---
title: "CVE-2011-3639\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2011-3639?format=md
keywords: index, follow
---

# CVE-2011-3639

Publication date 30 November 2011

Last updated 24 July 2024

---

Ubuntu priority

**Medium**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

Toggle side navigation

## Description

The mod\_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and
2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not
properly interact with use of (1) RewriteRule and (2) ProxyPassMatch
pattern matches for configuration of a reverse proxy, which allows remote
attackers to send requests to intranet servers by using the HTTP/0.9
protocol with a malformed URI containing an initial @ (at sign) character.
NOTE: this vulnerability exists because of an incomplete fix for
CVE-2011-3368.

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| apache2 | 11.10 oneiric | Not affected |
| 11.04 natty | Fixed 2.2.17-1ubuntu1.4 |
| 10.10 maverick | Fixed 2.2.16-1ubuntu3.4 |
| 10.04 LTS lucid | Fixed 2.2.14-5ubuntu8.7 |
| 8.04 LTS hardy | Fixed 2.2.8-1ubuntu0.22 |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)
* [Patch details](https://ubuntu.com/security/CVE-2011-3639?format=md#patch-details)

### Patch details

For informational purposes only. We recommend not to cherry-pick updates. [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)

| Package | Patch details |
| --- | --- |
| apache2 | * Upstream:   <http://svn.apache.org/viewvc?view=revision&revision=1100200> |

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3639)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2011-3639)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2011-3639)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2011-3639)

### Other references

* <http://seclists.org/oss-sec/2011/q4/159>
* <http://marc.info/?l=apache-httpd-dev&m=131955975103801&w=2>
* <https://www.cve.org/CVERecord?id=CVE-2011-3639>