Red Hat Security Advisory

RHSA-2017:0906

httpd security and bug fix update

Released 2017-04-12 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client Optional (v. 7) httpd-2.4.6-45.el7_3.4, httpd-devel-2.4.6-45.el7_3.4, httpd-manual-2.4.6-45.el7_3.4 +5
Red Hat Enterprise Linux ComputeNode Optional (v. 7) httpd-2.4.6-45.el7_3.4, httpd-devel-2.4.6-45.el7_3.4, httpd-manual-2.4.6-45.el7_3.4 +5
Red Hat Enterprise Linux Server (v. 7) httpd-2.4.6-45.el7_3.4, httpd-devel-2.4.6-45.el7_3.4, httpd-manual-2.4.6-45.el7_3.4 +2
Red Hat Enterprise Linux Server Optional (v. 7) mod_ldap-2.4.6-45.el7_3.4, mod_proxy_html-1:2.4.6-45.el7_3.4, mod_session-2.4.6-45.el7_3.4
Red Hat Enterprise Linux Workstation (v. 7) httpd-2.4.6-45.el7_3.4, httpd-devel-2.4.6-45.el7_3.4, httpd-manual-2.4.6-45.el7_3.4 +2
Red Hat Enterprise Linux Workstation Optional (v. 7) mod_ldap-2.4.6-45.el7_3.4, mod_proxy_html-1:2.4.6-45.el7_3.4, mod_session-2.4.6-45.el7_3.4

Fixes 4 records

TI-2016-00660 CVE-2016-0736 · GHSA-mxm5-vg5c-rx7v

Cryptographic flaw in Apache HTTP Server

MEDIUM 64

In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured ciphers with possibly either CBC or ECB modes of operation (AES256-CBC by default), hence no selectab…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.49024 Published 2017-07-27 Partial fix CWE-310

TI-2016-01972 CVE-2016-2161 · GHSA-3v6f-955w-932h

Improper input validation in Apache HTTP Server

MEDIUM 52

In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can cause the server to crash, and each instance continues to crash even for subsequently valid requests.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.20952 Published 2017-07-27 Fixed CWE-823

TI-2016-07200 CVE-2016-8743 · GHSA-2rfh-2gh8-v9fq

Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the…

MEDIUM 47

Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.13252 Published 2017-07-27 Partial fix

TI-2016-04297 CVE-2016-4975 · GHSA-crcg-r773-w4rv

mod_userdir CRLF injection

MEDIUM 46

Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.19882 Published 2018-08-14 Partial fix CWE-93