Oracle Linux Security Advisory ELSA-2023-5050

https://linux.oracle.com/errata/ELSA-2023-5050.html

The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network:

x86_64:
httpd-2.4.37-56.0.1.module+el8.8.0+21159+b5186791.7.x86_64.rpm
httpd-devel-2.4.37-56.0.1.module+el8.8.0+21159+b5186791.7.x86_64.rpm
httpd-filesystem-2.4.37-56.0.1.module+el8.8.0+21159+b5186791.7.noarch.rpm
httpd-manual-2.4.37-56.0.1.module+el8.8.0+21159+b5186791.7.noarch.rpm
httpd-tools-2.4.37-56.0.1.module+el8.8.0+21159+b5186791.7.x86_64.rpm
mod_http2-1.15.7-8.module+el8.8.0+21057+13668aee.3.x86_64.rpm
mod_ldap-2.4.37-56.0.1.module+el8.8.0+21159+b5186791.7.x86_64.rpm
mod_md-2.0.8-8.module+el8.5.0+20475+4f6a8fd5.x86_64.rpm
mod_proxy_html-2.4.37-56.0.1.module+el8.8.0+21159+b5186791.7.x86_64.rpm
mod_session-2.4.37-56.0.1.module+el8.8.0+21159+b5186791.7.x86_64.rpm
mod_ssl-2.4.37-56.0.1.module+el8.8.0+21159+b5186791.7.x86_64.rpm

aarch64:
httpd-2.4.37-56.0.1.module+el8.8.0+21159+b5186791.7.aarch64.rpm
httpd-devel-2.4.37-56.0.1.module+el8.8.0+21159+b5186791.7.aarch64.rpm
httpd-filesystem-2.4.37-56.0.1.module+el8.8.0+21159+b5186791.7.noarch.rpm
httpd-manual-2.4.37-56.0.1.module+el8.8.0+21159+b5186791.7.noarch.rpm
httpd-tools-2.4.37-56.0.1.module+el8.8.0+21159+b5186791.7.aarch64.rpm
mod_http2-1.15.7-8.module+el8.8.0+21057+13668aee.3.aarch64.rpm
mod_ldap-2.4.37-56.0.1.module+el8.8.0+21159+b5186791.7.aarch64.rpm
mod_md-2.0.8-8.module+el8.5.0+20475+4f6a8fd5.aarch64.rpm
mod_proxy_html-2.4.37-56.0.1.module+el8.8.0+21159+b5186791.7.aarch64.rpm
mod_session-2.4.37-56.0.1.module+el8.8.0+21159+b5186791.7.aarch64.rpm
mod_ssl-2.4.37-56.0.1.module+el8.8.0+21159+b5186791.7.aarch64.rpm


SRPMS:
https://oss.oracle.com/ol8/SRPMS-updates//httpd-2.4.37-56.0.1.module+el8.8.0+21159+b5186791.7.src.rpm
https://oss.oracle.com/ol8/SRPMS-updates//mod_http2-1.15.7-8.module+el8.8.0+21057+13668aee.3.src.rpm
https://oss.oracle.com/ol8/SRPMS-updates//mod_md-2.0.8-8.module+el8.5.0+20475+4f6a8fd5.src.rpm

Related CVEs:

CVE-2023-27522




Description of changes:

httpd
[2.4.37-56.0.1.7]
- Resolves: #2176723 - CVE-2023-27522 httpd:2.4/httpd: mod_proxy_uwsgi HTTP
  response splitting

[2.4.37-56.0.1.6]
- Set vstring per ORACLE_SUPPORT_PRODUCT [Orabug: 29892262]
- Replace index.html with Oracle's index page oracle_index.html

[2.4.37-56.6]
- Resolves: #2190133 - mod_rewrite regression with CVE-2023-25690

[2.4.37-56.4]
- Resolves: #2177748 - CVE-2023-25690 httpd:2.4/httpd: HTTP request splitting
  with mod_rewrite and mod_proxy

[2.4.37-56]
- Resolves: #2162499 - CVE-2006-20001 httpd: mod_dav: out-of-bounds read/write
  of zero byte
- Resolves: #2162485 - CVE-2022-37436 httpd: mod_proxy: HTTP response splitting
- Resolves: #2162509 - CVE-2022-36760 httpd: mod_proxy_ajp: Possible request
  smuggling

[2.4.37-55]
- Resolves: #2155961 - prevent sscg creating /dhparams.pem

[2.4.37-54]
- Resolves: #2095650 - Dependency from mod_http2 on httpd broken

[2.4.37-53]
- Resolves: #2050888 - httpd with SSL fails to start unless hostname command
  was installed

[2.4.37-52]
- Add the SNI support in mod_proxy_wstunnel module for Apache httpd
- Resolves: rhbz#2017543


mod_http2
[1.15.7-8.3]
- Resolves: #2177748 - CVE-2023-25690 httpd:2.4/httpd: HTTP request splitting
  with mod_rewrite and mod_proxy

[1.15.7-7]
- Resolves: #2095650 - Dependency from mod_http2 on httpd broken

[1.15.7-6]
- Backport SNI feature refactor
- Resolves: rhbz#2137257

mod_md

_______________________________________________
El-errata mailing list
[email protected]
https://oss.oracle.com/mailman/listinfo/el-errata