Red Hat Security AdvisoryRHSA-2015:0325
httpd security, bug fix, and enhancement update
Released 2015-03-05 · Red Hat rating Low · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client Optional (v. 7) httpd-2.4.6-31.el7, httpd-devel-2.4.6-31.el7, httpd-manual-2.4.6-31.el7 +5
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) httpd-2.4.6-31.el7, httpd-devel-2.4.6-31.el7, httpd-manual-2.4.6-31.el7 +5
- Red Hat Enterprise Linux Server (v. 7) httpd-2.4.6-31.el7, httpd-devel-2.4.6-31.el7, httpd-manual-2.4.6-31.el7 +2
- Red Hat Enterprise Linux Server Optional (v. 7) mod_ldap-2.4.6-31.el7, mod_proxy_html-1:2.4.6-31.el7, mod_session-2.4.6-31.el7
- Red Hat Enterprise Linux Workstation (v. 7) httpd-2.4.6-31.el7, httpd-devel-2.4.6-31.el7, httpd-manual-2.4.6-31.el7 +2
- Red Hat Enterprise Linux Workstation Optional (v. 7) mod_ldap-2.4.6-31.el7, mod_proxy_html-1:2.4.6-31.el7, mod_session-2.4.6-31.el7
Fixes 2 records
Priority MEDIUM 57
The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding.
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.57992 · Published 2014-04-15 · Partial fix
Priority LOW 38
The cache_merge_headers_out function in modules/cache/cache_util.c in the mod_cache module in the Apache HTTP Server before 2.4.11 allows remote attackers to cause a denial of service (NULL pointer dereference and applic…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.13451 · Published 2014-10-10 · Fixed CWE-476
