CVE-2024-39884

A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted.

Users are recommended to upgrade to version 2.4.61, which fixes this issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.2 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
apacheCNA
---
---
CISA-ADPADP
6.2 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVEADP
---
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 31%
Debian logo
Debian Releases
Debian Product
Codename
apache2
bullseye
2.4.62-1~deb11u1
fixed
bookworm
2.4.62-1~deb12u2
not-affected
bullseye (security)
2.4.62-1~deb11u2
fixed
bookworm (security)
2.4.62-1~deb12u2
fixed
sid
2.4.63-1
fixed
trixie
2.4.63-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
apache2
plucky
Fixed 2.4.62-1ubuntu1
released
oracular
Fixed 2.4.62-1ubuntu1
released
noble
Fixed 2.4.58-1ubuntu8.2
released
mantic
Fixed 2.4.57-2ubuntu2.5
released
jammy
Fixed 2.4.52-1ubuntu4.10
released
focal
Fixed 2.4.41-4ubuntu3.19
released
bionic
needs-triage
xenial
needs-triage
trusty
needs-triage
References
http://www.openwall.com/lists/oss-security/2024/07/17/6
https://httpd.apache.org/security/vulnerabilities_24.html
https://security.netapp.com/advisory/ntap-20240712-0002/
http://www.openwall.com/lists/oss-security/2024/07/03/8
http://www.openwall.com/lists/oss-security/2024/07/17/6
https://httpd.apache.org/security/vulnerabilities_24.html
https://security.netapp.com/advisory/ntap-20240712-0002/