Red Hat Security Advisory: httpd24-httpd security, bug fix, and enhancement update

Fixed packages 18

Vulnerabilities 6

• Unscored —
  CVE-2016-0736 Public exploit EPSS 49%

  In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured …

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu
  Jul 27, 2017
• Unscored —
  CVE-2016-1546 EPSS 16%

  The Apache HTTP Server 2.4.17 and 2.4.18, when mod_http2 is enabled, does not limit the number of simultaneous stream w…

  apache2 Debian
  Jul 6, 2016
• Unscored —
  CVE-2016-2161 EPSS 21%

  In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can cause the server to crash, and e…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu
  Jul 27, 2017
• Unscored —
  CVE-2016-8740 Public exploit EPSS 79%

  The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h…

  Apache Software Foundation Apache HTTP Server apache2 Debian
  Dec 5, 2016
• Unscored —
  CVE-2016-8743 EPSS 13%

  Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests an…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu
  Jul 27, 2017
• Unscored —
  CVE-2020-11985

  IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remotei…

  apache2 apache2 Debian Ubuntu
  Aug 7, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-US/Red_Hat_Software_Collections/2/html/2.4_Release_Notes/chap-RHSCL.html#sect-RHSCL-Changes-httpd
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1329639
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1335616
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1336350
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1401528
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1406744
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1406753
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1406822
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1414037
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1432249
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1433474
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1161.json
• report
  https://access.redhat.com/security/cve/CVE-2016-0736
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-0736
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-0736
• article
  https://httpd.apache.org/security/vulnerabilities_24.html#2.4.25
• article
  https://www.redteam-pentesting.de/advisories/rt-sa-2016-001.txt
• report
  https://access.redhat.com/security/cve/CVE-2016-1546
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-1546
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-1546
• article
  http://httpd.apache.org/security/vulnerabilities_24.html
• report
  https://access.redhat.com/security/cve/CVE-2016-2161
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-2161
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-2161
• report
  https://access.redhat.com/security/cve/CVE-2016-8740
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-8740
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-8740
• article
  http://seclists.org/bugtraq/2016/Dec/3
• article
  https://httpd.apache.org/security/vulnerabilities_24.html
• report
  https://access.redhat.com/security/cve/CVE-2016-8743
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-8743
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-8743
• report
  https://access.redhat.com/security/cve/CVE-2020-11985
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1866559
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-11985
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-11985
• article
  https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-11985