Red Hat Security AdvisoryRHSA-2020:3958
httpd security, bug fix, and enhancement update
Released 2020-09-29 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client Optional (v. 7) httpd-2.4.6-95.el7, httpd-devel-2.4.6-95.el7, httpd-manual-2.4.6-95.el7 +5
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) httpd-2.4.6-95.el7, httpd-devel-2.4.6-95.el7, httpd-manual-2.4.6-95.el7 +5
- Red Hat Enterprise Linux Server (v. 7) httpd-2.4.6-95.el7, httpd-devel-2.4.6-95.el7, httpd-manual-2.4.6-95.el7 +3
- Red Hat Enterprise Linux Server Optional (v. 7) mod_ldap-2.4.6-95.el7, mod_proxy_html-1:2.4.6-95.el7
- Red Hat Enterprise Linux Workstation (v. 7) httpd-2.4.6-95.el7, httpd-devel-2.4.6-95.el7, httpd-manual-2.4.6-95.el7 +3
- Red Hat Enterprise Linux Workstation Optional (v. 7) mod_ldap-2.4.6-95.el7, mod_proxy_html-1:2.4.6-95.el7
Fixes 6 records
Priority HIGH 77
In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename.
CVSS 3.0HIGH 8.1· Network · No auth · No interaction · EPSS 0.85452 · Published 2018-03-26 · Partial fix CWE-20
Priority HIGH 70
A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.69802 · Published 2018-03-26 · Partial fix CWE-125
Priority HIGH 66
In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.73981 · Published 2019-09-25 · Partial fix CWE-601
Priority MEDIUM 61
In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request U…
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.56691 · Published 2020-04-01 · Fixed CWE-601
Priority MEDIUM 56
In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.51951 · Published 2020-04-01 · Partial fix CWE-908
Priority LOW 36
In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their content by using a "Session" header.
CVSS 3.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.09737 · Published 2018-03-26 · Fixed
THREATIST.IORead the docs