CVE-2024-39884
apache2: A regression in the core of Apache HTTP Server 2.4.60 ignores some use ofthe legacy content-type based configuration...
CVE-2024-39884 is fixed in 33 products on 1 platform, first by apache2 2.4.41-4ubuntu3.19, released July 3, 2024. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
6.2
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0089
59th percentile
A regression in the core of Apache HTTP Server 2.4.60 ignores some use ofthe legacy content-type based configuration of handlers. "AddType" andsimilar configuration, under some circumstances where files are requestedindirectly, result in source code disclosure of local content. For example,PHP scripts may be served instead of interpreted.Users are recommended to upgrade to version 2.4.61, which fixes this issue.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| apache2 · Debian 13.5 (trixie) | 2.4.61-1 | DEBIAN-CVE-2024-39884 | Jul 4, 2024 |
| apache2 · Debian 14 | 2.4.61-1 | DEBIAN-CVE-2024-39884 | Jul 4, 2024 |
| apache2 · Ubuntu 20.04 LTS (focal) | 2.4.41-4ubuntu3.19 | apache2 2.4.41-4ubuntu3.19 | Jul 3, 2024 |
| apache2 · Ubuntu 22.04.1 LTS (jammy) | 2.4.52-1ubuntu4.10 | apache2 2.4.52-1ubuntu4.10 | Jul 3, 2024 |
| apache2 · Ubuntu 24.04.5 LTS (noble) | 2.4.58-1ubuntu8.2 | apache2 2.4.58-1ubuntu8.2 | Jul 3, 2024 |
| apache2 · Ubuntu 24.10 (oracular) | 2.4.62-1ubuntu1 | apache2 2.4.62-1ubuntu1 | Jul 17, 2024 |
| apache2 · Ubuntu 25.04 (plucky) | 2.4.62-1ubuntu1 | apache2 2.4.62-1ubuntu1 | Jul 17, 2024 |
| apache2 · opensuse-leap 15.6 | 2.4.58-150600.5.23.1 | SUSE-SU-2024:3172-1 | Sep 9, 2024 |
| apache2 · sles 15.6 | 2.4.51-150400.6.34.1 | SUSE-SU-2024:3173-1 | Sep 9, 2024 |
| apache2-bin · Ubuntu 20.04 LTS (focal) | 2.4.41-4ubuntu3.19 | apache2-bin 2.4.41-4ubuntu3.19 | Jul 3, 2024 |
| apache2-bin · Ubuntu 22.04.1 LTS (jammy) | 2.4.52-1ubuntu4.10 | apache2-bin 2.4.52-1ubuntu4.10 | Jul 3, 2024 |
| apache2-bin · Ubuntu 24.04.5 LTS (noble) | 2.4.58-1ubuntu8.2 | apache2-bin 2.4.58-1ubuntu8.2 | Jul 3, 2024 |
| apache2-bin · Ubuntu 24.10 (oracular) | 2.4.62-1ubuntu1 | apache2-bin 2.4.62-1ubuntu1 | Jul 17, 2024 |
| apache2-bin · Ubuntu 25.04 (plucky) | 2.4.62-1ubuntu1 | apache2-bin 2.4.62-1ubuntu1 | Jul 17, 2024 |
| apache2-data · Ubuntu 20.04 LTS (focal) | 2.4.41-4ubuntu3.19 | apache2-data 2.4.41-4ubuntu3.19 | Jul 3, 2024 |
| apache2-data · Ubuntu 22.04.1 LTS (jammy) | 2.4.52-1ubuntu4.10 | apache2-data 2.4.52-1ubuntu4.10 | Jul 3, 2024 |
| apache2-data · Ubuntu 24.04.5 LTS (noble) | 2.4.58-1ubuntu8.2 | apache2-data 2.4.58-1ubuntu8.2 | Jul 3, 2024 |
| apache2-data · Ubuntu 24.10 (oracular) | 2.4.62-1ubuntu1 | apache2-data 2.4.62-1ubuntu1 | Jul 17, 2024 |
| apache2-data · Ubuntu 25.04 (plucky) | 2.4.62-1ubuntu1 | apache2-data 2.4.62-1ubuntu1 | Jul 17, 2024 |
| apache2-devel · opensuse-leap 15.6 | 2.4.58-150600.5.23.1 | SUSE-SU-2024:3172-1 | Sep 9, 2024 |
| apache2-devel · sles 15.6 | 2.4.58-150600.5.23.1 | SUSE-SU-2024:3172-1 | Sep 9, 2024 |
| apache2-event · opensuse-leap 15.6 | 2.4.58-150600.5.23.1 | SUSE-SU-2024:3172-1 | Sep 9, 2024 |
| apache2-event · sles 15.6 | 2.4.58-150600.5.23.1 | SUSE-SU-2024:3172-1 | Sep 9, 2024 |
| apache2-manual · opensuse-leap 15.6 | 2.4.58-150600.5.23.1 | SUSE-SU-2024:3172-1 | Sep 9, 2024 |
| apache2-prefork · opensuse-leap 15.6 | 2.4.58-150600.5.23.1 | SUSE-SU-2024:3172-1 | Sep 9, 2024 |
| apache2-prefork · sles 15.6 | 2.4.58-150600.5.23.1 | SUSE-SU-2024:3172-1 | Sep 9, 2024 |
| apache2-suexec-custom · Ubuntu 20.04 LTS (focal) | 2.4.41-4ubuntu3.19 | apache2-suexec-custom 2.4.41-4ubuntu3.19 | Jul 3, 2024 |
| apache2-suexec-custom · Ubuntu 22.04.1 LTS (jammy) | 2.4.52-1ubuntu4.10 | apache2-suexec-custom 2.4.52-1ubuntu4.10 | Jul 3, 2024 |
| apache2-suexec-custom · Ubuntu 24.04.5 LTS (noble) | 2.4.58-1ubuntu8.2 | apache2-suexec-custom 2.4.58-1ubuntu8.2 | Jul 3, 2024 |
| apache2-suexec-custom · Ubuntu 24.10 (oracular) | 2.4.62-1ubuntu1 | apache2-suexec-custom 2.4.62-1ubuntu1 | Jul 17, 2024 |
| apache2-suexec-custom · Ubuntu 25.04 (plucky) | 2.4.62-1ubuntu1 | apache2-suexec-custom 2.4.62-1ubuntu1 | Jul 17, 2024 |
| apache2-suexec-pristine · Ubuntu 20.04 LTS (focal) | 2.4.41-4ubuntu3.19 | apache2-suexec-pristine 2.4.41-4ubuntu3.19 | Jul 3, 2024 |
| apache2-suexec-pristine · Ubuntu 22.04.1 LTS (jammy) | 2.4.52-1ubuntu4.10 | apache2-suexec-pristine 2.4.52-1ubuntu4.10 | Jul 3, 2024 |
| apache2-suexec-pristine · Ubuntu 24.04.5 LTS (noble) | 2.4.58-1ubuntu8.2 | apache2-suexec-pristine 2.4.58-1ubuntu8.2 | Jul 3, 2024 |
| apache2-suexec-pristine · Ubuntu 24.10 (oracular) | 2.4.62-1ubuntu1 | apache2-suexec-pristine 2.4.62-1ubuntu1 | Jul 17, 2024 |
| apache2-suexec-pristine · Ubuntu 25.04 (plucky) | 2.4.62-1ubuntu1 | apache2-suexec-pristine 2.4.62-1ubuntu1 | Jul 17, 2024 |
| apache2-utils · Ubuntu 20.04 LTS (focal) | 2.4.41-4ubuntu3.19 | apache2-utils 2.4.41-4ubuntu3.19 | Jul 3, 2024 |
| apache2-utils · Ubuntu 22.04.1 LTS (jammy) | 2.4.52-1ubuntu4.10 | apache2-utils 2.4.52-1ubuntu4.10 | Jul 3, 2024 |
| apache2-utils · Ubuntu 24.04.5 LTS (noble) | 2.4.58-1ubuntu8.2 | apache2-utils 2.4.58-1ubuntu8.2 | Jul 3, 2024 |
| apache2-utils · Ubuntu 24.10 (oracular) | 2.4.62-1ubuntu1 | apache2-utils 2.4.62-1ubuntu1 | Jul 17, 2024 |
| apache2-utils · Ubuntu 25.04 (plucky) | 2.4.62-1ubuntu1 | apache2-utils 2.4.62-1ubuntu1 | Jul 17, 2024 |
| apache2-utils · opensuse-leap 15.6 | 2.4.58-150600.5.23.1 | SUSE-SU-2024:3172-1 | Sep 9, 2024 |
| apache2-utils · sles 15.6 | 2.4.58-150600.5.23.1 | SUSE-SU-2024:3172-1 | Sep 9, 2024 |
| apache2-worker · opensuse-leap 15.6 | 2.4.58-150600.5.23.1 | SUSE-SU-2024:3172-1 | Sep 9, 2024 |
| apache2-worker · sles 15.6 | 2.4.58-150600.5.23.1 | SUSE-SU-2024:3172-1 | Sep 9, 2024 |
| httpd · amzn 2023 | 2.4.61-1.amzn2023 | ALAS2023-2024-656 | Jul 18, 2024 |
| httpd-core · amzn 2023 | 2.4.61-1.amzn2023 | ALAS2023-2024-656 | Jul 18, 2024 |
| httpd-core-debuginfo · amzn 2023 | 2.4.61-1.amzn2023 | ALAS2023-2024-656 | Jul 18, 2024 |
| httpd-debuginfo · amzn 2023 | 2.4.61-1.amzn2023 | ALAS2023-2024-656 | Jul 18, 2024 |
| httpd-debugsource · amzn 2023 | 2.4.61-1.amzn2023 | ALAS2023-2024-656 | Jul 18, 2024 |
| httpd-devel · amzn 2023 | 2.4.61-1.amzn2023 | ALAS2023-2024-656 | Jul 18, 2024 |
| httpd-filesystem · amzn 2023 | 2.4.61-1.amzn2023 | ALAS2023-2024-656 | Jul 18, 2024 |
| httpd-manual · amzn 2023 | 2.4.61-1.amzn2023 | ALAS2023-2024-656 | Jul 18, 2024 |
| httpd-tools · amzn 2023 | 2.4.61-1.amzn2023 | ALAS2023-2024-656 | Jul 18, 2024 |
| httpd-tools-debuginfo · amzn 2023 | 2.4.61-1.amzn2023 | ALAS2023-2024-656 | Jul 18, 2024 |
| libapache2-mod-md · Ubuntu 20.04 LTS (focal) | 2.4.41-4ubuntu3.19 | libapache2-mod-md 2.4.41-4ubuntu3.19 | Jul 3, 2024 |
| libapache2-mod-md · Ubuntu 22.04.1 LTS (jammy) | 2.4.52-1ubuntu4.10 | libapache2-mod-md 2.4.52-1ubuntu4.10 | Jul 3, 2024 |
| libapache2-mod-md · Ubuntu 24.04.5 LTS (noble) | 2.4.58-1ubuntu8.2 | libapache2-mod-md 2.4.58-1ubuntu8.2 | Jul 3, 2024 |
| libapache2-mod-proxy-uwsgi · Ubuntu 20.04 LTS (focal) | 2.4.41-4ubuntu3.19 | libapache2-mod-proxy-uwsgi 2.4.41-4ubuntu3.19 | Jul 3, 2024 |
| libapache2-mod-proxy-uwsgi · Ubuntu 22.04.1 LTS (jammy) | 2.4.52-1ubuntu4.10 | libapache2-mod-proxy-uwsgi 2.4.52-1ubuntu4.10 | Jul 3, 2024 |
| libapache2-mod-proxy-uwsgi · Ubuntu 24.04.5 LTS (noble) | 2.4.58-1ubuntu8.2 | libapache2-mod-proxy-uwsgi 2.4.58-1ubuntu8.2 | Jul 3, 2024 |
| mod_ldap · amzn 2023 | 2.4.61-1.amzn2023 | ALAS2023-2024-656 | Jul 18, 2024 |
| mod_ldap-debuginfo · amzn 2023 | 2.4.61-1.amzn2023 | ALAS2023-2024-656 | Jul 18, 2024 |
| mod_lua · amzn 2023 | 2.4.61-1.amzn2023 | ALAS2023-2024-656 | Jul 18, 2024 |
| mod_lua-debuginfo · amzn 2023 | 2.4.61-1.amzn2023 | ALAS2023-2024-656 | Jul 18, 2024 |
| mod_proxy_html · amzn 2023 | 1:2.4.61-1.amzn2023 | ALAS2023-2024-656 | Jul 18, 2024 |
| mod_proxy_html-debuginfo · amzn 2023 | 1:2.4.61-1.amzn2023 | ALAS2023-2024-656 | Jul 18, 2024 |
| mod_session · amzn 2023 | 2.4.61-1.amzn2023 | ALAS2023-2024-656 | Jul 18, 2024 |
| mod_session-debuginfo · amzn 2023 | 2.4.61-1.amzn2023 | ALAS2023-2024-656 | Jul 18, 2024 |
| mod_ssl · amzn 2023 | 1:2.4.61-1.amzn2023 | ALAS2023-2024-656 | Jul 18, 2024 |
| mod_ssl-debuginfo · amzn 2023 | 1:2.4.61-1.amzn2023 | ALAS2023-2024-656 | Jul 18, 2024 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.