Ubuntu USN-8589-1: Apache HTTP Server Vulnerabilities Fix (CVE-2026-29167 RCE/LPE, CVE-2026-29170 XSS, CVE-2026-33006 Auth Bypass)

Vulnerability Overview Vulnerability ID: USN-8589-1 Release Date: July 22, 2026 Affected Software: Apache HTTP Server Vulnerability Details: - CVE-2026-29167: The mod_ldap module of the Apache HTTP Server incorrectly handles memory when processing per-directory configuration, potentially leading to denial of service or arbitrary code execution. - CVE-2026-29170: The mod_proxy_ftp module of the Apache HTTP Server incorrectly generates HTML when processing FTP directory listings, potentially allowing the injection of arbitrary web scripts or HTML. - CVE-2026-33006: The mod_auth_digest module of the Apache HTTP Server has a timing side-channel vulnerability, potentially allowing bypass of Digest authentication. Scope of Impact Affected Versions: - 20.04 LTS (focal) - 18.04 LTS (bionic) - 16.04 LTS (xenial) - 14.04 LTS (trusty) Remediation Updated Package Versions: - 20.04 LTS (focal): - apache2 - 2.4.41-4ubuntu3.23+esm6 - apache2-bin - 2.4.41-4ubuntu3.23+esm6 - apache2-dev - 2.4.41-4ubuntu3.23+esm6 - apache2-ssl-dev - 2.4.41-4ubuntu3.23+esm6 - apache2-suexec-custom - 2.4.41-4ubuntu3.23+esm6 - apache2-suexec-pristine - 2.4.41-4ubuntu3.23+esm6 - apache2-utils - 2.4.41-4ubuntu3.23+esm6 - libapache2-mod-md - 2.4.41-4ubuntu3.23+esm6 - libapache2-mod-proxy-uwsgi - 2.4.41-4ubuntu3.23+esm6 - 18.04 LTS (bionic): - apache2 - 2.4.29-1ubuntu4.27+esm11 - apache2-bin - 2.4.29-1ubuntu4.27+esm11 - apache2-dev - 2.4.29-1ubuntu4.27+esm11 - apache2-ssl-dev - 2.4.29-1ubuntu4.27+esm11 - apache2-suexec-custom - 2.4.29-1ubuntu4.27+esm11 - apache2-suexec-pristine - 2.4.29-1ubuntu4.27+esm11 - apache2-utils - 2.4.29-1ubuntu4.27+esm11 - 16.04 LTS (xenial): - apache2 - 2.4.18-2ubuntu3.17+esm20 - apache2-bin - 2.4.18-2ubuntu3.17+esm20 - apache2-dev - 2.4.18-2ubuntu3.17+esm20 - apache2-suexec-custom - 2.4.18-2ubuntu3.17+esm20 - apache2-suexec-pristine - 2.4.18-2ubuntu3.17+esm20 - apache2-utils - 2.4.18-2ubuntu3.17+esm20 - 14.04 LTS (trusty): - apache2 - 2.4.7-1ubuntu4.22+esm15 - apache2-bin - 2.4.7-1ubuntu4.22+esm15 - apache2-dev - 2.4.7-1ubuntu4.22+esm15 - apache2-mpm-event - 2.4.7-1ubuntu4.22+esm15 - apache2-mpm-itk - 2.4.7-1ubuntu4.22+esm15 - apache2-mpm-prefork - 2.4.7-1ubuntu4.22+esm15 - apache2-mpm-worker - 2.4.7-1ubuntu4.22+esm15 - apache2-suexec-custom - 2.4.7-1ubuntu4.22+esm15 - apache2-suexec-pristine - 2.4.7-1ubuntu4.22+esm15 - apache2-utils - 2.4.7-1ubuntu4.22+esm15 - apache2.2-bin - 2.4.7-1ubuntu4.22+esm15 - libapache2-mod-macro - 1:2.4.7-1ubuntu4.22+esm15 - libapache2-mod-proxy-html - 1:2.4.7-1ubuntu4.22+esm15 Update Steps: - After performing a standard system update, restart apache2 to apply all necessary changes. References CVE-2026-33006 CVE-2026-29170 CVE-2026-29167 Related Advisories USN-8516-1 USN-8239-1 Reducing Security Exposure Ubuntu Pro provides ten years of security coverage for over 25,000 packages in the Main and Universe repositories, available for free for up to five machines.

Goal Reached Thanks to every supporter — we hit 100%!

Ubuntu USN-8589-1: Apache HTTP Server Vulnerabilities Fix (CVE-2026-29167 RCE/LPE, CVE-2026-29170 XSS, CVE-2026-33006 Auth Bypass)

More from this source