# Cve apache 2.4.37

**URL:** <https://forums.rockylinux.org/t/cve-apache-2-4-37/16201>\
**Category:** Rocky Linux Help & Support\
**Tags:** rocky-linux-8\
**Created:** [October 14, 2024, 1:33pm UTC](https://forums.rockylinux.org/t/cve-apache-2-4-37/16201 "2024-10-14T13:33:07Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![tjara](https://avatars.discourse-cdn.com/v4/letter/t/df788c/32.png) [@tjara](https://forums.rockylinux.org/u/tjara)\
**Post date:** [October 14, 2024, 1:33pm UTC](https://forums.rockylinux.org/t/cve-apache-2-4-37/16201/1 "2024-10-14T13:33:07Z")

</div>

Hello, I currently have Apache 2.4.37 and I got the following CVEs:

Apache 2.4.x \< 2.4.41 Multiple Vulnerabilities:  
CVE-2019-10092: Denial of Service (DoS) issue.  
CVE-2019-10098: Vulnerability in mod\_rewrite.  
Apache 2.4.x \< 2.4.46 Multiple Vulnerabilities:  
CVE-2020-9490: Denial of Service issue related to header processing.  
CVE-2020-11993: Issue in handling HTTP/2 requests.  
Apache 2.4.x \< 2.4.52 Forward Proxy DoS / SSRF:  
CVE-2021-44224: Issue related to SSRF in proxy configuration.  
Apache 2.4.x \< 2.4.53 Multiple Vulnerabilities:  
CVE-2022-22721: Security flaw in mod\_sed.  
CVE-2022-23943: Authentication and authorization vulnerability.  
Apache 2.4.x \< 2.4.58 Out-of-Bounds Read (CVE-2023-31122):  
CVE-2023-31122: Out-of-bounds read, which may allow denial of service attacks or information disclosure.  
OpenSSL 1.1.1 \< 1.1.1l Multiple Vulnerabilities:  
CVE-2021-3449: Denial of service issue.  
CVE-2021-3450: Certificate verification error.

Do you know if the CVEs mentioned are addressed in the version of Apache that I have?

---

<div class="post-metadata">

**Author:** ![jlehtone](https://avatars.discourse-cdn.com/v4/letter/j/e9a140/32.png) [@jlehtone](https://forums.rockylinux.org/u/jlehtone)\
**Post date:** [October 14, 2024, 1:40pm UTC](https://forums.rockylinux.org/t/cve-apache-2-4-37/16201/2 "2024-10-14T13:40:58Z")

</div>

You don’t have “Apache 2.4.37”. You have – if you do have Rocky 8’s httpd package – the RHEL 8’s fork of httpd, originally based on upstream 2.4.37.  
It has _backports_. See [What is backporting and how does it affect Red Hat Enterprise Linux? - Red Hat Customer Portal](https://access.redhat.com/solutions/57665)

You can run `rpm -q --changelog httpd` and read what CVE are mentioned.

---

<div class="post-metadata">

**Author:** ![tjara](https://avatars.discourse-cdn.com/v4/letter/t/df788c/32.png) [@tjara](https://forums.rockylinux.org/u/tjara)\
**Post date:** [October 14, 2024, 2:13pm UTC](https://forums.rockylinux.org/t/cve-apache-2-4-37/16201/3 "2024-10-14T14:13:20Z")

</div>

So, would you understand that the CVEs mentioned would be resolved?

---

<div class="post-metadata">

**Author:** ![sspencerwire](https://avatars.discourse-cdn.com/v4/letter/s/c2a13f/32.png) [@sspencerwire](https://forums.rockylinux.org/u/sspencerwire)\
**Post date:** [October 14, 2024, 3:04pm UTC](https://forums.rockylinux.org/t/cve-apache-2-4-37/16201/4 "2024-10-14T15:04:45Z")

</div>

Run the command @jlehtone mentioned and grep for the CVE’s your are looking for. Example:

```auto
rpm -q --changelog httpd| grep CVE-2019-10098
- Resolves: #1747284 - CVE-2019-10098 httpd:2.4/httpd: mod_rewrite potential

```