Read the docs
Red Hat Security Advisory

RHSA-2017:2478

httpd security update

Released 2017-08-15 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 4 records

TI-2017-07168 CVE-2017-9788 · GHSA-w97h-p5ff-7q69

Improper input validation in Apache HTTP Server

Priority HIGH 73

In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_d…

CVSS 3.0CRITICAL 9.1 Network No auth No interaction EPSS 0.5677 Published 2017-07-13 Partial fix CWE-20
TI-2017-05315 CVE-2017-7679 · GHSA-v946-67fg-g8xg

Memory corruption in Apache HTTP Server

Priority HIGH 69

In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.39341 Published 2017-06-20 Partial fix CWE-126
TI-2017-02384 CVE-2017-3169 · GHSA-p3gj-wq33-qg67

NULL pointer dereference in Apache HTTP Server

Priority MEDIUM 61

In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.19953 Published 2017-06-20 Partial fix CWE-476
TI-2017-02383 CVE-2017-3167 · GHSA-9mgw-4qp5-wrrj

Improper authentication in Apache HTTP Server

Priority MEDIUM 61

In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.20231 Published 2017-06-20 Partial fix CWE-287