Skip to content
OpenAdvisories
Low ELSA-2015-0325 2 CVEs

Low: httpd security, bug fix, and enhancement update (Oracle Linux 7)

Published Mar 11, 2015 · Updated Mar 11, 2015

Summary

[2.4.6-31.0.1]
- replace index.html with Oracle's index page oracle_index.html

[2.4.6-31]
- mod_proxy_fcgi: determine if FCGI_CONN_CLOSE should be enabled
instead of hardcoding it (#1168050)
- mod_proxy: support Unix Domain Sockets (#1168081)

[2.4.6-30]
- core: fix bypassing of mod_headers rules via chunked requests (CVE-2013-5704)
- mod_cache: fix NULL pointer dereference on empty Content-Type (CVE-2014-3581)

[2.4.6-29]
- rebuild against proper version of OpenSSL (#1080125)

[2.4.6-28]
- set vstring based on /etc/os-release (#1114123)

[2.4.6-27]
- fix the dependency on openssl-libs to match the fix for #1080125

[2.4.6-26]
- allow <Auth*ProviderAlias>'es to be seen under virtual hosts (#1131847)

[2.4.6-25]
- do not use hardcoded curve for ECDHE suites (#1080125)

[2.4.6-24]
- allow reverse-proxy to be set via SetHandler (#1136290)

[2.4.6-23]
- fix possible crash in SIGINT handling (#1131006)

[2.4.6-22]
- ab: fix integer overflow when printing stats with lot of requests (#1092420)

[2.4.6-21]
- add pre_htaccess so mpm-itk can be build as separate module (#1059143)

[2.4.6-20]
- mod_ssl: prefer larger keys and support up to 8192-bit keys (#1073078)

Fixed packages 8

ReleasePackageFixed in
Oracle Linux · 7 httpd 0:2.4.6-31.0.1.el7
Oracle Linux · 7 httpd-devel 0:2.4.6-31.0.1.el7
Oracle Linux · 7 httpd-manual 0:2.4.6-31.0.1.el7
Oracle Linux · 7 httpd-tools 0:2.4.6-31.0.1.el7
Oracle Linux · 7 mod_ldap 0:2.4.6-31.0.1.el7
Oracle Linux · 7 mod_proxy_html 1:2.4.6-31.0.1.el7
Oracle Linux · 7 mod_session 0:2.4.6-31.0.1.el7
Oracle Linux · 7 mod_ssl 1:2.4.6-31.0.1.el7

Vulnerabilities 2

  • Unscored —
    CVE-2013-5704 EPSS 58%

    The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directi…

  • Unscored —
    CVE-2014-3581 EPSS 13%

    The cache_merge_headers_out function in modules/cache/cache_util.c in the mod_cache module in the Apache HTTP Server be…