The solution is thus to update the mod_http2 – if you do use it – and use the mitigations mentioned in the RHSAs (if necessary) until Red Hat (and then Rocky) releases fixes for the other two CVE.
Hello,
Thank you for the clarification, and I’d like to take this opportunity to ask for some help if possible. I’m facing a similar situation after a black box cyber assessment. The following CVEs were reported. If you have any suggestions, I would greatly appreciate it.
@suraydan you can use dnf commands grepping the changelog for the CVE’s:
root@rocky9:~# dnf changelog httpd | egrep "36387|38472|38473|39474|38475|38476|38477|39573"
response headers are malicious or exploitable (CVE-2024-38476)
mod_proxy (CVE-2024-38473)
mod_proxy (CVE-2024-38477)
- Resolves: RHEL-45749 - httpd: Potential SSRF in mod_rewrite (CVE-2024-39573)
mod_rewrite (CVE-2024-38475)
as an example just picking parts of the CVE’s you listed above and you can see that it shows that some of them have been fixed. Otherwise, you can simply google the CVE number and RHEL9 and see what RHEL have done in relation to fixing it or whether RHEL have checked and found no problem for that particular CVE.
In fact, even googling CVE-2024-38474 it was enough to find this RHEL article which answers your question: https://access.redhat.com/solutions/7078219 which I’m guessing you didn’t do this since you asked here.
Thank you again for your quick response and help. I will follow your guidance. Great work, and congratulations on the help you’ve been providing on the forum.