USN-6885-4
apache2 regression
USN-6885-1 fixed a vulnerability in Apache. The patch for CVE-2024-38474 was incomplete and caused regressions. This update provides the fix for that issue.
Original advisory details:
Orange Tsai discovered that the Apache HTTP Server mod_rewrite module incorrectly handled certain substitutions. A remote attacker could possibly use this issue to execute scripts in directories not directly reachable by any URL, or cause a denial of service. Some environments may require using the new UnsafeAllow3F flag to handle unsafe substitutions. (CVE-2024-38474)
What each source reports
OSV No score
apache2 regression
USN-6885-1 fixed a vulnerability in Apache. The patch for CVE-2024-38474 was incomplete and caused regressions. This update provides the fix for that issue.
Original advisory details:
Orange Tsai discovered that the Apache HTTP Server mod_rewrite module incorrectly handled certain substitutions. A remote attacker could possibly use this issue to execute scripts in directories not directly reachable by any URL, or cause a denial of service. Some environments may require using the new UnsafeAllow3F flag to handle unsafe substitutions. (CVE-2024-38474)
- Record
USN-6885-4- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
apache2Ubuntu:Pro:16.04:LTS |
before 2.4.18-2ubuntu3.17+esm14, plus listed versions 2.4.12-2ubuntu22.4.17-1ubuntu12.4.17-2ubuntu12.4.17-3ubuntu12.4.18-1ubuntu1 Show 30 moreShow less2.4.18-2ubuntu12.4.18-2ubuntu22.4.18-2ubuntu32.4.18-2ubuntu3.12.4.18-2ubuntu3.22.4.18-2ubuntu3.32.4.18-2ubuntu3.42.4.18-2ubuntu3.52.4.18-2ubuntu3.72.4.18-2ubuntu3.82.4.18-2ubuntu3.92.4.18-2ubuntu3.102.4.18-2ubuntu3.122.4.18-2ubuntu3.132.4.18-2ubuntu3.142.4.18-2ubuntu3.152.4.18-2ubuntu3.172.4.18-2ubuntu3.17+esm12.4.18-2ubuntu3.17+esm22.4.18-2ubuntu3.17+esm32.4.18-2ubuntu3.17+esm42.4.18-2ubuntu3.17+esm52.4.18-2ubuntu3.17+esm62.4.18-2ubuntu3.17+esm72.4.18-2ubuntu3.17+esm82.4.18-2ubuntu3.17+esm92.4.18-2ubuntu3.17+esm102.4.18-2ubuntu3.17+esm112.4.18-2ubuntu3.17+esm122.4.18-2ubuntu3.17+esm13 |
2.4.18-2ubuntu3.17+esm14 |
apache2Ubuntu:Pro:18.04:LTS |
before 2.4.29-1ubuntu4.27+esm4, plus listed versions 2.4.27-2ubuntu32.4.29-1ubuntu12.4.29-1ubuntu22.4.29-1ubuntu32.4.29-1ubuntu4 Show 28 moreShow less2.4.29-1ubuntu4.12.4.29-1ubuntu4.22.4.29-1ubuntu4.32.4.29-1ubuntu4.42.4.29-1ubuntu4.52.4.29-1ubuntu4.62.4.29-1ubuntu4.72.4.29-1ubuntu4.82.4.29-1ubuntu4.102.4.29-1ubuntu4.112.4.29-1ubuntu4.122.4.29-1ubuntu4.132.4.29-1ubuntu4.142.4.29-1ubuntu4.162.4.29-1ubuntu4.172.4.29-1ubuntu4.182.4.29-1ubuntu4.192.4.29-1ubuntu4.202.4.29-1ubuntu4.212.4.29-1ubuntu4.222.4.29-1ubuntu4.232.4.29-1ubuntu4.242.4.29-1ubuntu4.252.4.29-1ubuntu4.262.4.29-1ubuntu4.272.4.29-1ubuntu4.27+esm12.4.29-1ubuntu4.27+esm22.4.29-1ubuntu4.27+esm3 |
2.4.29-1ubuntu4.27+esm4 |
apache2Ubuntu:20.04:LTS |
before 2.4.41-4ubuntu3.23, plus listed versions 2.4.41-1ubuntu12.4.41-4ubuntu12.4.41-4ubuntu22.4.41-4ubuntu32.4.41-4ubuntu3.1 Show 18 moreShow less2.4.41-4ubuntu3.32.4.41-4ubuntu3.42.4.41-4ubuntu3.52.4.41-4ubuntu3.62.4.41-4ubuntu3.72.4.41-4ubuntu3.82.4.41-4ubuntu3.92.4.41-4ubuntu3.102.4.41-4ubuntu3.112.4.41-4ubuntu3.122.4.41-4ubuntu3.132.4.41-4ubuntu3.142.4.41-4ubuntu3.152.4.41-4ubuntu3.162.4.41-4ubuntu3.172.4.41-4ubuntu3.192.4.41-4ubuntu3.202.4.41-4ubuntu3.21 |
2.4.41-4ubuntu3.23 |
apache2Ubuntu:22.04:LTS |
before 2.4.52-1ubuntu4.14, plus listed versions 2.4.48-3.1ubuntu32.4.48-3.1ubuntu42.4.51-2ubuntu12.4.52-1ubuntu12.4.52-1ubuntu2 Show 14 moreShow less2.4.52-1ubuntu42.4.52-1ubuntu4.12.4.52-1ubuntu4.22.4.52-1ubuntu4.32.4.52-1ubuntu4.42.4.52-1ubuntu4.52.4.52-1ubuntu4.62.4.52-1ubuntu4.72.4.52-1ubuntu4.82.4.52-1ubuntu4.92.4.52-1ubuntu4.102.4.52-1ubuntu4.112.4.52-1ubuntu4.122.4.52-1ubuntu4.13 |
2.4.52-1ubuntu4.14 |
apache2Ubuntu:24.04:LTS |
before 2.4.58-1ubuntu8.6, plus listed versions 2.4.57-2ubuntu22.4.57-2ubuntu32.4.58-1ubuntu12.4.58-1ubuntu22.4.58-1ubuntu6 Show 7 moreShow less2.4.58-1ubuntu72.4.58-1ubuntu82.4.58-1ubuntu8.12.4.58-1ubuntu8.22.4.58-1ubuntu8.32.4.58-1ubuntu8.42.4.58-1ubuntu8.5 |
2.4.58-1ubuntu8.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-6885-4 is a vulnerability with no CVSS score yet in apache2, published April 7, 2025. No source lists public exploit code. Fixed in apache2 2.4.18-2ubuntu3.17+esm14.