PH61893: IBM HTTP Server is vulnerable to multiple vulnerabilities due to the included Apache HTTP Server

Download Description

• CVE-2024-38472
  • Vulnerable Configurations: IHS on Windows
• CVE-2024-38473, CVE-2024-38477
  • Vulnerable Configurations: IHS 9.0 with mod_proxy loaded
• CVE-2024-38474, CVE-2024-38475
  • Vulnerable Configurations: IHS with mod_rewrite loaded.
    See https://httpd.apache.org/security/vulnerabilities_24.html for mod_rewrite specifics.
• CVE-2024-38476
  • Vulnerable Configurations:  IHS with mod_negotiation or CGI modules loaded
• CVE-2024-39573
  • Vulnerable: IHS with both mod_rewrite and mod_proxy loaded
    See https://httpd.apache.org/security/vulnerabilities_24.html for mod_rewrite specifics.

• If non-malicious URL's use encoded question marks (%3F), some RewriteRules that add a "?" to the substitution will return 403 unless the flag UnsafeAllow3F is added.
• If a mod_rewrite substitution begins with a variable or back-reference, and has no PT flag, and the first path segment matches a directory at the root of the filesystem, the substitution will no longer map the URL to that directory unless the flag UnsafePrefixStat is added.