Summary
httpd
[2.4.37-41.0.1]
- Add checks on the configured UDS path [Orabug: 33412270][CVE-2021-40438]
- Set vstring per ORACLE_SUPPORT_PRODUCT [Orabug: 29892262]
- Replace index.html with Oracles index page oracle_index.html
[2.4.37-41]
- Resolves: #1680111 - httpd sends reply to HTTPS GET using two TLS records
- Resolves: #1905613 - mod_ssl does not like valid certificate chain
- Resolves: #1935742 - [RFE] backport samesite/httponly/secure flags for
usertrack
- Resolves: #1972500 - CVE-2021-30641 httpd:2.4/httpd: MergeSlashes regression
- Resolves: #1968307 - CVE-2021-26690 httpd:2.4/httpd: mod_session NULL pointer
dereference in parser
- Resolves: #1934741 - Apache trademark update - new logo
[2.4.37-40]
- Resolves: #1952557 - mod_proxy_wstunnel.html is a malformed XML
- Resolves: #1937334 - SSLProtocol with based virtual hosts
mod_http2
[1.15.7-3]
- Resolves: #1869077 - CVE-2020-11993 httpd:2.4/mod_http2: httpd:
mod_http2 concurrent pool usage
mod_md
[1:2.0.8-8]
- Resolves: #1832844 - mod_md does not work with ACME server that does not
provide keyChange or revokeCert resources
Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | httpd | 0:2.4.37-41.0.1.module+el8.5.0+20323+c8e0c271 |
| Oracle Linux · 8 | httpd-devel | 0:2.4.37-41.0.1.module+el8.5.0+20323+c8e0c271 |
| Oracle Linux · 8 | httpd-filesystem | 0:2.4.37-41.0.1.module+el8.5.0+20323+c8e0c271 |
| Oracle Linux · 8 | httpd-manual | 0:2.4.37-41.0.1.module+el8.5.0+20323+c8e0c271 |
| Oracle Linux · 8 | httpd-tools | 0:2.4.37-41.0.1.module+el8.5.0+20323+c8e0c271 |
| Oracle Linux · 8 | mod_http2 | 0:1.15.7-3.module+el8.4.0+20024+b87b2deb |
| Oracle Linux · 8 | mod_ldap | 0:2.4.37-41.0.1.module+el8.5.0+20323+c8e0c271 |
| Oracle Linux · 8 | mod_md | 1:2.0.8-8.module+el8.3.0+7816+49791cfd |
| Oracle Linux · 8 | mod_proxy_html | 1:2.4.37-41.0.1.module+el8.5.0+20323+c8e0c271 |
| Oracle Linux · 8 | mod_session | 0:2.4.37-41.0.1.module+el8.5.0+20323+c8e0c271 |
| Oracle Linux · 8 | mod_ssl | 1:2.4.37-41.0.1.module+el8.5.0+20323+c8e0c271 |
Vulnerabilities 2
-
Unscored —
mod_session NULL pointer dereference
Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service
-
Unscored —CVE-2021-30641 EPSS 52%
Unexpected URL matching with 'MergeSlashes OFF'
Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'