Summary
[2.4.6-31.0.1]
- replace index.html with Oracle's index page oracle_index.html
[2.4.6-31]
- mod_proxy_fcgi: determine if FCGI_CONN_CLOSE should be enabled
instead of hardcoding it (#1168050)
- mod_proxy: support Unix Domain Sockets (#1168081)
[2.4.6-30]
- core: fix bypassing of mod_headers rules via chunked requests (CVE-2013-5704)
- mod_cache: fix NULL pointer dereference on empty Content-Type (CVE-2014-3581)
[2.4.6-29]
- rebuild against proper version of OpenSSL (#1080125)
[2.4.6-28]
- set vstring based on /etc/os-release (#1114123)
[2.4.6-27]
- fix the dependency on openssl-libs to match the fix for #1080125
[2.4.6-26]
- allow <Auth*ProviderAlias>'es to be seen under virtual hosts (#1131847)
[2.4.6-25]
- do not use hardcoded curve for ECDHE suites (#1080125)
[2.4.6-24]
- allow reverse-proxy to be set via SetHandler (#1136290)
[2.4.6-23]
- fix possible crash in SIGINT handling (#1131006)
[2.4.6-22]
- ab: fix integer overflow when printing stats with lot of requests (#1092420)
[2.4.6-21]
- add pre_htaccess so mpm-itk can be build as separate module (#1059143)
[2.4.6-20]
- mod_ssl: prefer larger keys and support up to 8192-bit keys (#1073078)
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | httpd | 0:2.4.6-31.0.1.el7 |
| Oracle Linux · 7 | httpd-devel | 0:2.4.6-31.0.1.el7 |
| Oracle Linux · 7 | httpd-manual | 0:2.4.6-31.0.1.el7 |
| Oracle Linux · 7 | httpd-tools | 0:2.4.6-31.0.1.el7 |
| Oracle Linux · 7 | mod_ldap | 0:2.4.6-31.0.1.el7 |
| Oracle Linux · 7 | mod_proxy_html | 1:2.4.6-31.0.1.el7 |
| Oracle Linux · 7 | mod_session | 0:2.4.6-31.0.1.el7 |
| Oracle Linux · 7 | mod_ssl | 1:2.4.6-31.0.1.el7 |
Vulnerabilities 2
-
Unscored —CVE-2013-5704 EPSS 58%
The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directi…
-
Unscored —CVE-2014-3581 EPSS 13%
The cache_merge_headers_out function in modules/cache/cache_util.c in the mod_cache module in the Apache HTTP Server be…