Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found -2 articles for you...
217
security advisoryDoS attackOracle LinuxOracle Linux 8 ELSA-2024-1786 Critical: Httpd DoS Attack Resolution
The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network: . Oracle Linux Security Advisory ELSA-2024-1786 https://linux.oracle.com/errata/ELSA-2024-1786.html The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable LinuxNetwork: x86_64: httpd-2.4.37-62.0.1.module+el8.9.0+90011+2f9c6a23.x86_64.rpm httpd-devel-2.4.37-62.0.1.module+el8.9.0+90011+2f9c6a23.x86_64.rpm httpd-filesystem-2.4.37-62.0.1.module+el8.9.0+90011+2f9c6a23.noarch.rpm httpd-manual-2.4.37-62.0.1.module+el8.9.0+90011+2f9c6a23.noarch.rpm httpd-tools-2.4.37-62.0.1.module+el8.9.0+90011+2f9c6a23.x86_64.rpm mod_http2-1.15.7-8.module+el8.9.0+90299+1db10a42.5.x86_64.rpm mod_ldap-2.4.37-62.0.1.module+el8.9.0+90011+2f9c6a23.x86_64.rpm mod_md-2.0.8-8.module+el8.9.0+90011+2f9c6a23.x86_64.rpm mod_proxy_html-2.4.37-62.0.1.module+el8.9.0+90011+2f9c6a23.x86_64.rpm mod_session-2.4.37-62.0.1.module+el8.9.0+90011+2f9c6a23.x86_64.rpm mod_ssl-2.4.37-62.0.1.module+el8.9.0+90011+2f9c6a23.x86_64.rpm aarch64: httpd-2.4.37-62.0.1.module+el8.9.0+90011+2f9c6a23.aarch64.rpm httpd-devel-2.4.37-62.0.1.module+el8.9.0+90011+2f9c6a23.aarch64.rpm httpd-filesystem-2.4.37-62.0.1.module+el8.9.0+90011+2f9c6a23.noarch.rpm httpd-manual-2.4.37-62.0.1.module+el8.9.0+90011+2f9c6a23.noarch.rpm httpd-tools-2.4.37-62.0.1.module+el8.9.0+90011+2f9c6a23.aarch64.rpm mod_http2-1.15.7-8.module+el8.9.0+90299+1db10a42.5.aarch64.rpm mod_ldap-2.4.37-62.0.1.module+el8.9.0+90011+2f9c6a23.aarch64.rpm mod_md-2.0.8-8.module+el8.9.0+90011+2f9c6a23.aarch64.rpm mod_proxy_html-2.4.37-62.0.1.module+el8.9.0+90011+2f9c6a23.aarch64.rpm mod_session-2.4.37-62.0.1.module+el8.9.0+90011+2f9c6a23.aarch64.rpm mod_ssl-2.4.37-62.0.1.module+el8.9.0+90011+2f9c6a23.aarch64.rpm SRPMS: https://oss.oracle.com:443/ol8/SRPMS-updates//httpd-2.4.37-62.0.1.module+el8.9.0+90011+2f9c6a23.src.rpm https://oss.oracle.com:443/ol8/SRPMS-updates//mod_http2-1.15.7-8.module+el8.9.0+90299+1db10a42.5.src.rpm https://oss.oracle.com:443/ol8/SRPMS-updates//mod_md-2.0.8-8.module+el8.9.0+90011+2f9c6a23.src.rpm Related CVEs: CVE-2024-27316 Description of changes: httpd mod_http2 [1.15.7-8.5] - Resolves: RHEL-29816 - httpd:2.4/mod_http2: httpd: CONTINUATION frames DoS (CVE-2024-27316) mod_md _______________________________________________ El-errata mailinglist
Apr 15, 2024
•Critical
Oracle
98
security advisoryremote accessRed Hat Enterprise LinuxRed Hat: RHSA-2017:3193-01 Important: httpd Remote Access Flaws
An update for httpd is now available for Red Hat Enterprise Linux 7.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Important: httpd security update Advisory ID: RHSA-2017:3193-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2017:3193 Issue date: 2017-11-13 CVE Names: CVE-2017-3167 CVE-2017-3169 CVE-2017-7668 CVE-2017-7679 CVE-2017-9788 CVE-2017-9798 ==================================================================== 1. Summary: An update for httpd is now available for Red Hat Enterprise Linux 7.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.2) - noarch, x86_64 Red Hat Enterprise Linux Server EUS (v. 7.2) - noarch, ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux Server Optional EUS (v. 7.2) - ppc64, ppc64le, s390x, x86_64 3. Description: The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * It was discovered that the httpd's mod_auth_digest module did not properly initialize memory before using it when processing certain headersrelated to digest authentication. A remote attacker could possibly use this flaw to disclose potentially sensitive information or cause httpd child process to crash by sending specially crafted requests to a server. (CVE-2017-9788) * It was discovered that the use ofhttpd's ap_get_basic_auth_pw() API function outside of the authentication phase could lead to authentication bypass. A remote attacker could possibly use this flaw to bypass required authentication if the API was used incorrectly by one of the modules used by httpd. (CVE-2017-3167) * A NULL pointer dereference flaw was found in the httpd's mod_ssl module. A remote attacker could use this flaw to cause an httpd child process to crash if another module used by httpd called a certain API function during the processing of an HTTPS request. (CVE-2017-3169) * A buffer over-read flaw was found in the httpd's ap_find_token() function. A remote attacker could use this flaw to cause httpd child process to crash via a specially crafted HTTP request. (CVE-2017-7668) * A buffer over-read flaw was found in the httpd's mod_mime module. A user permitted to modify httpd's MIME configuration could use this flaw to cause httpd child process to crash. (CVE-2017-7679) * A use-after-free flaw was found in the way httpd handled invalid and previously unregistered HTTP methods specified in the Limit directive used in an .htaccess file. A remote attacker could possibly use this flaw to disclose portions of the server memory, or cause httpd child process to crash. (CVE-2017-9798) Red Hat would like to thank Hanno Böck for reporting CVE-2017-9798. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the updated packages, the httpd daemon will be restarted automatically. 5. Bugs fixed (https://bugzilla.redhat.com/): 1463194 - CVE-2017-3167 httpd: ap_get_basic_auth_pw() authentication bypass 1463197 - CVE-2017-3169 httpd: mod_ssl NULL pointer dereference 1463205 - CVE-2017-7668 httpd: ap_find_token() buffer overread 1463207 - CVE-2017-7679 httpd: mod_mime buffer overread 1470748 - CVE-2017-9788 httpd: Uninitialized memory reflection in mod_auth_digest 1490344 - CVE-2017-9798 httpd: Use-after-free bylimiting unregistered HTTP method (Optionsbleed) 6. Package List: Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.2): Source: httpd-2.4.6-40.el7_2.6.src.rpm noarch: httpd-manual-2.4.6-40.el7_2.6.noarch.rpm x86_64: httpd-2.4.6-40.el7_2.6.x86_64.rpm httpd-debuginfo-2.4.6-40.el7_2.6.x86_64.rpm httpd-devel-2.4.6-40.el7_2.6.x86_64.rpm httpd-tools-2.4.6-40.el7_2.6.x86_64.rpm mod_ldap-2.4.6-40.el7_2.6.x86_64.rpm mod_proxy_html-2.4.6-40.el7_2.6.x86_64.rpm mod_session-2.4.6-40.el7_2.6.x86_64.rpm mod_ssl-2.4.6-40.el7_2.6.x86_64.rpm Red Hat Enterprise Linux Server EUS (v. 7.2): Source: httpd-2.4.6-40.el7_2.6.src.rpm noarch: httpd-manual-2.4.6-40.el7_2.6.noarch.rpm ppc64: httpd-2.4.6-40.el7_2.6.ppc64.rpm httpd-debuginfo-2.4.6-40.el7_2.6.ppc64.rpm httpd-devel-2.4.6-40.el7_2.6.ppc64.rpm httpd-tools-2.4.6-40.el7_2.6.ppc64.rpm mod_ssl-2.4.6-40.el7_2.6.ppc64.rpm ppc64le: httpd-2.4.6-40.el7_2.6.ppc64le.rpm httpd-debuginfo-2.4.6-40.el7_2.6.ppc64le.rpm httpd-devel-2.4.6-40.el7_2.6.ppc64le.rpm httpd-tools-2.4.6-40.el7_2.6.ppc64le.rpm mod_ssl-2.4.6-40.el7_2.6.ppc64le.rpm s390x: httpd-2.4.6-40.el7_2.6.s390x.rpm httpd-debuginfo-2.4.6-40.el7_2.6.s390x.rpm httpd-devel-2.4.6-40.el7_2.6.s390x.rpm httpd-tools-2.4.6-40.el7_2.6.s390x.rpm mod_ssl-2.4.6-40.el7_2.6.s390x.rpm x86_64: httpd-2.4.6-40.el7_2.6.x86_64.rpm httpd-debuginfo-2.4.6-40.el7_2.6.x86_64.rpm httpd-devel-2.4.6-40.el7_2.6.x86_64.rpm httpd-tools-2.4.6-40.el7_2.6.x86_64.rpm mod_ssl-2.4.6-40.el7_2.6.x86_64.rpm Red Hat Enterprise Linux Server Optional EUS (v.7.2): ppc64: httpd-debuginfo-2.4.6-40.el7_2.6.ppc64.rpm mod_ldap-2.4.6-40.el7_2.6.ppc64.rpm mod_proxy_html-2.4.6-40.el7_2.6.ppc64.rpm mod_session-2.4.6-40.el7_2.6.ppc64.rpm ppc64le: httpd-debuginfo-2.4.6-40.el7_2.6.ppc64le.rpm mod_ldap-2.4.6-40.el7_2.6.ppc64le.rpm mod_proxy_html-2.4.6-40.el7_2.6.ppc64le.rpm mod_session-2.4.6-40.el7_2.6.ppc64le.rpm s390x: httpd-debuginfo-2.4.6-40.el7_2.6.s390x.rpm mod_ldap-2.4.6-40.el7_2.6.s390x.rpm mod_proxy_html-2.4.6-40.el7_2.6.s390x.rpm mod_session-2.4.6-40.el7_2.6.s390x.rpm x86_64: httpd-debuginfo-2.4.6-40.el7_2.6.x86_64.rpm mod_ldap-2.4.6-40.el7_2.6.x86_64.rpm mod_proxy_html-2.4.6-40.el7_2.6.x86_64.rpm mod_session-2.4.6-40.el7_2.6.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2017-3167 https://access.redhat.com/security/cve/CVE-2017-3169 https://access.redhat.com/security/cve/CVE-2017-7668 https://access.redhat.com/security/cve/CVE-2017-7679 https://access.redhat.com/security/cve/CVE-2017-9788 https://access.redhat.com/security/cve/CVE-2017-9798 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2017 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFaCdgMXlSAg2UNWIIRAuCYAJ9LY/xg1awkDLjJskMcpUuLOiyVBQCfU+HY auQoPkY9/gL66Tm/gwYtzKc=vYV+ -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Nov 13, 2017
•Important
Red Hat
99
security advisorysecurity updatemoderate threatSlackware 14.0 Security Update 2015-198-01 Moderate: Httpd Threat Fix
New httpd packages are available for Slackware 14.0, 14.1, and -current to fix security issues. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] httpd (SSA:2015-198-01) New httpd packages are available for Slackware 14.0, 14.1, and -current to fix security issues. Here are the details from the Slackware 14.1 ChangeLog: +--------------------------+ patches/packages/httpd-2.4.16-i486-1_slack14.1.txz: Upgraded. This update fixes the following security issues: * CVE-2015-0253: Fix a crash with ErrorDocument 400 pointing to a local URL-path with the INCLUDES filter active, introduced in 2.4.11. * CVE-2015-0228: mod_lua: A maliciously crafted websockets PING after a script calls r:wsupgrade() can cause a child process crash. * CVE-2015-3183: core: Fix chunk header parsing defect. Remove apr_brigade_flatten(), buffering and duplicated code from the HTTP_IN filter, parse chunks in a single pass with zero copy. Limit accepted chunk-size to 2^63-1 and be strict about chunk-ext authorized characters. * CVE-2015-3185: Replacement of ap_some_auth_required (unusable in Apache httpd 2.4) with new ap_some_authn_required and ap_force_authn hook. For more information, see: https://www.cve.org/CVERecord?id=CVE-2015-0228 https://www.cve.org/CVERecord?id=CVE-2015-0253 https://www.cve.org/CVERecord?id=CVE-2015-3183 https://www.cve.org/CVERecord?id=CVE-2015-3185 (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ Thanks to the friendly folks at the OSU Open Source Lab (https://osuosl.org/) for donating FTP and rsync hosting to the Slackware project! :-) Also see the "Get Slack" section on http://www.slackware.com/ for additional mirror sites near you. Updated package for Slackware 14.0: Updated package for Slackware x86_64 14.0: Updated package for Slackware 14.1: Updated package for Slackware x86_64 14.1: Updated package for Slackware -current: Updated package for Slackwarex86_64 -current: MD5 signatures: +-------------+ Slackware 14.0 package: d78c9925e69ba6ce14d67fb67245981b httpd-2.4.16-i486-1_slack14.0.txz Slackware x86_64 14.0 package: 1370e3c7e135bf07b65e73049099a942 httpd-2.4.16-x86_64-1_slack14.0.txz Slackware 14.1 package: ea116c45bba8c80f59cfe0394a8f87fa httpd-2.4.16-i486-1_slack14.1.txz Slackware x86_64 14.1 package: 8b5b1caa1fa203b07b529f77834fac16 httpd-2.4.16-x86_64-1_slack14.1.txz Slackware -current package: 01ccb961f17bd14c1d157892af4c9f1d n/httpd-2.4.16-i586-1.txz Slackware x86_64 -current package: 70a6644de3585007861e57cf08608843 n/httpd-2.4.16-x86_64-1.txz Installation instructions: +------------------------+ Upgrade the package as root: # upgradepkg httpd-2.4.16-i486-1_slack14.1.txz Then, restart Apache httpd: # /etc/rc.d/rc.httpd stop # /etc/rc.d/rc.httpd start +-----+ . Critical security patches for httpd on Slackware 14.0, 14.1, and -current are essential for protecting your server and mitigating vulnerabilities. httpd Security, Slackware Update, Package Protection. . LinuxSecurity.com Team
Jul 17, 2015
Slackware
98
security advisorysecurity issuelow severityRed Hat Software Collections 1: RHSA-2014:1972-01 Low: httpd24-httpd Fix
Updated httpd24-httpd packages that fix two security issues and one bug are now available for Red Hat Software Collections 1. Red Hat Product Security has rated this update as having Low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Low: httpd24-httpd security and bug fix update Advisory ID: RHSA-2014:1972-01 Product: Red Hat Software Collections Advisory URL: https://access.redhat.com/errata/RHSA-2014:1972.html Issue date: 2014-12-09 CVE Names: CVE-2013-5704 CVE-2014-3581 ==================================================================== 1. Summary: Updated httpd24-httpd packages that fix two security issues and one bug are now available for Red Hat Software Collections 1. Red Hat Product Security has rated this update as having Low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 6) - noarch, x86_64 Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 7) - noarch, x86_64 Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.4) - noarch, x86_64 Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.5) - noarch, x86_64 Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.6) - noarch, x86_64 Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 6) - noarch, x86_64 Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64 3. Description: The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. A NULL pointerdereference flaw was found in the way the mod_cache httpd module handled Content-Type headers. A malicious HTTP server could cause the httpd child process to crash when the Apache HTTP server was configured to proxy to a server with caching enabled. (CVE-2014-3581) A flaw was found in the way httpd handled HTTP Trailer headers when processing requests using chunked encoding. A malicious client could use Trailer headers to set additional HTTP headers after header processing was performed by other modules. This could, for example, lead to a bypass of header restrictions defined with mod_headers. (CVE-2013-5704) Note: With this update, httpd has been modified to not merge HTTP Trailer headers with other HTTP request headers. A newly introduced configuration directive MergeTrailers can be used to re-enable the old method of processing Trailer headers, which also re-introduces the aforementioned flaw. This update also fixes the following bug: * Prior to this update, the mod_proxy_wstunnel module failed to set up an SSL connection when configured to use a back end server using the "wss:" URL scheme, causing proxied connections to fail. In these updated packages, SSL is used when proxying to "wss:" back end servers. (BZ#1141950) All httpd24-httpd users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd24-httpd service will be restarted automatically. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1082903 - CVE-2013-5704 httpd: bypass of mod_headers rules via chunked requests 1141950 - Request to resolve upstream bug 55320 1149709 - CVE-2014-3581 httpd: NULL pointer dereference in mod_cache if Content-Type has emptyvalue 6. Package List: Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 6): Source: httpd24-httpd-2.4.6-22.el6.src.rpm noarch: httpd24-httpd-manual-2.4.6-22.el6.noarch.rpm x86_64: httpd24-httpd-2.4.6-22.el6.x86_64.rpm httpd24-httpd-debuginfo-2.4.6-22.el6.x86_64.rpm httpd24-httpd-devel-2.4.6-22.el6.x86_64.rpm httpd24-httpd-tools-2.4.6-22.el6.x86_64.rpm httpd24-mod_ldap-2.4.6-22.el6.x86_64.rpm httpd24-mod_proxy_html-2.4.6-22.el6.x86_64.rpm httpd24-mod_session-2.4.6-22.el6.x86_64.rpm httpd24-mod_ssl-2.4.6-22.el6.x86_64.rpm Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.4): Source: httpd24-httpd-2.4.6-22.el6.src.rpm noarch: httpd24-httpd-manual-2.4.6-22.el6.noarch.rpm x86_64: httpd24-httpd-2.4.6-22.el6.x86_64.rpm httpd24-httpd-debuginfo-2.4.6-22.el6.x86_64.rpm httpd24-httpd-devel-2.4.6-22.el6.x86_64.rpm httpd24-httpd-tools-2.4.6-22.el6.x86_64.rpm httpd24-mod_ldap-2.4.6-22.el6.x86_64.rpm httpd24-mod_proxy_html-2.4.6-22.el6.x86_64.rpm httpd24-mod_session-2.4.6-22.el6.x86_64.rpm httpd24-mod_ssl-2.4.6-22.el6.x86_64.rpm Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.5): Source: httpd24-httpd-2.4.6-22.el6.src.rpm noarch: httpd24-httpd-manual-2.4.6-22.el6.noarch.rpm x86_64: httpd24-httpd-2.4.6-22.el6.x86_64.rpm httpd24-httpd-debuginfo-2.4.6-22.el6.x86_64.rpm httpd24-httpd-devel-2.4.6-22.el6.x86_64.rpm httpd24-httpd-tools-2.4.6-22.el6.x86_64.rpm httpd24-mod_ldap-2.4.6-22.el6.x86_64.rpm httpd24-mod_proxy_html-2.4.6-22.el6.x86_64.rpm httpd24-mod_session-2.4.6-22.el6.x86_64.rpm httpd24-mod_ssl-2.4.6-22.el6.x86_64.rpm Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v.6.6): Source: httpd24-httpd-2.4.6-22.el6.src.rpm noarch: httpd24-httpd-manual-2.4.6-22.el6.noarch.rpm x86_64: httpd24-httpd-2.4.6-22.el6.x86_64.rpm httpd24-httpd-debuginfo-2.4.6-22.el6.x86_64.rpm httpd24-httpd-devel-2.4.6-22.el6.x86_64.rpm httpd24-httpd-tools-2.4.6-22.el6.x86_64.rpm httpd24-mod_ldap-2.4.6-22.el6.x86_64.rpm httpd24-mod_proxy_html-2.4.6-22.el6.x86_64.rpm httpd24-mod_session-2.4.6-22.el6.x86_64.rpm httpd24-mod_ssl-2.4.6-22.el6.x86_64.rpm Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 6): Source: httpd24-httpd-2.4.6-22.el6.src.rpm noarch: httpd24-httpd-manual-2.4.6-22.el6.noarch.rpm x86_64: httpd24-httpd-2.4.6-22.el6.x86_64.rpm httpd24-httpd-debuginfo-2.4.6-22.el6.x86_64.rpm httpd24-httpd-devel-2.4.6-22.el6.x86_64.rpm httpd24-httpd-tools-2.4.6-22.el6.x86_64.rpm httpd24-mod_ldap-2.4.6-22.el6.x86_64.rpm httpd24-mod_proxy_html-2.4.6-22.el6.x86_64.rpm httpd24-mod_session-2.4.6-22.el6.x86_64.rpm httpd24-mod_ssl-2.4.6-22.el6.x86_64.rpm Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 7): Source: httpd24-httpd-2.4.6-25.el7.src.rpm noarch: httpd24-httpd-manual-2.4.6-25.el7.noarch.rpm x86_64: httpd24-httpd-2.4.6-25.el7.x86_64.rpm httpd24-httpd-debuginfo-2.4.6-25.el7.x86_64.rpm httpd24-httpd-devel-2.4.6-25.el7.x86_64.rpm httpd24-httpd-tools-2.4.6-25.el7.x86_64.rpm httpd24-mod_ldap-2.4.6-25.el7.x86_64.rpm httpd24-mod_proxy_html-2.4.6-25.el7.x86_64.rpm httpd24-mod_session-2.4.6-25.el7.x86_64.rpm httpd24-mod_ssl-2.4.6-25.el7.x86_64.rpm Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v.7): Source: httpd24-httpd-2.4.6-25.el7.src.rpm noarch: httpd24-httpd-manual-2.4.6-25.el7.noarch.rpm x86_64: httpd24-httpd-2.4.6-25.el7.x86_64.rpm httpd24-httpd-debuginfo-2.4.6-25.el7.x86_64.rpm httpd24-httpd-devel-2.4.6-25.el7.x86_64.rpm httpd24-httpd-tools-2.4.6-25.el7.x86_64.rpm httpd24-mod_ldap-2.4.6-25.el7.x86_64.rpm httpd24-mod_proxy_html-2.4.6-25.el7.x86_64.rpm httpd24-mod_session-2.4.6-25.el7.x86_64.rpm httpd24-mod_ssl-2.4.6-25.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2013-5704 https://access.redhat.com/security/cve/CVE-2014-3581 https://access.redhat.com/security/updates/classification#low 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2014 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD4DBQFUh2FSXlSAg2UNWIIRAudvAJjX0bNmMy9TpaEFCy15RnFruYumAKC3/408 xi65+FDI/ZqlTVHLwuMWog==HvGW -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list
Dec 09, 2014
•Low
Red Hat
98
security advisorylow severityhttpd updateRed Hat: RHSA-2014:1972-01 Low Severity: Httpd Security Update
Updated httpd24-httpd packages that fix two security issues and one bug are now available for Red Hat Software Collections 1. Red Hat Product Security has rated this update as having Low security [More...]. ==================================================================== Red Hat Security Advisory Synopsis: Low: httpd24-httpd security and bug fix update Advisory ID: RHSA-2014:1972-01 Product: Red Hat Software Collections Advisory URL: https://access.redhat.com/errata/RHSA-2014:1972.html Issue date: 2014-12-09 CVE Names: CVE-2013-5704 CVE-2014-3581 ==================================================================== 1. Summary: Updated httpd24-httpd packages that fix two security issues and one bug are now available for Red Hat Software Collections 1. Red Hat Product Security has rated this update as having Low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 6) - noarch, x86_64 Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 7) - noarch, x86_64 Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.4) - noarch, x86_64 Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.5) - noarch, x86_64 Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.6) - noarch, x86_64 Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 6) - noarch, x86_64 Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64 3. Description: The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. A NULL pointer dereference flaw was found in the way the mod_cache httpd module handled Content-Type headers. A malicious HTTP servercould cause the httpd child process to crash when the Apache HTTP server was configured to proxy to a server with caching enabled. (CVE-2014-3581) A flaw was found in the way httpd handled HTTP Trailer headers when processing requests using chunked encoding. A malicious client could use Trailer headers to set additional HTTP headers after header processing was performed by other modules. This could, for example, lead to a bypass of header restrictions defined with mod_headers. (CVE-2013-5704) Note: With this update, httpd has been modified to not merge HTTP Trailer headers with other HTTP request headers. A newly introduced configuration directive MergeTrailers can be used to re-enable the old method of processing Trailer headers, which also re-introduces the aforementioned flaw. This update also fixes the following bug: * Prior to this update, the mod_proxy_wstunnel module failed to set up an SSL connection when configured to use a back end server using the "wss:" URL scheme, causing proxied connections to fail. In these updated packages, SSL is used when proxying to "wss:" back end servers. (BZ#1141950) All httpd24-httpd users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd24-httpd service will be restarted automatically. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1082903 - CVE-2013-5704 httpd: bypass of mod_headers rules via chunked requests 1141950 - Request to resolve upstream bug 55320 1149709 - CVE-2014-3581 httpd: NULL pointer dereference in mod_cache if Content-Type has empty value 6. Package List: Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v.6): Source: httpd24-httpd-2.4.6-22.el6.src.rpm noarch: httpd24-httpd-manual-2.4.6-22.el6.noarch.rpm x86_64: httpd24-httpd-2.4.6-22.el6.x86_64.rpm httpd24-httpd-debuginfo-2.4.6-22.el6.x86_64.rpm httpd24-httpd-devel-2.4.6-22.el6.x86_64.rpm httpd24-httpd-tools-2.4.6-22.el6.x86_64.rpm httpd24-mod_ldap-2.4.6-22.el6.x86_64.rpm httpd24-mod_proxy_html-2.4.6-22.el6.x86_64.rpm httpd24-mod_session-2.4.6-22.el6.x86_64.rpm httpd24-mod_ssl-2.4.6-22.el6.x86_64.rpm Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.4): Source: httpd24-httpd-2.4.6-22.el6.src.rpm noarch: httpd24-httpd-manual-2.4.6-22.el6.noarch.rpm x86_64: httpd24-httpd-2.4.6-22.el6.x86_64.rpm httpd24-httpd-debuginfo-2.4.6-22.el6.x86_64.rpm httpd24-httpd-devel-2.4.6-22.el6.x86_64.rpm httpd24-httpd-tools-2.4.6-22.el6.x86_64.rpm httpd24-mod_ldap-2.4.6-22.el6.x86_64.rpm httpd24-mod_proxy_html-2.4.6-22.el6.x86_64.rpm httpd24-mod_session-2.4.6-22.el6.x86_64.rpm httpd24-mod_ssl-2.4.6-22.el6.x86_64.rpm Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.5): Source: httpd24-httpd-2.4.6-22.el6.src.rpm noarch: httpd24-httpd-manual-2.4.6-22.el6.noarch.rpm x86_64: httpd24-httpd-2.4.6-22.el6.x86_64.rpm httpd24-httpd-debuginfo-2.4.6-22.el6.x86_64.rpm httpd24-httpd-devel-2.4.6-22.el6.x86_64.rpm httpd24-httpd-tools-2.4.6-22.el6.x86_64.rpm httpd24-mod_ldap-2.4.6-22.el6.x86_64.rpm httpd24-mod_proxy_html-2.4.6-22.el6.x86_64.rpm httpd24-mod_session-2.4.6-22.el6.x86_64.rpm httpd24-mod_ssl-2.4.6-22.el6.x86_64.rpm Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v.6.6): Source: httpd24-httpd-2.4.6-22.el6.src.rpm noarch: httpd24-httpd-manual-2.4.6-22.el6.noarch.rpm x86_64: httpd24-httpd-2.4.6-22.el6.x86_64.rpm httpd24-httpd-debuginfo-2.4.6-22.el6.x86_64.rpm httpd24-httpd-devel-2.4.6-22.el6.x86_64.rpm httpd24-httpd-tools-2.4.6-22.el6.x86_64.rpm httpd24-mod_ldap-2.4.6-22.el6.x86_64.rpm httpd24-mod_proxy_html-2.4.6-22.el6.x86_64.rpm httpd24-mod_session-2.4.6-22.el6.x86_64.rpm httpd24-mod_ssl-2.4.6-22.el6.x86_64.rpm Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 6): Source: httpd24-httpd-2.4.6-22.el6.src.rpm noarch: httpd24-httpd-manual-2.4.6-22.el6.noarch.rpm x86_64: httpd24-httpd-2.4.6-22.el6.x86_64.rpm httpd24-httpd-debuginfo-2.4.6-22.el6.x86_64.rpm httpd24-httpd-devel-2.4.6-22.el6.x86_64.rpm httpd24-httpd-tools-2.4.6-22.el6.x86_64.rpm httpd24-mod_ldap-2.4.6-22.el6.x86_64.rpm httpd24-mod_proxy_html-2.4.6-22.el6.x86_64.rpm httpd24-mod_session-2.4.6-22.el6.x86_64.rpm httpd24-mod_ssl-2.4.6-22.el6.x86_64.rpm Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 7): Source: httpd24-httpd-2.4.6-25.el7.src.rpm noarch: httpd24-httpd-manual-2.4.6-25.el7.noarch.rpm x86_64: httpd24-httpd-2.4.6-25.el7.x86_64.rpm httpd24-httpd-debuginfo-2.4.6-25.el7.x86_64.rpm httpd24-httpd-devel-2.4.6-25.el7.x86_64.rpm httpd24-httpd-tools-2.4.6-25.el7.x86_64.rpm httpd24-mod_ldap-2.4.6-25.el7.x86_64.rpm httpd24-mod_proxy_html-2.4.6-25.el7.x86_64.rpm httpd24-mod_session-2.4.6-25.el7.x86_64.rpm httpd24-mod_ssl-2.4.6-25.el7.x86_64.rpm Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v.7): Source: httpd24-httpd-2.4.6-25.el7.src.rpm noarch: httpd24-httpd-manual-2.4.6-25.el7.noarch.rpm x86_64: httpd24-httpd-2.4.6-25.el7.x86_64.rpm httpd24-httpd-debuginfo-2.4.6-25.el7.x86_64.rpm httpd24-httpd-devel-2.4.6-25.el7.x86_64.rpm httpd24-httpd-tools-2.4.6-25.el7.x86_64.rpm httpd24-mod_ldap-2.4.6-25.el7.x86_64.rpm httpd24-mod_proxy_html-2.4.6-25.el7.x86_64.rpm httpd24-mod_session-2.4.6-25.el7.x86_64.rpm httpd24-mod_ssl-2.4.6-25.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2013-5704 https://access.redhat.com/security/cve/CVE-2014-3581 https://access.redhat.com/security/updates/classification#low 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2014 Red Hat, Inc. . ==================================================================== Red Hat Security Advisory Synop. updated, httpd24-httpd, packages, security. . Severity: Low. LinuxSecurity.com Team
Dec 09, 2014
•Low
Red Hat
98
security advisorymoderateremote exploitRed Hat: RHSA-2011:1391-01 Moderate: httpd Remote Exploit
Updated httpd packages that fix two security issues and one bug are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: httpd security and bug fix update Advisory ID: RHSA-2011:1391-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2011:1391.html Issue date: 2011-10-20 CVE Names: CVE-2011-3348 CVE-2011-3368 ==================================================================== 1. Summary: Updated httpd packages that fix two security issues and one bug are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, noarch, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - noarch, x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, noarch, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, noarch, x86_64 3. Description: The Apache HTTP Server is a popular web server. It was discovered that the Apache HTTP Server did not properly validate the request URI for proxied requests. In certain configurations, if a reverse proxy used the ProxyPassMatch directive, or if it used the RewriteRule directive with the proxy flag, a remote attacker could make the proxy connect to an arbitrary server, possibly disclosing sensitiveinformation from internal web servers not directly accessible to the attacker. (CVE-2011-3368) It was discovered that mod_proxy_ajp incorrectly returned an "Internal Server Error" response when processing certain malformed HTTP requests, which caused the back-end server to be marked as failed in configurations where mod_proxy was used in load balancer mode. A remote attacker could cause mod_proxy to not send requests to back-end AJP (Apache JServ Protocol) servers for the retry timeout period or until all back-end servers were marked as failed. (CVE-2011-3348) Red Hat would like to thank Context Information Security for reporting the CVE-2011-3368 issue. This update also fixes the following bug: * The fix for CVE-2011-3192 provided by the RHSA-2011:1245 update introduced regressions in the way httpd handled certain Range HTTP header values. This update corrects those regressions. (BZ#736592) All httpd users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the httpd daemon must be restarted for the update to take effect. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/kb/docs/DOC-11259 5. Bugs fixed (http://bugzilla.redhat.com/): 736592 - httpd: RHSA-2011:1245 regressions [rhel-6] 736690 - CVE-2011-3348 httpd: mod_proxy_ajp remote temporary DoS 740045 - CVE-2011-3368 httpd: reverse web proxy vulnerability 6. Package List: Red Hat Enterprise Linux Desktop (v. 6): Source: i386: httpd-2.2.15-9.el6_1.3.i686.rpm httpd-debuginfo-2.2.15-9.el6_1.3.i686.rpm httpd-tools-2.2.15-9.el6_1.3.i686.rpm x86_64: httpd-2.2.15-9.el6_1.3.x86_64.rpm httpd-debuginfo-2.2.15-9.el6_1.3.x86_64.rpm httpd-tools-2.2.15-9.el6_1.3.x86_64.rpm Red Hat Enterprise Linux Desktop Optional (v.6): Source: i386: httpd-debuginfo-2.2.15-9.el6_1.3.i686.rpm httpd-devel-2.2.15-9.el6_1.3.i686.rpm mod_ssl-2.2.15-9.el6_1.3.i686.rpm noarch: httpd-manual-2.2.15-9.el6_1.3.noarch.rpm x86_64: httpd-debuginfo-2.2.15-9.el6_1.3.i686.rpm httpd-debuginfo-2.2.15-9.el6_1.3.x86_64.rpm httpd-devel-2.2.15-9.el6_1.3.i686.rpm httpd-devel-2.2.15-9.el6_1.3.x86_64.rpm mod_ssl-2.2.15-9.el6_1.3.x86_64.rpm Red Hat Enterprise Linux HPC Node (v. 6): Source: x86_64: httpd-2.2.15-9.el6_1.3.x86_64.rpm httpd-debuginfo-2.2.15-9.el6_1.3.x86_64.rpm httpd-tools-2.2.15-9.el6_1.3.x86_64.rpm Red Hat Enterprise Linux HPC Node Optional (v. 6): Source: noarch: httpd-manual-2.2.15-9.el6_1.3.noarch.rpm x86_64: httpd-debuginfo-2.2.15-9.el6_1.3.i686.rpm httpd-debuginfo-2.2.15-9.el6_1.3.x86_64.rpm httpd-devel-2.2.15-9.el6_1.3.i686.rpm httpd-devel-2.2.15-9.el6_1.3.x86_64.rpm mod_ssl-2.2.15-9.el6_1.3.x86_64.rpm Red Hat Enterprise Linux Server (v. 6): Source: i386: httpd-2.2.15-9.el6_1.3.i686.rpm httpd-debuginfo-2.2.15-9.el6_1.3.i686.rpm httpd-devel-2.2.15-9.el6_1.3.i686.rpm httpd-tools-2.2.15-9.el6_1.3.i686.rpm mod_ssl-2.2.15-9.el6_1.3.i686.rpm noarch: httpd-manual-2.2.15-9.el6_1.3.noarch.rpm ppc64: httpd-2.2.15-9.el6_1.3.ppc64.rpm httpd-debuginfo-2.2.15-9.el6_1.3.ppc.rpm httpd-debuginfo-2.2.15-9.el6_1.3.ppc64.rpm httpd-devel-2.2.15-9.el6_1.3.ppc.rpm httpd-devel-2.2.15-9.el6_1.3.ppc64.rpm httpd-tools-2.2.15-9.el6_1.3.ppc64.rpm mod_ssl-2.2.15-9.el6_1.3.ppc64.rpm s390x: httpd-2.2.15-9.el6_1.3.s390x.rpm httpd-debuginfo-2.2.15-9.el6_1.3.s390.rpm httpd-debuginfo-2.2.15-9.el6_1.3.s390x.rpm httpd-devel-2.2.15-9.el6_1.3.s390.rpm httpd-devel-2.2.15-9.el6_1.3.s390x.rpm httpd-tools-2.2.15-9.el6_1.3.s390x.rpm mod_ssl-2.2.15-9.el6_1.3.s390x.rpm x86_64: httpd-2.2.15-9.el6_1.3.x86_64.rpm httpd-debuginfo-2.2.15-9.el6_1.3.i686.rpm httpd-debuginfo-2.2.15-9.el6_1.3.x86_64.rpm httpd-devel-2.2.15-9.el6_1.3.i686.rpm httpd-devel-2.2.15-9.el6_1.3.x86_64.rpm httpd-tools-2.2.15-9.el6_1.3.x86_64.rpm mod_ssl-2.2.15-9.el6_1.3.x86_64.rpm Red Hat Enterprise LinuxWorkstation (v. 6): Source: i386: httpd-2.2.15-9.el6_1.3.i686.rpm httpd-debuginfo-2.2.15-9.el6_1.3.i686.rpm httpd-devel-2.2.15-9.el6_1.3.i686.rpm httpd-tools-2.2.15-9.el6_1.3.i686.rpm mod_ssl-2.2.15-9.el6_1.3.i686.rpm noarch: httpd-manual-2.2.15-9.el6_1.3.noarch.rpm x86_64: httpd-2.2.15-9.el6_1.3.x86_64.rpm httpd-debuginfo-2.2.15-9.el6_1.3.i686.rpm httpd-debuginfo-2.2.15-9.el6_1.3.x86_64.rpm httpd-devel-2.2.15-9.el6_1.3.i686.rpm httpd-devel-2.2.15-9.el6_1.3.x86_64.rpm httpd-tools-2.2.15-9.el6_1.3.x86_64.rpm mod_ssl-2.2.15-9.el6_1.3.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://access.redhat.com/security/cve/CVE-2011-3348 https://access.redhat.com/security/cve/CVE-2011-3368 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/errata/RHSA-2011:1245.html 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2011 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFOoFwtXlSAg2UNWIIRArNFAJ4wl+RBSDavBY4s30osXuQolAExpgCfdnq4 jqEdmfFTEkx4L2vdRBd3Ux8=yDza -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list
Oct 20, 2011
Red Hat
200
security advisorycritical issuesecurity patchScientific Linux: 2005 Security Updates for Mozilla and Httpd
Critical: mozilla security update. Date: Mon, 12 Sep 2005 17:35:53 -0500 Reply-To: Connie Sieh Sender: Security Errata for Scientific Linux From: Connie Sieh Subject: ERRATA for SL 40,41 i386 now available Comments: To:
Sep 12, 2005
•Critical
Scientific Linux
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!