CVE-2024-40725

EUVD-2024-38590

18.07.2024, 10:15

A partial fix for  CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted.

Users are recommended to upgrade to version 2.4.62, which fixes this issue.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.3 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 96%

Affected Products (NVD)

Vendor	Product	Version
apache	http_server	2.4.60
apache	http_server	2.4.61

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

apache2

bookworm	2.4.65-1~deb12u1 fixed
bookworm (security)	2.4.62-1~deb12u2 fixed
bullseye	2.4.62-1~deb11u1 fixed
bullseye (security)	2.4.65-1~deb11u1 fixed
forky	2.4.65-3 fixed
sid	2.4.66-2 fixed
trixie	2.4.65-2 fixed

Ubuntu Releases

Ubuntu Product

Codename

apache2

bionic	needs-triage
focal	Fixed 2.4.41-4ubuntu3.21 released
jammy	Fixed 2.4.52-1ubuntu4.12 released
noble	Fixed 2.4.58-1ubuntu8.4 released
oracular	Fixed 2.4.62-1ubuntu1 released
plucky	Fixed 2.4.62-1ubuntu1 released
questing	Fixed 2.4.62-1ubuntu1 released
trusty	needs-triage
xenial	needs-triage

openSUSE / SLES Releases

openSUSE Product

Release

apache2

suse enterprise desktop 15 SP5	2.4.51-150400.6.37.1 fixed
suse enterprise desktop 15 SP6	2.4.58-150600.5.26.1 fixed
suse enterprise desktop 15 SP7	2.4.62-150700.2.2 fixed
suse enterprise sap 15 SP5	2.4.51-150400.6.37.1 fixed
suse enterprise sap 15 SP6	2.4.58-150600.5.26.1 fixed
suse enterprise sap 15 SP7	2.4.62-150700.2.2 fixed
suse enterprise server 12 SP3	2.4.23-29.123.1 fixed
suse enterprise server 12 SP5	2.4.51-35.63.1 fixed
suse enterprise server 15 SP2	2.4.51-150200.3.79.1 fixed
suse enterprise server 15 SP3	2.4.51-150200.3.79.1 fixed
suse enterprise server 15 SP4	2.4.51-150400.6.37.1 fixed
suse enterprise server 15 SP5	2.4.51-150400.6.37.1 fixed
suse enterprise server 15 SP6	2.4.58-150600.5.26.1 fixed
suse enterprise server 15 SP7	2.4.62-150700.2.2 fixed

apache2-devel

suse enterprise sap 15 SP5	2.4.51-150400.6.37.1 fixed
suse enterprise sap 15 SP6	2.4.58-150600.5.26.1 fixed
suse enterprise sap 15 SP7	2.4.62-150700.2.1 fixed
suse enterprise server 15 SP2	2.4.51-150200.3.79.1 fixed
suse enterprise server 15 SP3	2.4.51-150200.3.79.1 fixed
suse enterprise server 15 SP4	2.4.51-150400.6.37.1 fixed
suse enterprise server 15 SP5	2.4.51-150400.6.37.1 fixed
suse enterprise server 15 SP6	2.4.58-150600.5.26.1 fixed
suse enterprise server 15 SP7	2.4.62-150700.2.1 fixed

apache2-doc

suse enterprise sap 15 SP5	2.4.51-150400.6.37.1 fixed
suse enterprise sap 15 SP6	2.4.51-150400.6.37.1 fixed
suse enterprise sap 15 SP7	2.4.51-150400.6.37.1 fixed
suse enterprise server 12 SP3	2.4.23-29.123.1 fixed
suse enterprise server 12 SP5	2.4.51-35.63.1 fixed
suse enterprise server 15 SP2	2.4.51-150200.3.79.1 fixed
suse enterprise server 15 SP3	2.4.51-150200.3.79.1 fixed
suse enterprise server 15 SP4	2.4.51-150400.6.37.1 fixed
suse enterprise server 15 SP5	2.4.51-150400.6.37.1 fixed
suse enterprise server 15 SP6	2.4.51-150400.6.37.1 fixed
suse enterprise server 15 SP7	2.4.51-150400.6.37.1 fixed

apache2-example-pages

suse enterprise server 12 SP3	2.4.23-29.123.1 fixed
suse enterprise server 12 SP5	2.4.51-35.63.1 fixed

apache2-prefork

suse enterprise desktop 15 SP5	2.4.51-150400.6.37.1 fixed
suse enterprise desktop 15 SP6	2.4.58-150600.5.26.1 fixed
suse enterprise desktop 15 SP7	2.4.62-150700.2.4 fixed
suse enterprise sap 15 SP5	2.4.51-150400.6.37.1 fixed
suse enterprise sap 15 SP6	2.4.58-150600.5.26.1 fixed
suse enterprise sap 15 SP7	2.4.62-150700.2.4 fixed
suse enterprise server 12 SP3	2.4.23-29.123.1 fixed
suse enterprise server 12 SP5	2.4.51-35.63.1 fixed
suse enterprise server 15 SP2	2.4.51-150200.3.79.1 fixed
suse enterprise server 15 SP3	2.4.51-150200.3.79.1 fixed
suse enterprise server 15 SP4	2.4.51-150400.6.37.1 fixed
suse enterprise server 15 SP5	2.4.51-150400.6.37.1 fixed
suse enterprise server 15 SP6	2.4.58-150600.5.26.1 fixed
suse enterprise server 15 SP7	2.4.62-150700.2.4 fixed

apache2-tls13

suse enterprise server 12 SP5

2.4.51-35.63.1

fixed

apache2-tls13-doc

suse enterprise server 12 SP5

2.4.51-35.63.1

fixed

apache2-tls13-example-pages

suse enterprise server 12 SP5

2.4.51-35.63.1

fixed

apache2-tls13-prefork

suse enterprise server 12 SP5

2.4.51-35.63.1

fixed

apache2-tls13-utils

suse enterprise server 12 SP5

2.4.51-35.63.1

fixed

apache2-tls13-worker

suse enterprise server 12 SP5

2.4.51-35.63.1

fixed

apache2-utils

suse enterprise desktop 15 SP5	2.4.51-150400.6.37.1 fixed
suse enterprise sap 15 SP5	2.4.51-150400.6.37.1 fixed
suse enterprise sap 15 SP6	2.4.58-150600.5.26.1 fixed
suse enterprise sap 15 SP7	2.4.62-150700.2.4 fixed
suse enterprise server 12 SP3	2.4.23-29.123.1 fixed
suse enterprise server 12 SP5	2.4.51-35.63.1 fixed
suse enterprise server 15 SP2	2.4.51-150200.3.79.1 fixed
suse enterprise server 15 SP3	2.4.51-150200.3.79.1 fixed
suse enterprise server 15 SP4	2.4.51-150400.6.37.1 fixed
suse enterprise server 15 SP5	2.4.51-150400.6.37.1 fixed
suse enterprise server 15 SP6	2.4.58-150600.5.26.1 fixed
suse enterprise server 15 SP7	2.4.62-150700.2.4 fixed

apache2-worker

suse enterprise sap 15 SP5	2.4.51-150400.6.37.1 fixed
suse enterprise sap 15 SP6	2.4.58-150600.5.26.1 fixed
suse enterprise sap 15 SP7	2.4.62-150700.2.4 fixed
suse enterprise server 12 SP3	2.4.23-29.123.1 fixed
suse enterprise server 12 SP5	2.4.51-35.63.1 fixed
suse enterprise server 15 SP2	2.4.51-150200.3.79.1 fixed
suse enterprise server 15 SP3	2.4.51-150200.3.79.1 fixed
suse enterprise server 15 SP4	2.4.51-150400.6.37.1 fixed
suse enterprise server 15 SP5	2.4.51-150400.6.37.1 fixed
suse enterprise server 15 SP6	2.4.58-150600.5.26.1 fixed
suse enterprise server 15 SP7	2.4.62-150700.2.4 fixed

Common Weakness Enumeration

CWE-668 - Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

References

https://httpd.apache.org/security/vulnerabilities_24.html

https://security.netapp.com/advisory/ntap-20240808-0007/