Summary
[2.4.6-98.0.3]
- mod_proxy: ap_proxy_http_request() to clear hop-by-hop first and
fixup last [CVE-2022-31813][Orabug: 34381850]
- mod_session: save one apr_strtok() [Orabug: 33338149][CVE-2021-26690]
[2.4.6-98.0.1]
- replace index.html with Oracle's index page oracle_index.html
[2.4.6-97.7]
- Resolves: #2177742 - CVE-2023-25690 httpd: HTTP request splitting with
mod_rewrite and mod_proxy
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | httpd | 0:2.4.6-98.0.3.el7_9.7 |
| Oracle Linux · 7 | httpd-devel | 0:2.4.6-98.0.3.el7_9.7 |
| Oracle Linux · 7 | httpd-manual | 0:2.4.6-98.0.3.el7_9.7 |
| Oracle Linux · 7 | httpd-tools | 0:2.4.6-98.0.3.el7_9.7 |
| Oracle Linux · 7 | mod_ldap | 0:2.4.6-98.0.3.el7_9.7 |
| Oracle Linux · 7 | mod_proxy_html | 1:2.4.6-98.0.3.el7_9.7 |
| Oracle Linux · 7 | mod_session | 0:2.4.6-98.0.3.el7_9.7 |
| Oracle Linux · 7 | mod_ssl | 1:2.4.6-98.0.3.el7_9.7 |
Vulnerabilities 1
-
Critical 9.8
Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy
Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific patter…