Red Hat Security AdvisoryRHSA-2019:1898
httpd security update
Released 2019-07-29 · Red Hat rating Low · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client Optional (v. 7) httpd-2.4.6-89.el7_6.1, httpd-devel-2.4.6-89.el7_6.1, httpd-manual-2.4.6-89.el7_6.1 +5
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) httpd-2.4.6-89.el7_6.1, httpd-devel-2.4.6-89.el7_6.1, httpd-manual-2.4.6-89.el7_6.1 +5
- Red Hat Enterprise Linux Server (v. 7) httpd-2.4.6-89.el7_6.1, httpd-devel-2.4.6-89.el7_6.1, httpd-manual-2.4.6-89.el7_6.1 +3
- Red Hat Enterprise Linux Server Optional (v. 7) mod_ldap-2.4.6-89.el7_6.1, mod_proxy_html-1:2.4.6-89.el7_6.1
- Red Hat Enterprise Linux Workstation (v. 7) httpd-2.4.6-89.el7_6.1, httpd-devel-2.4.6-89.el7_6.1, httpd-manual-2.4.6-89.el7_6.1 +3
- Red Hat Enterprise Linux Workstation Optional (v. 7) mod_ldap-2.4.6-89.el7_6.1, mod_proxy_html-1:2.4.6-89.el7_6.1
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) httpd-2.4.6-89.el7_6.1, httpd-devel-2.4.6-89.el7_6.1, httpd-manual-2.4.6-89.el7_6.1 +3
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) mod_ldap-2.4.6-89.el7_6.1, mod_proxy_html-1:2.4.6-89.el7_6.1
Fixes 1 record
Priority MEDIUM 58
In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.15785 · Published 2018-03-26 · Partial fix CWE-287
