Stay Secure with the Latest Linux Advisories

security advisoryimportantSUSE

SUSE: 2020:1111-1 Important: Apache2 Security Issues Fixed

An update that fixes three vulnerabilities is now available. . SUSE Security Update: Security update for apache2 ______________________________________________________________________________ Announcement ID: SUSE-SU-2020:1111-1 Rating: important References: #1168404 #1168407 #1169066 Cross-References: CVE-2020-1927 CVE-2020-1934 CVE-2020-1938 Affected Products: SUSE Linux Enterprise Server for SAP 12-SP1 SUSE Linux Enterprise Server 12-SP1-LTSS ______________________________________________________________________________ An update that fixes three vulnerabilities is now available. Description: This update for apache2 fixes the following issues: - CVE-2020-1934: mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server (bsc#1168404). - CVE-2020-1927: mod_rewrite configurations vulnerable to open redirect (bsc#1168407). - CVE-2020-1938: mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy AJP13 authentication (bsc#1169066). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server for SAP 12-SP1: zypper in -t patch SUSE-SLE-SAP-12-SP1-2020-1111=1 - SUSE Linux Enterprise Server 12-SP1-LTSS: zypper in -t patch SUSE-SLE-SERVER-12-SP1-2020-1111=1 Package List: - SUSE Linux Enterprise Server for SAP 12-SP1 (x86_64): apache2-2.4.16-20.29.1 apache2-debuginfo-2.4.16-20.29.1 apache2-debugsource-2.4.16-20.29.1 apache2-example-pages-2.4.16-20.29.1 apache2-prefork-2.4.16-20.29.1 apache2-prefork-debuginfo-2.4.16-20.29.1 apache2-utils-2.4.16-20.29.1 apache2-utils-debuginfo-2.4.16-20.29.1 apache2-worker-2.4.16-20.29.1 apache2-worker-debuginfo-2.4.16-20.29.1 - SUSE LinuxEnterprise Server for SAP 12-SP1 (noarch): apache2-doc-2.4.16-20.29.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (ppc64le s390x x86_64): apache2-2.4.16-20.29.1 apache2-debuginfo-2.4.16-20.29.1 apache2-debugsource-2.4.16-20.29.1 apache2-example-pages-2.4.16-20.29.1 apache2-prefork-2.4.16-20.29.1 apache2-prefork-debuginfo-2.4.16-20.29.1 apache2-utils-2.4.16-20.29.1 apache2-utils-debuginfo-2.4.16-20.29.1 apache2-worker-2.4.16-20.29.1 apache2-worker-debuginfo-2.4.16-20.29.1 - SUSE Linux Enterprise Server 12-SP1-LTSS (noarch): apache2-doc-2.4.16-20.29.1 References: https://www.suse.com/security/cve/CVE-2020-1927.html https://www.suse.com/security/cve/CVE-2020-1934.html https://www.suse.com/security/cve/CVE-2020-1938.html https://bugzilla.suse.com/1168404 https://bugzilla.suse.com/1168407 https://bugzilla.suse.com/1169066 _______________________________________________ sle-security-updates mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. http://lists.suse.com/mailman/listinfo/sle-security-updates . A significant security enhancement has been deployed for SUSE's nginx service, targeting severe vulnerabilities alongside detailed guidance for applying fixes.. SUSE Patch Instructions, apache2 Security Fixes, SUSE Vulnerability Management. . Severity: Important. LinuxSecurity.com Team

Apr 24, 2020 •Important SuSE