Skip to content
OpenAdvisories
Medium ELSA-2023-5050 1 CVE

Moderate: httpd:2.4 security update (Oracle Linux 8)

Published Sep 12, 2023 · Updated Sep 12, 2023

Summary

httpd
[2.4.37-56.0.1.7]
- Resolves: #2176723 - CVE-2023-27522 httpd:2.4/httpd: mod_proxy_uwsgi HTTP
response splitting

[2.4.37-56.0.1.6]
- Set vstring per ORACLE_SUPPORT_PRODUCT [Orabug: 29892262]
- Replace index.html with Oracle's index page oracle_index.html

[2.4.37-56.6]
- Resolves: #2190133 - mod_rewrite regression with CVE-2023-25690

[2.4.37-56.4]
- Resolves: #2177748 - CVE-2023-25690 httpd:2.4/httpd: HTTP request splitting
with mod_rewrite and mod_proxy

[2.4.37-56]
- Resolves: #2162499 - CVE-2006-20001 httpd: mod_dav: out-of-bounds read/write
of zero byte
- Resolves: #2162485 - CVE-2022-37436 httpd: mod_proxy: HTTP response splitting
- Resolves: #2162509 - CVE-2022-36760 httpd: mod_proxy_ajp: Possible request
smuggling

[2.4.37-55]
- Resolves: #2155961 - prevent sscg creating /dhparams.pem

[2.4.37-54]
- Resolves: #2095650 - Dependency from mod_http2 on httpd broken

[2.4.37-53]
- Resolves: #2050888 - httpd with SSL fails to start unless hostname command
was installed

[2.4.37-52]
- Add the SNI support in mod_proxy_wstunnel module for Apache httpd
- Resolves: rhbz#2017543

mod_http2
[1.15.7-8.3]
- Resolves: #2177748 - CVE-2023-25690 httpd:2.4/httpd: HTTP request splitting
with mod_rewrite and mod_proxy

[1.15.7-7]
- Resolves: #2095650 - Dependency from mod_http2 on httpd broken

[1.15.7-6]
- Backport SNI feature refactor
- Resolves: rhbz#2137257

mod_md

Fixed packages 11

ReleasePackageFixed in
Oracle Linux · 8 httpd 0:2.4.37-56.0.1.module+el8.8.0+21159+b5186791.7
Oracle Linux · 8 httpd-devel 0:2.4.37-56.0.1.module+el8.8.0+21159+b5186791.7
Oracle Linux · 8 httpd-filesystem 0:2.4.37-56.0.1.module+el8.8.0+21159+b5186791.7
Oracle Linux · 8 httpd-manual 0:2.4.37-56.0.1.module+el8.8.0+21159+b5186791.7
Oracle Linux · 8 httpd-tools 0:2.4.37-56.0.1.module+el8.8.0+21159+b5186791.7
Oracle Linux · 8 mod_http2 0:1.15.7-8.module+el8.8.0+21057+13668aee.3
Oracle Linux · 8 mod_ldap 0:2.4.37-56.0.1.module+el8.8.0+21159+b5186791.7
Oracle Linux · 8 mod_md 1:2.0.8-8.module+el8.5.0+20475+4f6a8fd5
Oracle Linux · 8 mod_proxy_html 1:2.4.37-56.0.1.module+el8.8.0+21159+b5186791.7
Oracle Linux · 8 mod_session 0:2.4.37-56.0.1.module+el8.8.0+21159+b5186791.7
Oracle Linux · 8 mod_ssl 1:2.4.37-56.0.1.module+el8.8.0+21159+b5186791.7

Vulnerabilities 1