CVE-2024-39884
published 2024-07-18CVE-2024-39884: A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration of handlers…
PriorityP429medium6.2CVSS 3.1
AVLACLPRNUINSUCHINAN
EPSS
0.89%
55.4th percentile
A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted.
Users are recommended to upgrade to version 2.4.62, which fixes this issue.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | — | — |
| apache | http_server | — | — |
| apache | httpd | — | — |
| apache_software_foundation | apache_http_server | 2.4.60 – 2.4.61 | — |
| debian | apache2 | < apache2 2.4.61-1 (bullseye) | apache2 2.4.61-1 (bullseye) |
| debian | apache2 | < apache2 2.4.62-1~deb12u1 (bookworm) | apache2 2.4.62-1~deb12u1 (bookworm) |
| msrc | azl3_httpd_2.4.58-4_on_azure_linux_3.0 | — | — |
| msrc | azl3_httpd_2.4.61-1_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| msrc | cbl2_httpd_2.4.59-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_httpd_2.4.61-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| netapp | ontap_tools | — | — |
CVSS provenance
nvdv3.16.2MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
osv6.2MEDIUM
vendor_redhat9.8CRITICAL
vendor_apache6.2HIGH
vendor_debian6.2MEDIUM
vendor_msrc6.2MEDIUM
vendor_ubuntu5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
httpd: source code disclosure with handlers configured via AddType
vendor_redhat·2024-07-18·CVSS 6.2
CVE-2024-40725 [MEDIUM] CWE-668 httpd: source code disclosure with handlers configured via AddType
httpd: source code disclosure with handlers configured via AddType
A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted.
Users are recommended to upgrade to version 2.4.62, which fixes this issue.
A flaw was found in httpd. The fix for CVE-2024-39884 ignores some uses of the legacy content-type based configuration of handlers. "AddType" and similar configurations, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For ex
Ubuntu
Apache HTTP Server regression
vendor_ubuntu·2024-07-11·CVSS 5.4
[MEDIUM] Apache HTTP Server regression
Title: Apache HTTP Server regression
Summary: USN-6885-1 introduced a regression in Apache HTTP Server.
USN-6885-1 fixed vulnerabilities in Apache HTTP Server. One of the security
fixes introduced a regression when proxying requests to a HTTP/2 server.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Marc Stern discovered that the Apache HTTP Server incorrectly handled
serving WebSocket protocol upgrades over HTTP/2 connections. A remote
attacker could possibly use this issue to cause the server to crash,
resulting in a denial of service. (CVE-2024-36387)
Orange Tsai discovered that the Apache HTTP Server mod_proxy module
incorrectly sent certain request URLs with incorrect encodings to backends.
A remote attacker could possibly use this i
Microsoft
Apache HTTP Server: source code disclosure with handlers configured via AddType
vendor_msrc·2024-07-09·CVSS 6.2
CVE-2024-39884 [MEDIUM] Apache HTTP Server: source code disclosure with handlers configured via AddType
Apache HTTP Server: source code disclosure with handlers configured via AddType
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
apache: apache
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Ubuntu
Apache HTTP Server vulnerabilities
vendor_ubuntu·2024-07-08·CVSS 5.4
CVE-2024-38475 [MEDIUM] Apache HTTP Server vulnerabilities
Title: Apache HTTP Server vulnerabilities
Summary: Several security issues were fixed in Apache HTTP Server.
Marc Stern discovered that the Apache HTTP Server incorrectly handled
serving WebSocket protocol upgrades over HTTP/2 connections. A remote
attacker could possibly use this issue to cause the server to crash,
resulting in a denial of service. (CVE-2024-36387)
Orange Tsai discovered that the Apache HTTP Server mod_proxy module
incorrectly sent certain request URLs with incorrect encodings to backends.
A remote attacker could possibly use this issue to bypass authentication.
(CVE-2024-38473)
Orange Tsai discovered that the Apache HTTP Server mod_rewrite module
incorrectly handled certain substitutions. A remote attacker could possibly
use this issue to execute scripts in directori
Red Hat
httpd: source code disclosure with handlers configured via AddType
vendor_redhat·2024-07-04·CVSS 9.8
CVE-2024-39884 [CRITICAL] CWE-200 httpd: source code disclosure with handlers configured via AddType
httpd: source code disclosure with handlers configured via AddType
A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted.
Users are recommended to upgrade to version 2.4.61, which fixes this issue.
A flaw was found in httpd. The fix for CVE-2024-38476 ignores some uses of the legacy content-type based configuration of handlers. "AddType" and similar configurations, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts m
Debian
CVE-2024-39884: apache2 - A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the le...
vendor_debian·2024·CVSS 6.2
CVE-2024-39884 [MEDIUM] CVE-2024-39884: apache2 - A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the le...
A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted. Users are recommended to upgrade to version 2.4.61, which fixes this issue.
Scope: local
bookworm: resolved
bullseye: resolved (fixed in 2.4.61-1)
forky: resolved (fixed in 2.4.61-1)
sid: resolved (fixed in 2.4.61-1)
trixie: resolved (fixed in 2.4.61-1)
Debian
CVE-2024-40725: apache2 - A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignor...
vendor_debian·2024·CVSS 6.2
CVE-2024-40725 [MEDIUM] CVE-2024-40725: apache2 - A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignor...
A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted. Users are recommended to upgrade to version 2.4.62, which fixes this issue.
Scope: local
bookworm: resolved (fixed in 2.4.62-1~deb12u1)
bullseye: resolved (fixed in 2.4.62-1~deb11u1)
forky: resolved (fixed in 2.4.62-1)
sid: resolved (fixed in 2.4.62-1)
trixie: resolved (fixed in 2.4.62-1)
Apache
Apache httpd: CVE-2024-39884
vendor_apache·CVSS 6.2
CVE-2024-39884 [HIGH] Apache httpd: CVE-2024-39884
Apache httpd: CVE-2024-39884
A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted. Users are recommended to upgrade to version 2.4.61, which fixes this issue. Reported to security team 2024-07-01 fixed by r1918839 in 2.4.x 2024-07-03 Update 2.4.61 released 2024-07-03 Affects 2.4.60
Severity: high
Affected versions: 2.4.61,
OSV
CVE-2024-40725: A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2
osv·2024-07-18·CVSS 6.2
CVE-2024-40725 [MEDIUM] CVE-2024-40725: A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2
A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted. Users are recommended to upgrade to version 2.4.62, which fixes this issue.
GHSA
GHSA-x749-289q-pg9q: A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2
ghsa_unreviewed·2024-07-18·CVSS 6.2
CVE-2024-40725 [MEDIUM] CWE-668 GHSA-x749-289q-pg9q: A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2
A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted.
Users are recommended to upgrade to version 2.4.62, which fixes this issue.
OSV
CVE-2024-40725: A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2
osv·2024-07-18·CVSS 6.2
CVE-2024-40725 [MEDIUM] CVE-2024-40725: A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2
A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted.
Users are recommended to upgrade to version 2.4.62, which fixes this issue.
OSV
apache2 regression
osv·2024-07-11·CVSS 5.4
[MEDIUM] apache2 regression
apache2 regression
USN-6885-1 fixed vulnerabilities in Apache HTTP Server. One of the security
fixes introduced a regression when proxying requests to a HTTP/2 server.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Marc Stern discovered that the Apache HTTP Server incorrectly handled
serving WebSocket protocol upgrades over HTTP/2 connections. A remote
attacker could possibly use this issue to cause the server to crash,
resulting in a denial of service. (CVE-2024-36387)
Orange Tsai discovered that the Apache HTTP Server mod_proxy module
incorrectly sent certain request URLs with incorrect encodings to backends.
A remote attacker could possibly use this issue to bypass authentication.
(CVE-2024-38473)
Orange Tsai discovered that the Apach
OSV
apache2 vulnerabilities
osv·2024-07-08·CVSS 5.4
CVE-2024-36387 [MEDIUM] apache2 vulnerabilities
apache2 vulnerabilities
Marc Stern discovered that the Apache HTTP Server incorrectly handled
serving WebSocket protocol upgrades over HTTP/2 connections. A remote
attacker could possibly use this issue to cause the server to crash,
resulting in a denial of service. (CVE-2024-36387)
Orange Tsai discovered that the Apache HTTP Server mod_proxy module
incorrectly sent certain request URLs with incorrect encodings to backends.
A remote attacker could possibly use this issue to bypass authentication.
(CVE-2024-38473)
Orange Tsai discovered that the Apache HTTP Server mod_rewrite module
incorrectly handled certain substitutions. A remote attacker could possibly
use this issue to execute scripts in directories not directly reachable
by any URL, or cause a denial of service. Some environments
OSV
CVE-2024-39884: A regression in the core of Apache HTTP Server 2
osv·2024-07-04·CVSS 6.2
CVE-2024-39884 [MEDIUM] CVE-2024-39884: A regression in the core of Apache HTTP Server 2
A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted. Users are recommended to upgrade to version 2.4.61, which fixes this issue.
GHSA
GHSA-5r34-776f-3434: A regression in the core of Apache HTTP Server 2
ghsa_unreviewed·2024-07-04
CVE-2024-39884 [MEDIUM] GHSA-5r34-776f-3434: A regression in the core of Apache HTTP Server 2
A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted.
Users are recommended to upgrade to version 2.4.61, which fixes this issue.
OSV
CVE-2024-39884: A regression in the core of Apache HTTP Server 2
osv·2024-07-04·CVSS 6.2
CVE-2024-39884 [MEDIUM] CVE-2024-39884: A regression in the core of Apache HTTP Server 2
A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted.
Users are recommended to upgrade to version 2.4.61, which fixes this issue.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-07-18
Published