Summary
httpd
[2.4.37-51.5.0.1]
- Set vstring per ORACLE_SUPPORT_PRODUCT [Orabug: 29892262]
- Replace index.html with Oracle's index page oracle_index.html
[2.4.37-51.5]
- Resolves: #2177747 - CVE-2023-25690 httpd:2.4/httpd: HTTP request splitting
with mod_rewrite and mod_proxy
[2.4.37-51.1]
- Resolves: #2165967 - prevent sscg creating /dhparams.pem
- Resolves: #2165976 - CVE-2006-20001 httpd: mod_dav: out-of-bounds read/write
of zero byte
- Resolves: #2165977 - CVE-2022-37436 httpd: mod_proxy: HTTP response splitting
- Resolves: #2165978 - CVE-2022-36760 httpd: mod_proxy_ajp: Possible request
smuggling
mod_http2
[1.15.7-5.4]
- Resolves: #2177747 - CVE-2023-25690 httpd:2.4/httpd: HTTP request splitting
with mod_rewrite and mod_proxy
Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | httpd | 0:2.4.37-51.0.1.module+el8.7.0+21029+de29ba63.5 |
| Oracle Linux · 8 | httpd-devel | 0:2.4.37-51.0.1.module+el8.7.0+21029+de29ba63.5 |
| Oracle Linux · 8 | httpd-filesystem | 0:2.4.37-51.0.1.module+el8.7.0+21029+de29ba63.5 |
| Oracle Linux · 8 | httpd-manual | 0:2.4.37-51.0.1.module+el8.7.0+21029+de29ba63.5 |
| Oracle Linux · 8 | httpd-tools | 0:2.4.37-51.0.1.module+el8.7.0+21029+de29ba63.5 |
| Oracle Linux · 8 | mod_http2 | 0:1.15.7-5.module+el8.7.0+21029+de29ba63.4 |
| Oracle Linux · 8 | mod_ldap | 0:2.4.37-51.0.1.module+el8.7.0+21029+de29ba63.5 |
| Oracle Linux · 8 | mod_md | 1:2.0.8-8.module+el8.5.0+20475+4f6a8fd5 |
| Oracle Linux · 8 | mod_proxy_html | 1:2.4.37-51.0.1.module+el8.7.0+21029+de29ba63.5 |
| Oracle Linux · 8 | mod_session | 0:2.4.37-51.0.1.module+el8.7.0+21029+de29ba63.5 |
| Oracle Linux · 8 | mod_ssl | 1:2.4.37-51.0.1.module+el8.7.0+21029+de29ba63.5 |
Vulnerabilities 1
-
Critical 9.8
Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy
Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific patter…