2025-09-08 11:50 UTC
@micahflee Please note that installing the latest Ubuntu security updates for Apache httpd does not necessarily upgrade Apache to the latest available version. Instead, security fixes are typically backported to the version included with the distribution. As a result, the displayed version remains unchanged.
For example, even after fully updating Ubuntu 22.04 LTS, the Apache version shown in the Server header still appears as 2.4.52, despite being patched with the latest security fixes.
Replies (2)
-
@buherator@infosec.place 2025-09-08 11:59
@h0ng10 @micahflee This is a fairly common mistake too and causes a lot of bullshit work for security teams. A banner string (*especially* in case of Apache HTTPd) doesn't mean anything, so unless you can demonstrate the presence of a vulnerability this is nothing (aka PoC||GTFO). (edited) In addition the cited CVE-2024-38476 requires a *malicious backend* to be exploitable: https://devco.re/blog/2024/08/09/confusion-attacks-exploiting-hidden-semantic-ambiguity-in-apache-http-server-en/
-
@xyhhx@nso.group 2025-09-08 15:25
@h0ng10 @micahflee common {ubuntu,debian} L