Red Hat Security AdvisoryRHSA-2014:0921
httpd security update
Released 2014-07-23 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client Optional (v. 7) httpd-2.4.6-18.el7_0, httpd-devel-2.4.6-18.el7_0, httpd-manual-2.4.6-18.el7_0 +5
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) httpd-2.4.6-18.el7_0, httpd-devel-2.4.6-18.el7_0, httpd-manual-2.4.6-18.el7_0 +5
- Red Hat Enterprise Linux Server (v. 7) httpd-2.4.6-18.el7_0, httpd-devel-2.4.6-18.el7_0, httpd-manual-2.4.6-18.el7_0 +2
- Red Hat Enterprise Linux Server Optional (v. 7) mod_ldap-2.4.6-18.el7_0, mod_proxy_html-1:2.4.6-18.el7_0, mod_session-2.4.6-18.el7_0
- Red Hat Enterprise Linux Workstation (v. 7) httpd-2.4.6-18.el7_0, httpd-devel-2.4.6-18.el7_0, httpd-manual-2.4.6-18.el7_0 +2
- Red Hat Enterprise Linux Workstation Optional (v. 7) mod_ldap-2.4.6-18.el7_0, mod_proxy_html-1:2.4.6-18.el7_0, mod_session-2.4.6-18.el7_0
Fixes 5 records
Priority HIGH 72
Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or ex…
CVSS 2.0MEDIUM 6.8· Network · No auth · Interaction — · EPSS 0.85808 · Published 2014-07-20 · Partial fix CWE-362
Priority MEDIUM 52
The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read fr…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.4472 · Published 2014-07-20 · Partial fix CWE-399
Priority MEDIUM 47
The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resourc…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.37295 · Published 2014-07-20 · Partial fix CWE-400
Priority MEDIUM 46
The mod_proxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote attackers to cause a denial of service (child-process crash) via a crafted HTTP Connection header.
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.35677 · Published 2014-07-20 · Fixed CWE-20
Priority LOW 34
The cache_invalidate function in modules/cache/cache_storage.c in the mod_cache module in the Apache HTTP Server 2.4.6, when a caching forward proxy is enabled, allows remote HTTP servers to cause a denial of service (NU…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.11534 · Published 2014-07-20 · Partial fix
THREATIST.IORead the docs