[CLSA-2025:1760711358] Fix CVE(s): CVE-2024-38474, CVE-2024-38475
Type:
security
Severity:
Critical
Release date:
2025-10-20 14:02:40 UTC
Description:
* SECURITY UPDATE: mod_rewrite proxy handler substitution and prefix_stat vulnerabilities - debian/patches/CVE-2024-38474-38475-*.patch: tighten up prefix_stat and %3f handling, add better question mark tracking to avoid UnsafeAllow3F - CVE-2024-38474, CVE-2024-38475
Updated packages:
  • apache2_2.4.59-1~deb10u1+tuxcare.els2_amd64.deb
    sha:9c7a74a194ea840337212f7eb84fa4e05f2c80f7
  • apache2-bin_2.4.59-1~deb10u1+tuxcare.els2_amd64.deb
    sha:e84170b194839906fd30dd456ecc7839e160137b
  • apache2-data_2.4.59-1~deb10u1+tuxcare.els2_all.deb
    sha:2f7a5595bb54c1849dd6d158d73000002ff51db5
  • apache2-dev_2.4.59-1~deb10u1+tuxcare.els2_amd64.deb
    sha:8359ab8a5ec9254275a3235f1212e6673e719e5b
  • apache2-doc_2.4.59-1~deb10u1+tuxcare.els2_all.deb
    sha:8cfcde608a7b65f3afe6abe2738ea2e59438c3a4
  • apache2-ssl-dev_2.4.59-1~deb10u1+tuxcare.els2_amd64.deb
    sha:9633ac21eecf085ade3dc9bd9e9e92292d9a95f9
  • apache2-suexec-custom_2.4.59-1~deb10u1+tuxcare.els2_amd64.deb
    sha:91195402df7d51c926d99677eec1c8bff9ad5014
  • apache2-suexec-pristine_2.4.59-1~deb10u1+tuxcare.els2_amd64.deb
    sha:572c412ec85fa1131163bffc3424e08458fbf745
  • apache2-utils_2.4.59-1~deb10u1+tuxcare.els2_amd64.deb
    sha:c41bd92bcc8d261a7ae086bcc996ab16ca12b79a
  • libapache2-mod-md_2.4.59-1~deb10u1+tuxcare.els2_amd64.deb
    sha:3f180ea79f44acfd5ad1dc7ac3c5bec7b76fc686
  • libapache2-mod-proxy-uwsgi_2.4.59-1~deb10u1+tuxcare.els2_amd64.deb
    sha:9c10a74aaf1a7a86edf725d8176156382df6ff4d
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.