Red Hat Security AdvisoryRHSA-2017:3018
httpd24 security, bug fix, and enhancement update
Released 2017-10-24 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) httpd24-1.1-18.el6, httpd24-httpd-2.4.27-8.el6, httpd24-httpd-devel-2.4.27-8.el6 +8
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) httpd24-1.1-18.el7, httpd24-curl-7.47.1-4.el7, httpd24-httpd-2.4.27-8.el7 +15
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) httpd24-1.1-18.el6, httpd24-httpd-2.4.27-8.el6, httpd24-httpd-devel-2.4.27-8.el6 +8
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) httpd24-1.1-18.el7, httpd24-curl-7.47.1-4.el7, httpd24-httpd-2.4.27-8.el7 +15
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) httpd24-1.1-18.el7, httpd24-curl-7.47.1-4.el7, httpd24-httpd-2.4.27-8.el7 +15
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) httpd24-1.1-18.el6, httpd24-httpd-2.4.27-8.el6, httpd24-httpd-devel-2.4.27-8.el6 +8
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) httpd24-1.1-18.el7, httpd24-curl-7.47.1-4.el7, httpd24-httpd-2.4.27-8.el7 +15
Fixes 1 record
Priority HIGH 77
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.94651 · Published 2017-09-18 · Partial fix CWE-416
