Summary
httpd
[2.4.37-39.1.0.1.1]
- Set vstring per ORACLE_SUPPORT_PRODUCT [Orabug: 29892262]
- Replace index.html with Oracle's index page oracle_index.html
[2.4.37-39.1]
- Resolves: #2007234 - CVE-2021-40438 httpd:2.4/httpd: mod_proxy: SSRF via
a crafted request uri-path
- Resolves: #2007646 - CVE-2021-26691 httpd:2.4/httpd: Heap overflow in
mod_session
Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | httpd | 0:2.4.37-39.0.1.module+el8.4.0+20372+b87b2deb.1 |
| Oracle Linux · 8 | httpd-devel | 0:2.4.37-39.0.1.module+el8.4.0+20372+b87b2deb.1 |
| Oracle Linux · 8 | httpd-filesystem | 0:2.4.37-39.0.1.module+el8.4.0+20372+b87b2deb.1 |
| Oracle Linux · 8 | httpd-manual | 0:2.4.37-39.0.1.module+el8.4.0+20372+b87b2deb.1 |
| Oracle Linux · 8 | httpd-tools | 0:2.4.37-39.0.1.module+el8.4.0+20372+b87b2deb.1 |
| Oracle Linux · 8 | mod_http2 | 0:1.15.7-3.module+el8.4.0+20024+b87b2deb |
| Oracle Linux · 8 | mod_ldap | 0:2.4.37-39.0.1.module+el8.4.0+20372+b87b2deb.1 |
| Oracle Linux · 8 | mod_md | 1:2.0.8-8.module+el8.3.0+7816+49791cfd |
| Oracle Linux · 8 | mod_proxy_html | 1:2.4.37-39.0.1.module+el8.4.0+20372+b87b2deb.1 |
| Oracle Linux · 8 | mod_session | 0:2.4.37-39.0.1.module+el8.4.0+20372+b87b2deb.1 |
| Oracle Linux · 8 | mod_ssl | 1:2.4.37-39.0.1.module+el8.4.0+20372+b87b2deb.1 |
Vulnerabilities 2
-
Critical 9.0
mod_proxy SSRF
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
KEV Dec 1, 2021 -
Unscored —CVE-2021-26691 EPSS 68%
Apache HTTP Server mod_session response handling heap overflow
In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow