Skip to content
OpenAdvisories
Medium ELSA-2021-4257 2 CVEs

Moderate: httpd:2.4 security, bug fix, and enhancement update (Oracle Linux 8)

Published Nov 16, 2021 · Updated Nov 16, 2021

Summary

httpd
[2.4.37-41.0.1]
- Add checks on the configured UDS path [Orabug: 33412270][CVE-2021-40438]
- Set vstring per ORACLE_SUPPORT_PRODUCT [Orabug: 29892262]
- Replace index.html with Oracles index page oracle_index.html

[2.4.37-41]
- Resolves: #1680111 - httpd sends reply to HTTPS GET using two TLS records
- Resolves: #1905613 - mod_ssl does not like valid certificate chain
- Resolves: #1935742 - [RFE] backport samesite/httponly/secure flags for
usertrack
- Resolves: #1972500 - CVE-2021-30641 httpd:2.4/httpd: MergeSlashes regression
- Resolves: #1968307 - CVE-2021-26690 httpd:2.4/httpd: mod_session NULL pointer
dereference in parser
- Resolves: #1934741 - Apache trademark update - new logo

[2.4.37-40]
- Resolves: #1952557 - mod_proxy_wstunnel.html is a malformed XML
- Resolves: #1937334 - SSLProtocol with based virtual hosts

mod_http2
[1.15.7-3]
- Resolves: #1869077 - CVE-2020-11993 httpd:2.4/mod_http2: httpd:
mod_http2 concurrent pool usage

mod_md
[1:2.0.8-8]
- Resolves: #1832844 - mod_md does not work with ACME server that does not
provide keyChange or revokeCert resources

Fixed packages 11

ReleasePackageFixed in
Oracle Linux · 8 httpd 0:2.4.37-41.0.1.module+el8.5.0+20323+c8e0c271
Oracle Linux · 8 httpd-devel 0:2.4.37-41.0.1.module+el8.5.0+20323+c8e0c271
Oracle Linux · 8 httpd-filesystem 0:2.4.37-41.0.1.module+el8.5.0+20323+c8e0c271
Oracle Linux · 8 httpd-manual 0:2.4.37-41.0.1.module+el8.5.0+20323+c8e0c271
Oracle Linux · 8 httpd-tools 0:2.4.37-41.0.1.module+el8.5.0+20323+c8e0c271
Oracle Linux · 8 mod_http2 0:1.15.7-3.module+el8.4.0+20024+b87b2deb
Oracle Linux · 8 mod_ldap 0:2.4.37-41.0.1.module+el8.5.0+20323+c8e0c271
Oracle Linux · 8 mod_md 1:2.0.8-8.module+el8.3.0+7816+49791cfd
Oracle Linux · 8 mod_proxy_html 1:2.4.37-41.0.1.module+el8.5.0+20323+c8e0c271
Oracle Linux · 8 mod_session 0:2.4.37-41.0.1.module+el8.5.0+20323+c8e0c271
Oracle Linux · 8 mod_ssl 1:2.4.37-41.0.1.module+el8.5.0+20323+c8e0c271

Vulnerabilities 2