Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.1135
httpd security, bug fix, and enhancement update
1 April 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: httpd
Publisher: Red Hat
Operating System: Red Hat Enterprise Linux Server 7
Red Hat Enterprise Linux WS/Desktop 7
Impact/Access: Denial of Service -- Remote/Unauthenticated
Reduced Security -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2018-17199 CVE-2018-1301 CVE-2017-15710
Reference: ASB-2020.0001
ESB-2019.4614
ESB-2019.4403
ESB-2019.1240
Original Bulletin:
https://access.redhat.com/errata/RHSA-2020:1121
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: httpd security, bug fix, and enhancement update
Advisory ID: RHSA-2020:1121-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2020:1121
Issue date: 2020-03-31
CVE Names: CVE-2017-15710 CVE-2018-1301 CVE-2018-17199
=====================================================================
1. Summary:
An update for httpd is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Client Optional (v. 7) - noarch, x86_64
Red Hat Enterprise Linux ComputeNode Optional (v. 7) - noarch, x86_64
Red Hat Enterprise Linux Server (v. 7) - noarch, ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 7) - ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64
Red Hat Enterprise Linux Workstation Optional (v. 7) - x86_64
3. Description:
The httpd packages provide the Apache HTTP Server, a powerful, efficient,
and extensible web server.
Security Fix(es):
* httpd: mod_session_cookie does not respect expiry time (CVE-2018-17199)
* httpd: Out of bounds write in mod_authnz_ldap when using too small
Accept-Language values (CVE-2017-15710)
* httpd: Out of bounds access after failure in reading the HTTP request
(CVE-2018-1301)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat
Enterprise Linux 7.8 Release Notes linked from the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing the updated packages, the httpd daemon will be restarted
automatically.
5. Bugs fixed (https://bugzilla.redhat.com/):
1486889 - htpasswd: support SHA-x passwords for FIPS compatibility
1560599 - CVE-2017-15710 httpd: Out of bounds write in mod_authnz_ldap when using too small Accept-Language values
1560643 - CVE-2018-1301 httpd: Out of bounds access after failure in reading the HTTP request
1630886 - scriptlet can fail if hostname is not installed
1633152 - mod_session missing apr-util-openssl
1649470 - httpd response contains garbage in Content-Type header
1668493 - CVE-2018-17199 httpd: mod_session_cookie does not respect expiry time
1673457 - Apache child process crashes because ScriptAliasMatch directive.
1724034 - Unexpected OCSP in proxy SSL connection
6. Package List:
Red Hat Enterprise Linux Client Optional (v. 7):
Source:
httpd-2.4.6-93.el7.src.rpm
noarch:
httpd-manual-2.4.6-93.el7.noarch.rpm
x86_64:
httpd-2.4.6-93.el7.x86_64.rpm
httpd-debuginfo-2.4.6-93.el7.x86_64.rpm
httpd-devel-2.4.6-93.el7.x86_64.rpm
httpd-tools-2.4.6-93.el7.x86_64.rpm
mod_ldap-2.4.6-93.el7.x86_64.rpm
mod_proxy_html-2.4.6-93.el7.x86_64.rpm
mod_session-2.4.6-93.el7.x86_64.rpm
mod_ssl-2.4.6-93.el7.x86_64.rpm
Red Hat Enterprise Linux ComputeNode Optional (v. 7):
Source:
httpd-2.4.6-93.el7.src.rpm
noarch:
httpd-manual-2.4.6-93.el7.noarch.rpm
x86_64:
httpd-2.4.6-93.el7.x86_64.rpm
httpd-debuginfo-2.4.6-93.el7.x86_64.rpm
httpd-devel-2.4.6-93.el7.x86_64.rpm
httpd-tools-2.4.6-93.el7.x86_64.rpm
mod_ldap-2.4.6-93.el7.x86_64.rpm
mod_proxy_html-2.4.6-93.el7.x86_64.rpm
mod_session-2.4.6-93.el7.x86_64.rpm
mod_ssl-2.4.6-93.el7.x86_64.rpm
Red Hat Enterprise Linux Server (v. 7):
Source:
httpd-2.4.6-93.el7.src.rpm
noarch:
httpd-manual-2.4.6-93.el7.noarch.rpm
ppc64:
httpd-2.4.6-93.el7.ppc64.rpm
httpd-debuginfo-2.4.6-93.el7.ppc64.rpm
httpd-devel-2.4.6-93.el7.ppc64.rpm
httpd-tools-2.4.6-93.el7.ppc64.rpm
mod_session-2.4.6-93.el7.ppc64.rpm
mod_ssl-2.4.6-93.el7.ppc64.rpm
ppc64le:
httpd-2.4.6-93.el7.ppc64le.rpm
httpd-debuginfo-2.4.6-93.el7.ppc64le.rpm
httpd-devel-2.4.6-93.el7.ppc64le.rpm
httpd-tools-2.4.6-93.el7.ppc64le.rpm
mod_session-2.4.6-93.el7.ppc64le.rpm
mod_ssl-2.4.6-93.el7.ppc64le.rpm
s390x:
httpd-2.4.6-93.el7.s390x.rpm
httpd-debuginfo-2.4.6-93.el7.s390x.rpm
httpd-devel-2.4.6-93.el7.s390x.rpm
httpd-tools-2.4.6-93.el7.s390x.rpm
mod_session-2.4.6-93.el7.s390x.rpm
mod_ssl-2.4.6-93.el7.s390x.rpm
x86_64:
httpd-2.4.6-93.el7.x86_64.rpm
httpd-debuginfo-2.4.6-93.el7.x86_64.rpm
httpd-devel-2.4.6-93.el7.x86_64.rpm
httpd-tools-2.4.6-93.el7.x86_64.rpm
mod_session-2.4.6-93.el7.x86_64.rpm
mod_ssl-2.4.6-93.el7.x86_64.rpm
Red Hat Enterprise Linux Server Optional (v. 7):
ppc64:
httpd-debuginfo-2.4.6-93.el7.ppc64.rpm
mod_ldap-2.4.6-93.el7.ppc64.rpm
mod_proxy_html-2.4.6-93.el7.ppc64.rpm
ppc64le:
httpd-debuginfo-2.4.6-93.el7.ppc64le.rpm
mod_ldap-2.4.6-93.el7.ppc64le.rpm
mod_proxy_html-2.4.6-93.el7.ppc64le.rpm
s390x:
httpd-debuginfo-2.4.6-93.el7.s390x.rpm
mod_ldap-2.4.6-93.el7.s390x.rpm
mod_proxy_html-2.4.6-93.el7.s390x.rpm
x86_64:
httpd-debuginfo-2.4.6-93.el7.x86_64.rpm
mod_ldap-2.4.6-93.el7.x86_64.rpm
mod_proxy_html-2.4.6-93.el7.x86_64.rpm
Red Hat Enterprise Linux Workstation (v. 7):
Source:
httpd-2.4.6-93.el7.src.rpm
noarch:
httpd-manual-2.4.6-93.el7.noarch.rpm
x86_64:
httpd-2.4.6-93.el7.x86_64.rpm
httpd-debuginfo-2.4.6-93.el7.x86_64.rpm
httpd-devel-2.4.6-93.el7.x86_64.rpm
httpd-tools-2.4.6-93.el7.x86_64.rpm
mod_session-2.4.6-93.el7.x86_64.rpm
mod_ssl-2.4.6-93.el7.x86_64.rpm
Red Hat Enterprise Linux Workstation Optional (v. 7):
x86_64:
httpd-debuginfo-2.4.6-93.el7.x86_64.rpm
mod_ldap-2.4.6-93.el7.x86_64.rpm
mod_proxy_html-2.4.6-93.el7.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2017-15710
https://access.redhat.com/security/cve/CVE-2018-1301
https://access.redhat.com/security/cve/CVE-2018-17199
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.8_release_notes/index
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2020 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBXoOc4tzjgjWX9erEAQhISA//Y5mE23rwkh7GwfDR0qeaO+jVAzoXWh/T
3iqLPhVrDP+oJNMLw0E1YiU4usVPv6PZxBK8yG52hg3RoqQ/CRP9e4fdQf4yrep0
M+wT6XL1jUoP8DczRrQEJOOAks/jcCP5c8Id/6MfdsqUBDfvYwVgZAxKAqiH1squ
SGIjfnA/DsWCPiTh/y4rennybp6MiLgEOKHtEz+dSu65DVHJ7Nhe1ZoOehhGGK7I
1PvyLab/Nb7k87k5Ch+Zo2yO4yDrv99Ey4uvfEpX0+hNsZjwje44a+C00SeqAtbH
PdTn4MwZJz215JfpKwbwWjuRmCDlwNobNLhxl8gYAXIoXey0SuH7aHbZbmIbpFkN
IhMuNKTjZaYJSXTEKKifD7zd1V2MevvGh6cDR2ELCE0ucZvhLgFnBLbI3et85gzp
Iz4gcXTo+44E4m5NYfTnavY0p0eb7ppQB7exfLBQJ/zQbYt0wbfoPhT9Kd/8n+6N
EHXFnw0zNzFXEiBSxOqCKC7JLgb2TIyJ8lOErrIKgf33dVXduZCw0YUBulTmajAX
CsbSUav58F5cnNxLGN2/8e3a7xC4KEA4+IHTbSTgTJdPVtOJqlEp4zUMKIIX1inz
rUu5g1s01GcxnLy1TV06FFAvuU+HZdRRrkpXVWvDd7iUS3wfjoBvOm+yEH+xCYDJ
A5u9lBwaBEg=
=zHYj
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXoQsHGaOgq3Tt24GAQhs6hAAj0r95xmZSVHCJUxAqIeVGQNsRmas7fMw
dXzOumJBpajnBEOrPW9KdgVxKZk0G3tWdqCmsh/XZV+9yKOa66aGqrEMj7YtMncl
BSHBJkwee7v0qP+UFmRcG252wHXitvp/TGVxYhkLDTfCtRFDMgwvx+6gef2VG+7I
bmvOCKghii7o9fGqG8MewALpm/Mj4/hwp+hvz1Qg+gCevcMDZkYMKj/WHDvJN869
aF0AreU3D6Ji4qxEZCljeor8riuLYuRyrtc7R0zCPFKkKjvBhObi9ztIE34x8zIw
Kn3P6a8QHI1tH2JwcSU4jNksr9H9G5OA1NCgEiBVc7Tl3tq7HMk/6xYyhEWDsGS+
J/RroGJzCzoadYphkB94a/tPgEaXmzoQQaL44eNWbo2ieUBMdiJ9sOnq2tv7BaVe
OklUoD+x6Nkh8kaHcu2ap5uFL+HBKiWOtsRWBZSKnTGgo1ZvRhI9mQncxz+xJxHu
uzjcigF0dMAGl4gv3y1PdlZzE8TPvfDuazsHPvaKuqVgpFZgi0tj8ZuM9HC53R9O
mHkKrCMsnIlxwVrT6egpV2rZZv09p59AyBrbiTA8J1pbdNpx7K+aH9aatjS4Beqp
HjNGGETQvt1syl4HNh6L7XHdUqSikirufFO/c3QbUYtWe6qK9ZcvQS5M4zeCoMXY
g0Rb1KihKQ0=
=yn9l
-----END PGP SIGNATURE-----