[USN-6885-2] Apache HTTP Server regression

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAmaQRHEACgkQZWnYVadE
vpM2wQ/8CmR0S5jMY1oz2zsLEkBh293bim5So3QXmkGWDueDLi4QSnYa2UPdr26C
/SAud/ph8f4kblEEDHqjDE+43Wl9NmvBNve5I6urtTNiEoXxGz04lg25HxsKwKMt
tDQccPA7R7B93d+YwJLSOB4J7iwMx9P+udY88qVFggoOx1iTgweIMUtF27PJUx9F
1PsxnnRewliCpjZb4pAT2K0j8OL6xudkFXU2VsZKYAYSkQsaKnjRkWGzagZsdH/U
YoTpC5HMXkxHcPnHaIuOfK13MEfJUeAaGMVAEU7GNcPlfPOd/Zfh91ZfzkDiTFzw
9Uq2OPKmLHuuEq+l8V6JfXRUDl3EW23jZhRUfwFsu8QayjIAaOtPrzX+Lxc/e9y8
hh8HvrAThFCHP5usx9/JmoZP5e2cXz2PxFdNQnG5L2v98uk/PhMa7DPtFcATduG6
s3vpivT5BH5Q/Kjuo+6p80OcZqA9FDMhBRYnNZ2765B+1c1ZmRGWZD7fDwCU5fT4
6gM2lzFVJaMFTd3V63FiW80i4wicRNpPBkaROoHKScnVnItLcQPuSCIW5XDBtd71
urPD7VyPvgU4REf+7/nTVHQV+gWE5Xnx1WEBwupBBpliUjpfGOFUMjk/V3VW4jVh
1fAPMmjNit6XVSf6ETZJy9TPWKHJnhy8A4JQDg+V8h+dwG6Wsg8=
=ESTG
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6885-2
July 11, 2024

apache2 regression
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

USN-6885-1 introduced a regression in Apache HTTP Server.

Software Description:
- apache2: Apache HTTP server

Details:

USN-6885-1 fixed vulnerabilities in Apache HTTP Server. One of the security
fixes introduced a regression when proxying requests to a HTTP/2 server.
This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

Marc Stern discovered that the Apache HTTP Server incorrectly handled
serving WebSocket protocol upgrades over HTTP/2 connections. A remote
attacker could possibly use this issue to cause the server to crash,
resulting in a denial of service. (CVE-2024-36387)
Orange Tsai discovered that the Apache HTTP Server mod_proxy module
incorrectly sent certain request URLs with incorrect encodings to backends.
A remote attacker could possibly use this issue to bypass authentication.
(CVE-2024-38473)
Orange Tsai discovered that the Apache HTTP Server mod_rewrite module
incorrectly handled certain substitutions. A remote attacker could possibly
use this issue to execute scripts in directories not directly reachable
by any URL, or cause a denial of service. Some environments may require
using the new UnsafeAllow3F flag to handle unsafe substitutions.
(CVE-2024-38474, CVE-2024-38475, CVE-2024-39573)
Orange Tsai discovered that the Apache HTTP Server incorrectly handled
certain response headers. A remote attacker could possibly use this issue
to obtain sensitive information, execute local scripts, or perform SSRF
attacks. (CVE-2024-38476)
Orange Tsai discovered that the Apache HTTP Server mod_proxy module
incorrectly handled certain requests. A remote attacker could possibly use
this issue to cause the server to crash, resulting in a denial of service.
(CVE-2024-38477)
It was discovered that the Apache HTTP Server incorrectly handled certain
handlers configured via AddType. A remote attacker could possibly use this
issue to obtain source code. (CVE-2024-39884)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
apache2 2.4.58-1ubuntu8.3

Ubuntu 22.04 LTS
apache2 2.4.52-1ubuntu4.11

Ubuntu 20.04 LTS
apache2 2.4.41-4ubuntu3.20

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6885-2
https://ubuntu.com/security/notices/USN-6885-1
https://launchpad.net/bugs/2072648

Package Information:
https://launchpad.net/ubuntu/+source/apache2/2.4.58-1ubuntu8.3
https://launchpad.net/ubuntu/+source/apache2/2.4.52-1ubuntu4.11
https://launchpad.net/ubuntu/+source/apache2/2.4.41-4ubuntu3.20