CVE-2024-38474
Publication date 1 July 2024
Last updated 13 August 2025
Ubuntu priority
Description
Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI. Users are recommended to upgrade to version 2.4.60, which fixes this issue. Some RewriteRules that capture and substitute unsafely will now fail unless rewrite flag "UnsafeAllow3F" is specified.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| apache2 | ||
| 24.04 LTS noble |
Fixed in 2.4.58-1ubuntu8.8
|
|
| 22.04 LTS jammy |
Fixed in 2.4.52-1ubuntu4.16
|
|
| 20.04 LTS focal |
Fixed in 2.4.41-4ubuntu3.23
|
|
| 18.04 LTS bionic |
Fixed in 2.4.29-1ubuntu4.27+esm4
|
|
| 16.04 LTS xenial |
Fixed in 2.4.18-2ubuntu3.17+esm14
|
|
| 14.04 LTS trusty |
Fixed in 2.4.7-1ubuntu4.22+esm10
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialPatch details
| Package | Patch details |
|---|---|
| apache2 |
|
Severity score breakdown
CVSS version: CVSS v3.0
Base score
8.1 · High
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
References
Related Ubuntu Security Notices (USN)
- USN-6885-1
- Apache HTTP Server vulnerabilities
- 8 July 2024
- USN-6885-3
- Apache HTTP Server vulnerabilities
- 18 September 2024
- USN-6885-5
- Apache HTTP Server vulnerabilities
- 21 July 2025