We had done a PCI scan on one of our servers running Ubuntu 12.04 LTS with apache 2.2.22.

The scan reported a vulnerability in apache 2.2.22 (Apache HTTP Server Zero-Length Directory Name in LD_LIBRARY_PATH Vulnerability).The report states to upgrade the version to the latest stable release of either 2.2.23 or 2.2.24.

How do I upgrade to the 2.2.23 to fix the vulnerability or is there a patch available that can fix this and if yes can you let me know how that can be patched.


According to the package search for apache2 there is no package greater than 2.2.22 in the Ubuntu repos.

However if you look at the specific vulnerability it is 'just' a local exploitable vulnerability which leads unauthorized disclosure of information. So it might be acceptable to wait for a fix. More information about the vulnerability can be found at the entry CVE-2012-0883.

  • It's not acceptable to wait if you're trying to pass a PCI scan however. – Josh Feb 4 '14 at 16:44

rmadison apache2 shows that version 2.2.22-1 is the stable version in Ubuntu 12.04. You'll have to wait for a security upgrade to be applied to the apache2 package or for it to be updated by its maintainers.

You won't be able to update to version 2.4 in any version of Ubuntu as it isn't in the repositories yet. I wouldn't count on 2.4 entering the precise repositories as 12.04 is LTS and packages as commonly used as apache2 aren't updated on a whim.


Ubuntu does not backport feature releases, but just security vulnerabilities if they do have impact.

This specific one is considered to be negligible, according to this page. Quoting:

jdstrand> Debian/Ubuntu packages contain 038_no_LD_LIBRARY_PATH (see http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=276670 for more information)

So, I suggest you can now spend your time on more useful stuff. :-)

  • @Josh What does that have to do with the Q&A here? I think I was clear the vulnerability does not apply to Ubuntu as a result of the compile flags used for package build configuration. – gertvdijk Feb 4 '14 at 16:47
  • @Josh Your assumption about Ubuntu not patching is false. Ubuntu backports the fixes to the shipping 2.2.22 version. See the changelog: apt-get changelog apache2. Please don't start a new discussion in comments. Instead, I'd suggest to ask a new question in a more open approach rather than repetitive complaining. – gertvdijk Feb 4 '14 at 20:48
  • Please understand that I am not complaining... I was only trying to point out that your comment of this issue being negligible isn't totally true because it is necessary to address issues, even negligible ones, to pass a PCI scan. That being said, I do now see thanks to your comment Ubuntu backports the fixes to the shipping 2.2.22 version and the changelog that Apache version 2.2.22-1ubuntu1.4 actually does contain fixes for everything that I supposedly failed on a PCI scan. That wasn't clear to me from your answer. Thanks! – Josh Feb 4 '14 at 21:02
  • @Josh Fair enough. For new users of Ubuntu and just reading my answer I can imagine this isn't apparent. – gertvdijk Feb 4 '14 at 21:05
  • 1
    Sorry, I was still confused. I see now that this specific issue (CVE-2012-0883) was not fixed, it is marked negligible as you said. Other issues, like CVE-2012-3499, are fixed in backports. My apologies for adding extended discussion in comments; Once you let me know you've read this I'll delete my comments. – Josh Feb 4 '14 at 21:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.