2024
apache2-suexec-pristine · Ubuntu 20.04 LTS (focal) 2.4.41-4ubuntu3.19 apache2-suexec-pristine 2.4.41-4ubuntu3.19 Jul 3, 2024
apache2-suexec-pristine · Ubuntu 22.04.1 LTS (jammy) 2.4.52-1ubuntu4.10 apache2-suexec-pristine 2.4.52-1ubuntu4.10 Jul 3, 2024
apache2-suexec-pristine · Ubuntu 24.04.5 LTS (noble) 2.4.58-1ubuntu8.2 apache2-suexec-pristine 2.4.58-1ubuntu8.2 Jul 3, 2024
apache2-suexec-pristine · Ubuntu 24.10 (oracular) 2.4.62-1ubuntu1 apache2-suexec-pristine 2.4.62-1ubuntu1 Jul 17, 2024
apache2-suexec-pristine · Ubuntu 25.04 (plucky) 2.4.62-1ubuntu1 apache2-suexec-pristine 2.4.62-1ubuntu1 Jul 17, 2024
apache2-utils · Ubuntu 18.04.6 LTS (bionic) 2.4.29-1ubuntu4.27+esm3 apache2-utils 2.4.29-1ubuntu4.27+esm3 Jul 1, 2024
apache2-utils · Ubuntu 20.04 LTS (focal) 2.4.41-4ubuntu3.19 apache2-utils 2.4.41-4ubuntu3.19 Jul 3, 2024
apache2-utils · Ubuntu 22.04.1 LTS (jammy) 2.4.52-1ubuntu4.10 apache2-utils 2.4.52-1ubuntu4.10 Jul 3, 2024
apache2-utils · Ubuntu 24.04.5 LTS (noble) 2.4.58-1ubuntu8.2 apache2-utils 2.4.58-1ubuntu8.2 Jul 3, 2024
apache2-utils · Ubuntu 24.10 (oracular) 2.4.62-1ubuntu1 apache2-utils 2.4.62-1ubuntu1 Jul 17, 2024
apache2-utils · Ubuntu 25.04 (plucky) 2.4.62-1ubuntu1 apache2-utils 2.4.62-1ubuntu1 Jul 17, 2024
apache2-utils · opensuse-leap 15.6 2.4.58-150600.5.18.1 SUSE-SU-2024:2597-1 Jul 23, 2024
apache2-utils · sles 15.6 2.4.58-150600.5.18.1 SUSE-SU-2024:2597-1 Jul 23, 2024
apache2-worker · opensuse-leap 15.6 2.4.58-150600.5.18.1 SUSE-SU-2024:2597-1 Jul 23, 2024
apache2-worker · sles 15.6 2.4.58-150600.5.18.1 SUSE-SU-2024:2597-1 Jul 23, 2024
httpd · RHEL 8 0:2.4.37-65.module+el8.10.0+22069+b47f5c72.1 RHSA-2024:4720 Jul 23, 2024
httpd · RHEL 9 0:2.4.57-11.el9_4 RHSA-2024:4726 Jul 23, 2024
httpd · almalinux 8 2.4.37-65.module_el8.10.0+3872+9b8ab21e.1 ALSA-2024:4720 Jul 23, 2024
httpd · almalinux 9 2.4.57-11.el9_4 ALSA-2024:4726 Jul 23, 2024
httpd · amzn 2023 2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024
httpd · ol 8 0:2.4.37-65.0.1.module+el8.10.0+90368+a557a4bf.1 ELSA-2024-4720 Jul 23, 2024
httpd · ol 9 0:2.4.57-11.0.1.el9_4 ELSA-2024-4726 Jul 23, 2024
httpd · rocky 8 0:2.4.37-65.module+el8.10.0+1830+22f0c9e0 RLSA-2024:4720 May 7, 2025
httpd · rocky 9 0:2.4.57-11.el9_4 RLSA-2024:4726 Jul 26, 2024
httpd-core · RHEL 9 0:2.4.57-11.el9_4 RHSA-2024:4726 Jul 23, 2024
httpd-core · almalinux 9 2.4.57-11.el9_4 ALSA-2024:4726 Jul 23, 2024
httpd-core · amzn 2023 2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024
httpd-core · ol 9 0:2.4.57-11.0.1.el9_4 ELSA-2024-4726 Jul 23, 2024
httpd-core-debuginfo · amzn 2023 2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024
httpd-debuginfo · amzn 2023 2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024
httpd-debugsource · amzn 2023 2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024
httpd-devel · RHEL 8 0:2.4.37-65.module+el8.10.0+22069+b47f5c72.1 RHSA-2024:4720 Jul 23, 2024
httpd-devel · RHEL 9 0:2.4.57-11.el9_4 RHSA-2024:4726 Jul 23, 2024
httpd-devel · almalinux 8 2.4.37-65.module_el8.10.0+3872+9b8ab21e.1 ALSA-2024:4720 Jul 23, 2024
httpd-devel · almalinux 9 2.4.57-11.el9_4 ALSA-2024:4726 Jul 23, 2024
httpd-devel · amzn 2023 2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024
httpd-devel · ol 8 0:2.4.37-65.0.1.module+el8.10.0+90368+a557a4bf.1 ELSA-2024-4720 Jul 23, 2024
httpd-devel · ol 9 0:2.4.57-11.0.1.el9_4 ELSA-2024-4726 Jul 23, 2024
httpd-filesystem · RHEL 8 0:2.4.37-65.module+el8.10.0+22069+b47f5c72.1 RHSA-2024:4720 Jul 23, 2024
httpd-filesystem · RHEL 9 0:2.4.57-11.el9_4 RHSA-2024:4726 Jul 23, 2024
httpd-filesystem · almalinux 8 2.4.37-65.module_el8.10.0+3872+9b8ab21e.1 ALSA-2024:4720 Jul 23, 2024
httpd-filesystem · almalinux 9 2.4.57-11.el9_4 ALSA-2024:4726 Jul 23, 2024
httpd-filesystem · amzn 2023 2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024
httpd-filesystem · ol 8 0:2.4.37-65.0.1.module+el8.10.0+90368+a557a4bf.1 ELSA-2024-4720 Jul 23, 2024
httpd-filesystem · ol 9 0:2.4.57-11.0.1.el9_4 ELSA-2024-4726 Jul 23, 2024
httpd-manual · RHEL 8 0:2.4.37-65.module+el8.10.0+22069+b47f5c72.1 RHSA-2024:4720 Jul 23, 2024
httpd-manual · RHEL 9 0:2.4.57-11.el9_4 RHSA-2024:4726 Jul 23, 2024
httpd-manual · almalinux 8 2.4.37-65.module_el8.10.0+3872+9b8ab21e.1 ALSA-2024:4720 Jul 23, 2024
httpd-manual · almalinux 9 2.4.57-11.el9_4 ALSA-2024:4726 Jul 23, 2024
httpd-manual · amzn 2023 2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024
httpd-manual · ol 8 0:2.4.37-65.0.1.module+el8.10.0+90368+a557a4bf.1 ELSA-2024-4720 Jul 23, 2024
httpd-manual · ol 9 0:2.4.57-11.0.1.el9_4 ELSA-2024-4726 Jul 23, 2024
httpd-tools · RHEL 8 0:2.4.37-65.module+el8.10.0+22069+b47f5c72.1 RHSA-2024:4720 Jul 23, 2024
httpd-tools · RHEL 9 0:2.4.57-11.el9_4 RHSA-2024:4726 Jul 23, 2024
httpd-tools · almalinux 8 2.4.37-65.module_el8.10.0+3872+9b8ab21e.1 ALSA-2024:4720 Jul 23, 2024
httpd-tools · almalinux 9 2.4.57-11.el9_4 ALSA-2024:4726 Jul 23, 2024
httpd-tools · amzn 2023 2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024
httpd-tools · ol 8 0:2.4.37-65.0.1.module+el8.10.0+90368+a557a4bf.1 ELSA-2024-4720 Jul 23, 2024
httpd-tools · ol 9 0:2.4.57-11.0.1.el9_4 ELSA-2024-4726 Jul 23, 2024
httpd-tools-debuginfo · amzn 2023 2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024
libapache2-mod-md · Ubuntu 20.04 LTS (focal) 2.4.41-4ubuntu3.19 libapache2-mod-md 2.4.41-4ubuntu3.19 Jul 3, 2024
libapache2-mod-md · Ubuntu 22.04.1 LTS (jammy) 2.4.52-1ubuntu4.10 libapache2-mod-md 2.4.52-1ubuntu4.10 Jul 3, 2024
libapache2-mod-md · Ubuntu 24.04.5 LTS (noble) 2.4.58-1ubuntu8.2 libapache2-mod-md 2.4.58-1ubuntu8.2 Jul 3, 2024
libapache2-mod-proxy-uwsgi · Ubuntu 20.04 LTS (focal) 2.4.41-4ubuntu3.19 libapache2-mod-proxy-uwsgi 2.4.41-4ubuntu3.19 Jul 3, 2024
libapache2-mod-proxy-uwsgi · Ubuntu 22.04.1 LTS (jammy) 2.4.52-1ubuntu4.10 libapache2-mod-proxy-uwsgi 2.4.52-1ubuntu4.10 Jul 3, 2024
libapache2-mod-proxy-uwsgi · Ubuntu 24.04.5 LTS (noble) 2.4.58-1ubuntu8.2 libapache2-mod-proxy-uwsgi 2.4.58-1ubuntu8.2 Jul 3, 2024
mod_http2 · RHEL 8 0:1.15.7-10.module+el8.10.0+21653+eaff63f0 RHSA-2024:4720 Jul 23, 2024
mod_http2 · almalinux 8 1.15.7-10.module_el8.10.0+3832+564e7653 ALSA-2024:4720 Jul 23, 2024
mod_http2 · ol 8 0:1.15.7-10.module+el8.10.0+90327+96b8ea28 ELSA-2024-4720 Jul 23, 2024
mod_http2 · rocky 8 0:1.15.7-10.module+el8.10.0+1775+6b057638 RLSA-2024:4720 May 7, 2025
mod_ldap · RHEL 8 0:2.4.37-65.module+el8.10.0+22069+b47f5c72.1 RHSA-2024:4720 Jul 23, 2024
mod_ldap · RHEL 9 0:2.4.57-11.el9_4 RHSA-2024:4726 Jul 23, 2024
mod_ldap · almalinux 8 2.4.37-65.module_el8.10.0+3872+9b8ab21e.1 ALSA-2024:4720 Jul 23, 2024
mod_ldap · almalinux 9 2.4.57-11.el9_4 ALSA-2024:4726 Jul 23, 2024
mod_ldap · amzn 2023 2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024
mod_ldap · ol 8 0:2.4.37-65.0.1.module+el8.10.0+90368+a557a4bf.1 ELSA-2024-4720 Jul 23, 2024
mod_ldap · ol 9 0:2.4.57-11.0.1.el9_4 ELSA-2024-4726 Jul 23, 2024
mod_ldap-debuginfo · amzn 2023 2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024
mod_lua · RHEL 9 0:2.4.57-11.el9_4 RHSA-2024:4726 Jul 23, 2024
mod_lua · almalinux 9 2.4.57-11.el9_4 ALSA-2024:4726 Jul 23, 2024
mod_lua · amzn 2023 2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024
mod_lua · ol 9 0:2.4.57-11.0.1.el9_4 ELSA-2024-4726 Jul 23, 2024
mod_lua-debuginfo · amzn 2023 2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024
mod_md · RHEL 8 1:2.0.8-8.module+el8.9.0+19080+567b90f8 RHSA-2024:4720 Jul 23, 2024
mod_md · almalinux 8 1:2.0.8-8.module_el8.6.0+2872+fe0ff7aa ALSA-2024:4720 Jul 23, 2024
mod_md · ol 8 1:2.0.8-8.module+el8.9.0+90011+2f9c6a23 ELSA-2024-4720 Jul 23, 2024
mod_md · rocky 8 1:2.0.8-8.module+el8.9.0+1370+89cc8ad5 RLSA-2024:4720 May 7, 2025
mod_proxy_html · RHEL 8 1:2.4.37-65.module+el8.10.0+22069+b47f5c72.1 RHSA-2024:4720 Jul 23, 2024
mod_proxy_html · RHEL 9 1:2.4.57-11.el9_4 RHSA-2024:4726 Jul 23, 2024
mod_proxy_html · almalinux 8 1:2.4.37-65.module_el8.10.0+3872+9b8ab21e.1 ALSA-2024:4720 Jul 23, 2024
mod_proxy_html · almalinux 9 1:2.4.57-11.el9_4 ALSA-2024:4726 Jul 23, 2024
mod_proxy_html · amzn 2023 1:2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024
mod_proxy_html · ol 8 1:2.4.37-65.0.1.module+el8.10.0+90368+a557a4bf.1 ELSA-2024-4720 Jul 23, 2024
mod_proxy_html · ol 9 1:2.4.57-11.0.1.el9_4 ELSA-2024-4726 Jul 23, 2024
mod_proxy_html-debuginfo · amzn 2023 1:2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024
mod_session · RHEL 8 0:2.4.37-65.module+el8.10.0+22069+b47f5c72.1 RHSA-2024:4720 Jul 23, 2024
mod_session · RHEL 9 0:2.4.57-11.el9_4 RHSA-2024:4726 Jul 23, 2024
mod_session · almalinux 8 2.4.37-65.module_el8.10.0+3872+9b8ab21e.1 ALSA-2024:4720 Jul 23, 2024
mod_session · almalinux 9 2.4.57-11.el9_4 ALSA-2024:4726 Jul 23, 2024
mod_session · amzn 2023 2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024
mod_session · ol 8 0:2.4.37-65.0.1.module+el8.10.0+90368+a557a4bf.1 ELSA-2024-4720 Jul 23, 2024
mod_session · ol 9 0:2.4.57-11.0.1.el9_4 ELSA-2024-4726 Jul 23, 2024
mod_session-debuginfo · amzn 2023 2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024
mod_ssl · RHEL 8 1:2.4.37-65.module+el8.10.0+22069+b47f5c72.1 RHSA-2024:4720 Jul 23, 2024
mod_ssl · RHEL 9 1:2.4.57-11.el9_4 RHSA-2024:4726 Jul 23, 2024
mod_ssl · almalinux 8 1:2.4.37-65.module_el8.10.0+3872+9b8ab21e.1 ALSA-2024:4720 Jul 23, 2024
mod_ssl · almalinux 9 1:2.4.57-11.el9_4 ALSA-2024:4726 Jul 23, 2024
mod_ssl · amzn 2023 1:2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024
mod_ssl · ol 8 1:2.4.37-65.0.1.module+el8.10.0+90368+a557a4bf.1 ELSA-2024-4720 Jul 23, 2024
mod_ssl · ol 9 1:2.4.57-11.0.1.el9_4 ELSA-2024-4726 Jul 23, 2024
mod_ssl-debuginfo · amzn 2023 1:2.4.61-1.amzn2023 ALAS2023-2024-656 Jul 18, 2024

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.