Apache HTTP Server: Mehrere Schwachstellen
WID-SEC-2024-1504 · first 02.07.2024 · updated 23.10.2026 · CVSS 8,2
What it is about
Apache ist ein Webserver für verschiedene Plattformen. Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apache HTTP Server ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Sicherheitsmaßnahmen zu umgehen oder vertrauliche Informationen offenzulegen.
Under what conditions?
Over the network and without logging in. This is the most dangerous combination: attackers can scan reachable devices automatically.
What can happen in the worst case
An attacker could use the vulnerability to
- beliebigen Code auszuführen
- einen Denial-of-Service-Zustand herbeizuführen
- Sicherheitsmaßnahmen zu umgehen oder vertrauliche Informationen offenzulegen
Am I affected?
Affected according to the BSI:
- Debian Linux
- IBM Tivoli Monitoring 6.3.0.7
- Amazon Linux 2
- IBM Power Hardware Management Console
- Red Hat Enterprise Linux
- Fedora Linux
- Ubuntu Linux
- F5 BIG-IP
- SUSE Linux
- IBM HTTP Server 8.5
- Oracle Linux
- IBM HTTP Server 9.0
and 34 more
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Apache HTTP Server 2.4.60
- Dell PowerScale OneFS OneFS 9.8.0.1
- Dell NetWorker 19.10.0.5
- IBM Rational Build Forge 8.0.0.27
- Dell PowerScale OneFS OneFS 9.4.0.20
- Dell PowerScale OneFS OneFS 9.5.1.1
- Dell PowerScale OneFS OneFS 9.7.1.3
- Dell PowerScale OneFS OneFS 9.9.0.1
- SonicWall SMA 10.2.1.14-75sv
- Xerox FreeFlow Print Server 9.0 SP-3 (93.M3.14.86)
- Dell ECS 3.8.1.3
- HPE HP-UX 11.31
Is the vulnerability already being exploited?
- CVE-2024-38475: exploited in the wild according to CISA, in the catalogue since 01.05.2025.
Information and sources
- Original BSI advisory (WID)
- Dell Security Advisory DSA-2024-483 vom 2024-12-18 www.dell.com
- XEROX Security Advisory XRX24-019 vom 2024-12-17 security.business.xerox.com
- XEROX Security Advisory XRX25-001 vom 2025-01-13 securitydocs.business.xerox.com
- Apache Advisory vom 2024-07-01 httpd.apache.org
- Red Hat Bugzilla vom 2024-07-01 bugzilla.redhat.com
- Red Hat Bugzilla vom 2024-07-01 bugzilla.redhat.com
- Red Hat Bugzilla vom 2024-07-01 bugzilla.redhat.com
- Red Hat Bugzilla vom 2024-07-01 bugzilla.redhat.com
- Red Hat Bugzilla vom 2024-07-01 bugzilla.redhat.com
- Red Hat Bugzilla vom 2024-07-01 bugzilla.redhat.com
- Red Hat Bugzilla vom 2024-07-01 bugzilla.redhat.com
- Apache HTTP Server seclists.org
- Rocky Linux Security Advisory RLSA-2024:4197 vom 2024-07-02 errata.build.resf.org
- Fedora Security Advisory FEDORA-2024-39F1A828ED vom 2024-07-03 bodhi.fedoraproject.org
- Fedora Security Advisory FEDORA-2024-E7E73BEFAD vom 2024-07-03 bodhi.fedoraproject.org
- Ubuntu Security Notice USN-6885-1 vom 2024-07-08 ubuntu.com
- IBM Security Bulletin 7159849 vom 2024-07-09 www.ibm.com
- Fedora Security Advisory FEDORA-2024-661BB6322D vom 2024-07-11 bodhi.fedoraproject.org
- Fedora Security Advisory FEDORA-2024-CB8ACBF644 vom 2024-07-11 bodhi.fedoraproject.org
- IBM Security Bulletin 7160019 vom 2024-07-11 www.ibm.com
- SUSE Security Update SUSE-SU-2024:2405-1 vom 2024-07-11 lists.suse.com
- Debian Security Advisory DSA-5729 vom 2024-07-12 lists.debian.org
- Ubuntu Security Notice USN-6885-2 vom 2024-07-11 ubuntu.com
- SUSE Security Update SUSE-SU-2024:2560-1 vom 2024-07-18 lists.suse.com
- Amazon Linux Security Advisory ALAS-2024-2594 vom 2024-07-23 alas.aws.amazon.com
and 105 more sources in the original advisory
CVE: CVE-2023-38709, CVE-2024-36387, CVE-2024-38472, CVE-2024-38473, CVE-2024-38474, CVE-2024-38475, CVE-2024-38476, CVE-2024-38477, CVE-2024-39573
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.