Red Hat Security Advisory

RHSA-2019:4126

httpd24-httpd security, bug fix, and enhancement update

Released 2019-12-10 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) httpd24-1.1-19.el6, httpd24-build-1.1-19.el6, httpd24-httpd-2.4.34-15.el6 +12
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) httpd24-1.1-19.el7, httpd24-httpd-2.4.34-15.el7, httpd24-httpd-devel-2.4.34-15.el7 +12
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) httpd24-1.1-19.el7, httpd24-httpd-2.4.34-15.el7, httpd24-httpd-devel-2.4.34-15.el7 +12
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) httpd24-1.1-19.el7, httpd24-httpd-2.4.34-15.el7, httpd24-httpd-devel-2.4.34-15.el7 +12
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) httpd24-1.1-19.el7, httpd24-httpd-2.4.34-15.el7, httpd24-httpd-devel-2.4.34-15.el7 +12
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) httpd24-1.1-19.el6, httpd24-build-1.1-19.el6, httpd24-httpd-2.4.34-15.el6 +12
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) httpd24-1.1-19.el7, httpd24-httpd-2.4.34-15.el7, httpd24-httpd-devel-2.4.34-15.el7 +12

Fixes 6 records

TI-2019-07417 CVE-2019-10092 · GHSA-qrr6-fpf4-x3v4

Cross-site scripting in Apache HTTP Server

HIGH 68

In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.81466 Published 2019-09-26 Partial fix CWE-79

TI-2019-07421 CVE-2019-10097 · GHSA-x7xg-9vq9-q8xh

NULL pointer dereference in Apache HTTP Server

MEDIUM 64

In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could trigger a stack buffer overflow or NULL…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.52873 Published 2019-09-26 Partial fix CWE-476

TI-2018-12298 CVE-2018-17199 · GHSA-gxfm-3qhv-h52c

Session fixation in Apache HTTP Server

MEDIUM 51

In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.19994 Published 2019-01-30 Fixed CWE-384

TI-2019-00190 CVE-2019-0217 · GHSA-q29r-xr2f-g7j5

Race condition in Apache HTTP Server

MEDIUM 49

In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing config…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.16355 Published 2019-04-08 Partial fix CWE-362

TI-2018-12288 CVE-2018-17189 · GHSA-xcwr-pcwv-7gm8

Uncontrolled resource consumption in Apache HTTP Server

MEDIUM 42

In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.19404 Published 2019-01-30 Fixed CWE-400

TI-2019-00193 CVE-2019-0220 · GHSA-mfx7-67r8-jcfr

A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38.

MEDIUM 41

A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.1786 Published 2019-06-11 Partial fix CWE-706