mod_wsgi before 4.2.4 for Apache, when creating a daemon process group, does not properly handle when group privileges cannot be dropped, which might allow attackers to gain privileges via unspecified vectors.
CVSS Details
- CVSS 3.1 Base Score: 8.4
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade mod_wsgiUpgrade mod_wsgi-debuginfo | Apr 27, 2020 | Dec 16, 2014 |
| Amazon_linux | — | Upgrade mod24_wsgi | Apr 27, 2018 | Dec 16, 2014 |
| Debian | — | Upgrade mod-wsgi | Jul 30, 2024 | Dec 16, 2014 |
| Gentoo Linux | — | Upgrade www-apache/mod_wsgi. | Oct 30, 2017 | Dec 16, 2014 |
| Huawei Euleros 2_0_sp2 | — | Upgrade mod_wsgi | Dec 4, 2019 | Dec 16, 2014 |
| Huawei Euleros 2_0_sp3 | — | Upgrade mod_wsgi | Dec 18, 2019 | Dec 16, 2014 |
| Huawei Euleros 2_0_sp5 | — | Upgrade mod_wsgi | Dec 27, 2019 | Dec 16, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 17, 2014 |
| Suse | — | Upgrade apache2-mod_wsgi-debugsourceUpgrade apache2-mod_wsgi-debuginfoUpgrade apache2-mod_wsgi | Dec 18, 2015 | Dec 5, 2014 |
| Ubuntu | — | Upgrade libapache2-mod-wsgiUpgrade libapache2-mod-wsgi-py3 | Nov 8, 2024 | Dec 16, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub