Red Hat Security AdvisoryRHSA-2016:0061
httpd and httpd22 security update
Released 2016-01-21 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server httpd-2.2.26-41.ep6.el5, httpd-2.2.26-41.ep6.el5.i386, httpd-devel-2.2.26-41.ep6.el5 +9
- Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server httpd-2.2.26-41.ep6.el6, httpd-2.2.26-41.ep6.el6.i386, httpd-devel-2.2.26-41.ep6.el6 +9
- Red Hat JBoss Enterprise Web Server 2 for RHEL 7 Server httpd22-2.2.26-42.ep6.el7, httpd22-devel-2.2.26-42.ep6.el7, httpd22-manual-2.2.26-42.ep6.el7 +3
Fixes 2 records
Priority MEDIUM 61
The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, rel…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.74387 · Published 2015-07-20 · Partial fix CWE-17
Priority MEDIUM 57
The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding.
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.57992 · Published 2014-04-15 · Partial fix
