Red Hat Security AdvisoryRHSA-2017:2972
httpd security update
Released 2017-10-19 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Desktop (v. 6) httpd-2.2.15-60.el6_9.6, httpd-tools-2.2.15-60.el6_9.6
- Red Hat Enterprise Linux Desktop Optional (v. 6) httpd-devel-2.2.15-60.el6_9.6, httpd-manual-2.2.15-60.el6_9.6, mod_ssl-1:2.2.15-60.el6_9.6
- Red Hat Enterprise Linux HPC Node (v. 6) httpd-2.2.15-60.el6_9.6, httpd-tools-2.2.15-60.el6_9.6
- Red Hat Enterprise Linux HPC Node Optional (v. 6) httpd-devel-2.2.15-60.el6_9.6, httpd-manual-2.2.15-60.el6_9.6, mod_ssl-1:2.2.15-60.el6_9.6
- Red Hat Enterprise Linux Server (v. 6) httpd-2.2.15-60.el6_9.6, httpd-devel-2.2.15-60.el6_9.6, httpd-devel-2.2.15-60.el6_9.6.ppc +3
- Red Hat Enterprise Linux Workstation (v. 6) httpd-2.2.15-60.el6_9.6, httpd-devel-2.2.15-60.el6_9.6, httpd-manual-2.2.15-60.el6_9.6 +2
Fixes 2 records
Priority HIGH 77
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.94651 · Published 2017-09-18 · Partial fix CWE-416
Priority MEDIUM 40
A regression was found in the Red Hat Enterprise Linux 6.9 version of httpd 2.2.15-60, causing comments in the "Allow" and "Deny" configuration lines to be parsed incorrectly.
CVSS 3.0MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.08078 · Published 2018-07-26 · Fixed CWE-284
