Red Hat Security AdvisoryRHSA-2017:2479
httpd security update
Released 2017-08-15 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client Optional (v. 7) httpd-2.4.6-67.el7_4.2, httpd-devel-2.4.6-67.el7_4.2, httpd-manual-2.4.6-67.el7_4.2 +5
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) httpd-2.4.6-67.el7_4.2, httpd-devel-2.4.6-67.el7_4.2, httpd-manual-2.4.6-67.el7_4.2 +5
- Red Hat Enterprise Linux Server (v. 7) httpd-2.4.6-67.el7_4.2, httpd-devel-2.4.6-67.el7_4.2, httpd-manual-2.4.6-67.el7_4.2 +3
- Red Hat Enterprise Linux Server Optional (v. 7) mod_ldap-2.4.6-67.el7_4.2, mod_proxy_html-1:2.4.6-67.el7_4.2
- Red Hat Enterprise Linux Workstation (v. 7) httpd-2.4.6-67.el7_4.2, httpd-devel-2.4.6-67.el7_4.2, httpd-manual-2.4.6-67.el7_4.2 +3
- Red Hat Enterprise Linux Workstation Optional (v. 7) mod_ldap-2.4.6-67.el7_4.2, mod_proxy_html-1:2.4.6-67.el7_4.2
Fixes 5 records
Priority HIGH 73
In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_d…
CVSS 3.0CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.5677 · Published 2017-07-13 · Partial fix CWE-20
Priority HIGH 69
In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.39341 · Published 2017-06-20 · Partial fix CWE-126
Priority HIGH 66
The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.57472 · Published 2017-06-20 · Fixed CWE-126
Priority MEDIUM 61
In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.19953 · Published 2017-06-20 · Partial fix CWE-476
Priority MEDIUM 61
In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.20231 · Published 2017-06-20 · Partial fix CWE-287
THREATIST.IORead the docs