Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 935427 (CVE-2024-39884) - =www-servers/apache-2.4.60: source code disclosure with handlers configured via AddType
Summary: =www-servers/apache-2.4.60: source code disclosure with handlers configured v...
Status: CONFIRMED
Alias: CVE-2024-39884
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B3 [cleanup glsa?]
Keywords:
Depends on: 936295
Blocks:
  Show dependency tree
 
Reported: 2024-07-03 19:30 UTC by Hans de Graaff
Modified: 2024-07-20 05:54 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Hans de Graaff gentoo-dev Security 2024-07-03 19:30:48 UTC 
A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted.

Users are recommended to upgrade to version 2.4.61, which fixes this issue.