TI-2018-12298 CVE-2018-17199 · GHSA-gxfm-3qhv-h52c
Session fixation in Apache HTTP Server
Priority MEDIUM 51
In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session.
RHSA-2020:1121
httpd security, bug fix, and enhancement update
Released 2020-03-31 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client Optional (v. 7) httpd-2.4.6-93.el7, httpd-devel-2.4.6-93.el7, httpd-manual-2.4.6-93.el7 +5
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) httpd-2.4.6-93.el7, httpd-devel-2.4.6-93.el7, httpd-manual-2.4.6-93.el7 +5
- Red Hat Enterprise Linux Server (v. 7) httpd-2.4.6-93.el7, httpd-devel-2.4.6-93.el7, httpd-manual-2.4.6-93.el7 +3
- Red Hat Enterprise Linux Server Optional (v. 7) mod_ldap-2.4.6-93.el7, mod_proxy_html-1:2.4.6-93.el7
- Red Hat Enterprise Linux Workstation (v. 7) httpd-2.4.6-93.el7, httpd-devel-2.4.6-93.el7, httpd-manual-2.4.6-93.el7 +3
- Red Hat Enterprise Linux Workstation Optional (v. 7) mod_ldap-2.4.6-93.el7, mod_proxy_html-1:2.4.6-93.el7
Fixes 3 records
TI-2017-11483 CVE-2017-15710 · GHSA-9q97-qm54-9797
Out-of-bounds write in Apache HTTP Server
Priority MEDIUM 50
In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured with AuthLDAPCharsetConfig, uses the Accept-Language header value to lookup the right charset encoding when verifying…
TI-2018-01204 CVE-2018-1301 · GHSA-c68v-mcv4-56hp
Memory corruption in Apache HTTP Server
Priority MEDIUM 42
A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size limit is reached by reading the HTTP header.