A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes (/), directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects of the servers processing will implicitly collapse them.
The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Http_server | Apache | 2.4.0 (including) | 2.4.38 (including) |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-apr-0:1.6.3-73.jbcs.el6 | * |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-apr-util-0:1.6.1-54.jbcs.el6 | * |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-brotli-0:1.0.6-9.jbcs.el6 | * |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-curl-0:7.64.1-21.jbcs.el6 | * |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-httpd-0:2.4.37-41.jbcs.el6 | * |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-jansson-0:2.11-24.jbcs.el6 | * |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-mod_cluster-native-0:1.3.12-13.Final_redhat_2.jbcs.el6 | * |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-mod_http2-0:1.11.3-8.jbcs.el6 | * |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-mod_jk-0:1.2.46-26.redhat_1.jbcs.el6 | * |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-mod_md-1:2.0.8-10.jbcs.el6 | * |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-mod_security-0:2.9.2-20.GA.jbcs.el6 | * |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-nghttp2-0:1.39.2-10.jbcs.el6 | * |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-openssl-1:1.1.1c-4.jbcs.el6 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-apr-0:1.6.3-73.jbcs.el7 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-apr-util-0:1.6.1-54.jbcs.el7 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-brotli-0:1.0.6-9.jbcs.el7 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-curl-0:7.64.1-21.jbcs.el7 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-httpd-0:2.4.37-41.jbcs.el7 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-jansson-0:2.11-24.jbcs.el7 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-mod_cluster-native-0:1.3.12-13.Final_redhat_2.jbcs.el7 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-mod_http2-0:1.11.3-8.jbcs.el7 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-mod_jk-0:1.2.46-26.redhat_1.jbcs.el7 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-mod_md-1:2.0.8-10.jbcs.el7 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-mod_security-0:2.9.2-20.GA.jbcs.el7 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-nghttp2-0:1.39.2-10.jbcs.el7 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-openssl-1:1.1.1c-4.jbcs.el7 | * |
| Red Hat Enterprise Linux 7 | RedHat | httpd-0:2.4.6-90.el7 | * |
| Red Hat Enterprise Linux 8 | RedHat | httpd:2.4-8010020190829143335.cdc1202b | * |
| Red Hat JBoss Core Services 1 | RedHat | httpd | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 6 | RedHat | httpd24-0:1.1-19.el6 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 6 | RedHat | httpd24-httpd-0:2.4.34-15.el6 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 6 | RedHat | httpd24-nghttp2-0:1.7.1-8.el6 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | httpd24-0:1.1-19.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | httpd24-httpd-0:2.4.34-15.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | httpd24-nghttp2-0:1.7.1-8.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS | RedHat | httpd24-0:1.1-19.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS | RedHat | httpd24-httpd-0:2.4.34-15.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS | RedHat | httpd24-nghttp2-0:1.7.1-8.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS | RedHat | httpd24-0:1.1-19.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS | RedHat | httpd24-httpd-0:2.4.34-15.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS | RedHat | httpd24-nghttp2-0:1.7.1-8.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | RedHat | httpd24-0:1.1-19.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | RedHat | httpd24-httpd-0:2.4.34-15.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | RedHat | httpd24-nghttp2-0:1.7.1-8.el7 | * |
| Apache2 | Ubuntu | bionic | * |
| Apache2 | Ubuntu | cosmic | * |
| Apache2 | Ubuntu | devel | * |
| Apache2 | Ubuntu | disco | * |
| Apache2 | Ubuntu | eoan | * |
| Apache2 | Ubuntu | focal | * |
| Apache2 | Ubuntu | groovy | * |
| Apache2 | Ubuntu | hirsute | * |
| Apache2 | Ubuntu | precise/esm | * |
| Apache2 | Ubuntu | trusty | * |
| Apache2 | Ubuntu | xenial | * |