Red Hat Security AdvisoryRHSA-2017:2882
httpd security update
Released 2017-10-11 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client Optional (v. 7) httpd-2.4.6-67.el7_4.5, httpd-devel-2.4.6-67.el7_4.5, httpd-manual-2.4.6-67.el7_4.5 +5
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) httpd-2.4.6-67.el7_4.5, httpd-devel-2.4.6-67.el7_4.5, httpd-manual-2.4.6-67.el7_4.5 +5
- Red Hat Enterprise Linux Server (v. 7) httpd-2.4.6-67.el7_4.5, httpd-devel-2.4.6-67.el7_4.5, httpd-manual-2.4.6-67.el7_4.5 +3
- Red Hat Enterprise Linux Server Optional (v. 7) mod_ldap-2.4.6-67.el7_4.5, mod_proxy_html-1:2.4.6-67.el7_4.5
- Red Hat Enterprise Linux Workstation (v. 7) httpd-2.4.6-67.el7_4.5, httpd-devel-2.4.6-67.el7_4.5, httpd-manual-2.4.6-67.el7_4.5 +3
- Red Hat Enterprise Linux Workstation Optional (v. 7) mod_ldap-2.4.6-67.el7_4.5, mod_proxy_html-1:2.4.6-67.el7_4.5
Fixes 1 record
Priority HIGH 77
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.94651 · Published 2017-09-18 · Partial fix CWE-416
