Alerts This Week
Warning Icon 1 916
Alerts This Week
Warning Icon 1 916

Red Hat Enterprise Linux 8 Security Advisory RHSA-2020-4751-01 for httpd

red hat
Calendar Grey November 4, 2020
Dist Redhat Esm H88
Cautionary update for httpd:2.4 modules in Red Hat systems, including critical bug resolutions and necessary information.
An update for the httpd:2.4 module is now available for Red Hat Enterprise Linux 8

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon will be restarted automatically.

Summary

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.
The following packages have been upgraded to a later upstream version: mod_http2 (1.15.7). (BZ#1814236)
Security Fix(es):
* httpd: memory corruption on early pushes (CVE-2019-10081)
* httpd: read-after-free in h2 connection shutdown (CVE-2019-10082)
* httpd: null-pointer dereference in mod_remoteip (CVE-2019-10097)
* httpd: mod_rewrite configurations vulnerable to open redirect (CVE-2020-1927)
* httpd: mod_http2: DoS via slow, unneeded request bodies (CVE-2018-17189)
* httpd: mod_http2: read-after-free on a string compare (CVE-2019-0196)
* httpd: mod_http2: possible crash on late upgrade (CVE-2019-0197)
* httpd: limited cross-site scripting in mod_proxy error page (CVE-2019-10092)
* httpd: mod_rewrite potential open redirect (CVE-2019-10098)
* httpd: mod_proxy_ftp use of uninitialized value (CVE-2020-1934)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes linked from the References section.

Topics%20covered

Topics Covered

security advisory moderate security issue bug fix Red Hat Enterprise Linux DoS threat httpd module

References

https://access.redhat.com/security/cve/CVE-2018-17189 https://access.redhat.com/security/cve/CVE-2019-0196 https://access.redhat.com/security/cve/CVE-2019-0197 https://access.redhat.com/security/cve/CVE-2019-10081 https://access.redhat.com/security/cve/CVE-2019-10082 https://access.redhat.com/security/cve/CVE-2019-10092 https://access.redhat.com/security/cve/CVE-2019-10097 https://access.redhat.com/security/cve/CVE-2019-10098 https://access.redhat.com/security/cve/CVE-2020-1927 https://access.redhat.com/security/cve/CVE-2020-1934 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/

Package List

Red Hat Enterprise Linux AppStream (v. 8):
Source: httpd-2.4.37-30.module+el8.3.0+7001+0766b9e7.src.rpm mod_http2-1.15.7-2.module+el8.3.0+7670+8bf57d29.src.rpm mod_md-2.0.8-8.module+el8.3.0+6814+67d1e611.src.rpm
aarch64: httpd-2.4.37-30.module+el8.3.0+7001+0766b9e7.aarch64.rpm httpd-debuginfo-2.4.37-30.module+el8.3.0+7001+0766b9e7.aarch64.rpm httpd-debugsource-2.4.37-30.module+el8.3.0+7001+0766b9e7.aarch64.rpm httpd-devel-2.4.37-30.module+el8.3.0+7001+0766b9e7.aarch64.rpm httpd-tools-2.4.37-30.module+el8.3.0+7001+0766b9e7.aarch64.rpm httpd-tools-debuginfo-2.4.37-30.module+el8.3.0+7001+0766b9e7.aarch64.rpm mod_http2-1.15.7-2.module+el8.3.0+7670+8bf57d29.aarch64.rpm mod_http2-debuginfo-1.15.7-2.module+el8.3.0+7670+8bf57d29.aarch64.rpm mod_http2-debugsource-1.15.7-2.module+el8.3.0+7670+8bf57d29.aarch64.rpm mod_ldap-2.4.37-30.module+el8.3.0+7001+0766b9e7.aarch64.rpm mod_ldap-debuginfo-2.4.37-30.module+el8.3.0+7001+0766b9e7.aarch64.rpm mod_md-2.0.8-8.module+el8.3.0+6814+67d1e611.aarch64.rpm mod_md-debuginfo-2.0.8-8.module+el8.3.0+6814+67d1e611.aarch64.rpm mod_md-debugsource-2.0.8-8.module+el8.3.0+6814+67d1e611.aarch64.rpm mod_proxy_html-2.4.37-30.module+el8.3.0+7001+0766b9e7.aarch64.rpm mod_proxy_html-debuginfo-2.4.37-30.module+el8.3.0+7001+0766b9e7.aarch64.rpm

Read the Full Advisory


Advisory ID: RHSA-2020:4751-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2020:4751
Issue date: 2020-11-03

Topic

An update for the httpd:2.4 module is now available for Red Hat EnterpriseLinux 8.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory moderate security issue bug fix Red Hat Enterprise Linux DoS threat httpd module

Relevant Releases Architectures

Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64

Bugs Fixed

1209162 - RFE: CustomLog should be able to use journald

1668497 - CVE-2018-17189 httpd: mod_http2: DoS via slow, unneeded request bodies

1695030 - CVE-2019-0196 httpd: mod_http2: read-after-free on a string compare

1695042 - CVE-2019-0197 httpd: mod_http2: possible crash on late upgrade

1743956 - CVE-2019-10092 httpd: limited cross-site scripting in mod_proxy error page

1743959 - CVE-2019-10098 httpd: mod_rewrite potential open redirect

1743966 - CVE-2019-10081 httpd: memory corruption on early pushes

1743974 - CVE-2019-10082 httpd: read-after-free in h2 connection shutdown

1743996 - CVE-2019-10097 httpd: null-pointer dereference in mod_remoteip

1771847 - BalancerMember ping parameter for mod_proxy_http doesn't work

1814236 - RFE: mod_http2 rebase

1820761 - CVE-2020-1927 httpd: mod_rewrite configurations vulnerable to open redirect

1820772 - CVE-2020-1934 httpd: mod_proxy_ftp use of uninitialized value

1832844 - mod_md does not work with ACME server that does not provide keyChange or revokeCert resources

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here