Red Hat Security AdvisoryRHSA-2014:0922
httpd24-httpd security update
Released 2014-07-23 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 6) httpd24-httpd-2.4.6-18.el6, httpd24-httpd-devel-2.4.6-18.el6, httpd24-httpd-manual-2.4.6-18.el6 +5
- Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 7) httpd24-httpd-2.4.6-21.el7, httpd24-httpd-devel-2.4.6-21.el7, httpd24-httpd-manual-2.4.6-21.el7 +5
- Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.4) httpd24-httpd-2.4.6-18.el6, httpd24-httpd-devel-2.4.6-18.el6, httpd24-httpd-manual-2.4.6-18.el6 +5
- Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 6) httpd24-httpd-2.4.6-18.el6, httpd24-httpd-devel-2.4.6-18.el6, httpd24-httpd-manual-2.4.6-18.el6 +5
- Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 7) httpd24-httpd-2.4.6-21.el7, httpd24-httpd-devel-2.4.6-21.el7, httpd24-httpd-manual-2.4.6-21.el7 +5
Fixes 5 records
Priority HIGH 72
Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or ex…
CVSS 2.0MEDIUM 6.8· Network · No auth · Interaction — · EPSS 0.85808 · Published 2014-07-20 · Partial fix CWE-362
Priority MEDIUM 52
The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read fr…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.4472 · Published 2014-07-20 · Partial fix CWE-399
Priority MEDIUM 47
The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resourc…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.37295 · Published 2014-07-20 · Partial fix CWE-400
Priority MEDIUM 46
The mod_proxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote attackers to cause a denial of service (child-process crash) via a crafted HTTP Connection header.
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.35677 · Published 2014-07-20 · Fixed CWE-20
Priority LOW 34
The cache_invalidate function in modules/cache/cache_storage.c in the mod_cache module in the Apache HTTP Server 2.4.6, when a caching forward proxy is enabled, allows remote HTTP servers to cause a denial of service (NU…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.11534 · Published 2014-07-20 · Partial fix
THREATIST.IORead the docs