Red Hat Security AdvisoryRHSA-2016:1420
httpd24-httpd security update
Released 2016-07-18 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) httpd24-httpd-2.4.18-11.el6, httpd24-httpd-devel-2.4.18-11.el6, httpd24-httpd-manual-2.4.18-11.el6 +5
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) httpd24-httpd-2.4.18-11.el7, httpd24-httpd-devel-2.4.18-11.el7, httpd24-httpd-manual-2.4.18-11.el7 +5
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6) httpd24-httpd-2.4.18-11.el6, httpd24-httpd-devel-2.4.18-11.el6, httpd24-httpd-manual-2.4.18-11.el6 +5
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) httpd24-httpd-2.4.18-11.el6, httpd24-httpd-devel-2.4.18-11.el6, httpd24-httpd-manual-2.4.18-11.el6 +5
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1) httpd24-httpd-2.4.18-11.el7, httpd24-httpd-devel-2.4.18-11.el7, httpd24-httpd-manual-2.4.18-11.el7 +5
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2) httpd24-httpd-2.4.18-11.el7, httpd24-httpd-devel-2.4.18-11.el7, httpd24-httpd-manual-2.4.18-11.el7 +5
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) httpd24-httpd-2.4.18-11.el6, httpd24-httpd-devel-2.4.18-11.el6, httpd24-httpd-manual-2.4.18-11.el6 +5
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) httpd24-httpd-2.4.18-11.el7, httpd24-httpd-devel-2.4.18-11.el7, httpd24-httpd-manual-2.4.18-11.el7 +5
Fixes 2 records
Priority HIGH 68
The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remot…
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.55724 · Published 2016-07-19 · Partial fix
Priority MEDIUM 51
The Apache HTTP Server 2.4.18 through 2.4.20, when mod_http2 and mod_ssl are enabled, does not properly recognize the "SSLVerifyClient require" directive for HTTP/2 request authorization, which allows remote attackers to…
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.18802 · Published 2016-07-06 · Fixed CWE-284
