Debian Bug report logs -
#1068412
apache2: CVE-2024-27316 CVE-2024-24795 CVE-2023-38709
Reply or subscribe to this bug.
Toggle useless messages
Report forwarded
to debian-bugs-dist@lists.debian.org, team@security.debian.org, Debian Apache Maintainers <debian-apache@lists.debian.org>:
Bug#1068412; Package src:apache2.
(Thu, 04 Apr 2024 18:54:04 GMT) (full text, mbox, link).
Acknowledgement sent
to Moritz Mühlenhoff <jmm@inutil.org>:
New Bug report received and forwarded. Copy sent to team@security.debian.org, Debian Apache Maintainers <debian-apache@lists.debian.org>.
(Thu, 04 Apr 2024 18:54:04 GMT) (full text, mbox, link).
Message #5 received at submit@bugs.debian.org (full text, mbox, reply):
Source: apache2
X-Debbugs-CC: team@security.debian.org
Severity: grave
Tags: security
Hi,
The following vulnerabilities were published for apache2.
CVE-2024-27316[0]:
https://www.kb.cert.org/vuls/id/421644
https://www.openwall.com/lists/oss-security/2024/04/04/4
CVE-2024-24795[1]:
https://www.openwall.com/lists/oss-security/2024/04/04/5
CVE-2023-38709[2]:
https://www.openwall.com/lists/oss-security/2024/04/04/3
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2024-27316
https://www.cve.org/CVERecord?id=CVE-2024-27316
[1] https://security-tracker.debian.org/tracker/CVE-2024-24795
https://www.cve.org/CVERecord?id=CVE-2024-24795
[2] https://security-tracker.debian.org/tracker/CVE-2023-38709
https://www.cve.org/CVERecord?id=CVE-2023-38709
Please adjust the affected versions in the BTS as needed.
Added tag(s) upstream.
Request was from Salvatore Bonaccorso <carnil@debian.org>
to control@bugs.debian.org.
(Thu, 04 Apr 2024 18:57:02 GMT) (full text, mbox, link).
Marked as found in versions apache2/2.4.58-1.
Request was from Salvatore Bonaccorso <carnil@debian.org>
to control@bugs.debian.org.
(Thu, 04 Apr 2024 18:57:04 GMT) (full text, mbox, link).
Information forwarded
to debian-bugs-dist@lists.debian.org, Debian Apache Maintainers <debian-apache@lists.debian.org>:
Bug#1068412; Package src:apache2.
(Fri, 05 Apr 2024 04:36:02 GMT) (full text, mbox, link).
Acknowledgement sent
to Yadd <yadd@debian.org>:
Extra info received and forwarded to list. Copy sent to Debian Apache Maintainers <debian-apache@lists.debian.org>.
(Fri, 05 Apr 2024 04:36:08 GMT) (full text, mbox, link).
Message #14 received at 1068412@bugs.debian.org (full text, mbox, reply):
[Message part 1 (text/plain, inline)]
On 4/4/24 22:51, Moritz Mühlenhoff wrote:
> Source: apache2
> X-Debbugs-CC: team@security.debian.org
> Severity: grave
> Tags: security
>
> Hi,
>
> The following vulnerabilities were published for apache2.
>
> CVE-2024-27316[0]:
> https://www.kb.cert.org/vuls/id/421644
> https://www.openwall.com/lists/oss-security/2024/04/04/4
>
> CVE-2024-24795[1]:
> https://www.openwall.com/lists/oss-security/2024/04/04/5
>
> CVE-2023-38709[2]:
> https://www.openwall.com/lists/oss-security/2024/04/04/3
>
> If you fix the vulnerabilities please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
>
> For further information see:
>
> [0] https://security-tracker.debian.org/tracker/CVE-2024-27316
> https://www.cve.org/CVERecord?id=CVE-2024-27316
> [1] https://security-tracker.debian.org/tracker/CVE-2024-24795
> https://www.cve.org/CVERecord?id=CVE-2024-24795
> [2] https://security-tracker.debian.org/tracker/CVE-2023-38709
> https://www.cve.org/CVERecord?id=CVE-2023-38709
>
> Please adjust the affected versions in the BTS as needed.
Hi,
I'm ready to push 2.4.59 into bookworm-security. Note that this includes
a test-framework update
Cheers,
Yadd
[apache2_2.4.59-1~deb12u1.debdiff (text/plain, attachment)]
[apache2_2.4.59-1~deb12u1.debian.debdiff (text/plain, attachment)]
Send a report that this bug log contains spam.
Debian bug tracking system administrator <owner@bugs.debian.org>.
Last modified:
Fri Apr 5 11:52:59 2024;
Machine Name:
bembo
Debian Bug tracking system
Debbugs is free software and licensed under the terms of the GNU
Public License version 2. The current version can be obtained
from https://bugs.debian.org/debbugs-source/.
Copyright © 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd,
1994-97 Ian Jackson,
2005-2017 Don Armstrong, and many other contributors.
Vulmon