Red Hat Security AdvisoryRHSA-2015:1667
httpd security update
Released 2015-08-24 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client Optional (v. 7) httpd-2.4.6-31.el7_1.1, httpd-devel-2.4.6-31.el7_1.1, httpd-manual-2.4.6-31.el7_1.1 +5
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) httpd-2.4.6-31.el7_1.1, httpd-devel-2.4.6-31.el7_1.1, httpd-manual-2.4.6-31.el7_1.1 +5
- Red Hat Enterprise Linux Server (v. 7) httpd-2.4.6-31.ael7b_1.1, httpd-2.4.6-31.el7_1.1, httpd-devel-2.4.6-31.ael7b_1.1 +7
- Red Hat Enterprise Linux Server Optional (v. 7) mod_ldap-2.4.6-31.ael7b_1.1, mod_ldap-2.4.6-31.el7_1.1, mod_proxy_html-1:2.4.6-31.ael7b_1.1 +3
- Red Hat Enterprise Linux Workstation (v. 7) httpd-2.4.6-31.el7_1.1, httpd-devel-2.4.6-31.el7_1.1, httpd-manual-2.4.6-31.el7_1.1 +2
- Red Hat Enterprise Linux Workstation Optional (v. 7) mod_ldap-2.4.6-31.el7_1.1, mod_proxy_html-1:2.4.6-31.el7_1.1, mod_session-2.4.6-31.el7_1.1
Fixes 2 records
Priority MEDIUM 61
The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, rel…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.74387 · Published 2015-07-20 · Partial fix CWE-17
Priority LOW 37
The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an authorization setting rather than an authenticatio…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.16306 · Published 2015-07-20 · Partial fix CWE-264
