Scientific Linux: SLSA-2016:1422-1 Important: httpd Proxy Vulnerability

Date: Mon, 18 Jul 2016 21:06:48 -0000
Reply-To: scientific-linux-users@
Sender: Security Errata for Scientific Linux
 
From: Pat Riehecky 
Subject: Security ERRATA Important: httpd on SL7.x x86_64
MIME-Version: 1.0
Message-ID: <20160718210648.20586.75792@slpackages.fnal.gov>

Synopsis: Important: httpd security and bug fix update
Advisory ID: SLSA-2016:1422-1
Issue Date: 2016-07-18
CVE Numbers: CVE-2016-5387
--

Security Fix(es):

* It was discovered that httpd used the value of the Proxy header from
HTTP requests to initialize the HTTP_PROXY environment variable for CGI
scripts, which in turn was incorrectly used by certain HTTP client
implementations to configure the proxy for outgoing HTTP requests. A
remote attacker could possibly use this flaw to redirect HTTP requests
performed by a CGI script to an attacker-controlled proxy via a malicious
HTTP request. (CVE-2016-5387)

Note: After this update, httpd will no longer pass the value of the Proxy
request header to scripts via the HTTP_PROXY environment variable.

Bug Fix(es):

* In a caching proxy configuration, the mod_cache module would treat
content as stale if the Expires header changed when refreshing a cached
response. As a consequence, an origin server returning content without a
fixed Expires header would not be treated as cacheable. The mod_cache
module has been fixed to ignore changes in the Expires header when
refreshing content. As a result, such content is now cacheable, improving
performance and reducing load at the origin server.

* The HTTP status code 451 "Unavailable For Legal Reasons" was not usable
in the httpd configuration. As a consequence, modules such as mod_rewrite
could not be configured to return a 451 error if required for legal
purposes. The 451 status code has been added to the list of available
error codes, and modules can now be configured to return a 451 error if
required.
--

SL7
 x86_64
 httpd-2.4.6-40.el7_2.4.x86_64.rpm
 httpd-debuginfo-2.4.6-40.el7_2.4.x86_64.rpm
 httpd-devel-2.4.6-40.el7_2.4.x86_64.rpm
 httpd-tools-2.4.6-40.el7_2.4.x86_64.rpm
 mod_ldap-2.4.6-40.el7_2.4.x86_64.rpm
 mod_proxy_html-2.4.6-40.el7_2.4.x86_64.rpm
 mod_session-2.4.6-40.el7_2.4.x86_64.rpm
 mod_ssl-2.4.6-40.el7_2.4.x86_64.rpm
 noarch
 httpd-manual-2.4.6-40.el7_2.4.noarch.rpm

- Scientific Linux Development Team