Summary
[2.4.6-93.0.1]
- replace index.html with Oracles index page oracle_index.html
[2.4.6-93]
- Resolves: #1677496 - CVE-2018-17199 httpd: mod_session_cookie does not respect
expiry time
[2.4.6-92]
- htpasswd: add SHA-2 crypt() support (#1486889)
[2.4.6-91]
- Resolves: #1630886 - scriptlet can fail if hostname is not installed
- Resolves: #1565465 - CVE-2017-15710 httpd: Out of bound write in
mod_authnz_ldap when using too small Accept-Language values
- Resolves: #1568298 - CVE-2018-1301 httpd: Out of bounds access after
failure in reading the HTTP request
- Resolves: #1673457 - Apache child process crashes because ScriptAliasMatch
directive
- Resolves: #1633152 - mod_session missing apr-util-openssl
- Resolves: #1649470 - httpd response contains garbage in Content-Type header
- Resolves: #1724034 - Unexpected OCSP in proxy SSL connection
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | httpd | 0:2.4.6-93.0.1.el7 |
| Oracle Linux · 7 | httpd-devel | 0:2.4.6-93.0.1.el7 |
| Oracle Linux · 7 | httpd-manual | 0:2.4.6-93.0.1.el7 |
| Oracle Linux · 7 | httpd-tools | 0:2.4.6-93.0.1.el7 |
| Oracle Linux · 7 | mod_ldap | 0:2.4.6-93.0.1.el7 |
| Oracle Linux · 7 | mod_proxy_html | 1:2.4.6-93.0.1.el7 |
| Oracle Linux · 7 | mod_session | 0:2.4.6-93.0.1.el7 |
| Oracle Linux · 7 | mod_ssl | 1:2.4.6-93.0.1.el7 |
Vulnerabilities 3
-
Unscored —CVE-2017-15710 EPSS 18%
In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured with AuthLDAPCha…
-
Unscored —CVE-2018-1301 EPSS 14%
A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound a…
-
Unscored —CVE-2018-17199 EPSS 20%
In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the sess…