Red Hat Security AdvisoryRHSA-2017:1161
httpd24-httpd security, bug fix, and enhancement update
Released 2017-04-26 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) httpd24-httpd-2.4.25-9.el6, httpd24-httpd-devel-2.4.25-9.el6, httpd24-httpd-manual-2.4.25-9.el6 +5
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) httpd24-httpd-2.4.25-9.el7, httpd24-httpd-devel-2.4.25-9.el7, httpd24-httpd-manual-2.4.25-9.el7 +5
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) httpd24-httpd-2.4.25-9.el6, httpd24-httpd-devel-2.4.25-9.el6, httpd24-httpd-manual-2.4.25-9.el6 +5
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) httpd24-httpd-2.4.25-9.el7, httpd24-httpd-devel-2.4.25-9.el7, httpd24-httpd-manual-2.4.25-9.el7 +5
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) httpd24-httpd-2.4.25-9.el6, httpd24-httpd-devel-2.4.25-9.el6, httpd24-httpd-manual-2.4.25-9.el6 +5
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) httpd24-httpd-2.4.25-9.el7, httpd24-httpd-devel-2.4.25-9.el7, httpd24-httpd-manual-2.4.25-9.el7 +5
Fixes 6 records
Priority HIGH 73
The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows remote attackers to cause a denial of servi…
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.7907 · Published 2016-12-05 · Fixed CWE-20
Priority MEDIUM 64
In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured ciphers with possibly either CBC or ECB modes of operation (AES256-CBC by default), hence no selectab…
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.49024 · Published 2017-07-27 · Partial fix CWE-310
Priority MEDIUM 52
In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can cause the server to crash, and each instance continues to crash even for subsequently valid requests.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.20952 · Published 2017-07-27 · Fixed CWE-823
Priority MEDIUM 47
Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.13252 · Published 2017-07-27 · Partial fix
Priority MEDIUM 43
The Apache HTTP Server 2.4.17 and 2.4.18, when mod_http2 is enabled, does not limit the number of simultaneous stream workers for a single HTTP/2 connection, which allows remote attackers to cause a denial of service (st…
CVSS 3.0MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.15923 · Published 2016-07-06 · Fixed CWE-399
Priority LOW 34
IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts…
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.07082 · Published 2020-08-07 · Partial fix CWE-345
THREATIST.IORead the docs