RHSA-2019:3933

Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service.

Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service.

Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service.

Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service.

In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session.

In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing config…

The OpenSSL DSA signature algorithm has been shown to be vulnerable to a timing side channel attack.

A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38.

In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data.

The OpenSSL RSA Key generation algorithm has been shown to be vulnerable to a cache timing side channel attack.

A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38.

Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention'.