Summary
[2.4.6-90.0.1]
- replace index.html with Oracles index page oracle_index.html
Resolves: #1566317 - CVE-2018-1312 httpd: Weak Digest auth nonce generation
in mod_auth_digest
- Resolves: #1696141 - CVE-2019-0217 httpd: mod_auth_digest: access control
bypass due to race condition
- Resolves: #1696096 - CVE-2019-0220 httpd: URL normalization inconsistency
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | httpd | 0:2.4.6-90.0.1.el7 |
| Oracle Linux · 7 | httpd-devel | 0:2.4.6-90.0.1.el7 |
| Oracle Linux · 7 | httpd-manual | 0:2.4.6-90.0.1.el7 |
| Oracle Linux · 7 | httpd-tools | 0:2.4.6-90.0.1.el7 |
| Oracle Linux · 7 | mod_ldap | 0:2.4.6-90.0.1.el7 |
| Oracle Linux · 7 | mod_proxy_html | 1:2.4.6-90.0.1.el7 |
| Oracle Linux · 7 | mod_session | 0:2.4.6-90.0.1.el7 |
| Oracle Linux · 7 | mod_ssl | 1:2.4.6-90.0.1.el7 |
Vulnerabilities 2
-
Unscored —
In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded serv…
-
Unscored —CVE-2019-0220 EPSS 18%
A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains mult…