RHSA-2018:3558 — Red Hat Security Advisory: httpd24 security, bug fix, and enhancement update

Fixed packages 35

Release	Package	Fixed in
Red Hat · RHEL 3 rhel_software_collections:3::el6	httpd24-curl	0:7.61.1-1.el6
Red Hat · RHEL 3 rhel_software_collections:3::el6	httpd24-curl-debuginfo	0:7.61.1-1.el6
Red Hat · RHEL 3 rhel_software_collections:3::el6	httpd24-httpd	0:2.4.34-7.el6
Red Hat · RHEL 3 rhel_software_collections:3::el6	httpd24-httpd-debuginfo	0:2.4.34-7.el6
Red Hat · RHEL 3 rhel_software_collections:3::el6	httpd24-httpd-devel	0:2.4.34-7.el6
Red Hat · RHEL 3 rhel_software_collections:3::el6	httpd24-httpd-manual	0:2.4.34-7.el6
Red Hat · RHEL 3 rhel_software_collections:3::el6	httpd24-httpd-tools	0:2.4.34-7.el6
Red Hat · RHEL 3 rhel_software_collections:3::el6	httpd24-libcurl	0:7.61.1-1.el6
Red Hat · RHEL 3 rhel_software_collections:3::el6	httpd24-libcurl-devel	0:7.61.1-1.el6
Red Hat · RHEL 3 rhel_software_collections:3::el6	httpd24-libnghttp2	0:1.7.1-7.el6
Red Hat · RHEL 3 rhel_software_collections:3::el6	httpd24-libnghttp2-devel	0:1.7.1-7.el6
Red Hat · RHEL 3 rhel_software_collections:3::el6	httpd24-mod_ldap	0:2.4.34-7.el6
Red Hat · RHEL 3 rhel_software_collections:3::el6	httpd24-mod_proxy_html	1:2.4.34-7.el6
Red Hat · RHEL 3 rhel_software_collections:3::el6	httpd24-mod_session	0:2.4.34-7.el6
Red Hat · RHEL 3 rhel_software_collections:3::el6	httpd24-mod_ssl	1:2.4.34-7.el6
Red Hat · RHEL 3 rhel_software_collections:3::el6	httpd24-nghttp2	0:1.7.1-7.el6
Red Hat · RHEL 3 rhel_software_collections:3::el6	httpd24-nghttp2-debuginfo	0:1.7.1-7.el6
Red Hat · RHEL 3 rhel_software_collections:3::el7	httpd24-curl	0:7.61.1-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7	httpd24-curl-debuginfo	0:7.61.1-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7	httpd24-httpd	0:2.4.34-7.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7	httpd24-httpd-debuginfo	0:2.4.34-7.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7	httpd24-httpd-devel	0:2.4.34-7.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7	httpd24-httpd-manual	0:2.4.34-7.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7	httpd24-httpd-tools	0:2.4.34-7.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7	httpd24-libcurl	0:7.61.1-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7	httpd24-libcurl-devel	0:7.61.1-1.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7	httpd24-libnghttp2	0:1.7.1-7.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7	httpd24-libnghttp2-devel	0:1.7.1-7.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7	httpd24-mod_ldap	0:2.4.34-7.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7	httpd24-mod_md	0:2.4.34-7.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7	httpd24-mod_proxy_html	1:2.4.34-7.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7	httpd24-mod_session	0:2.4.34-7.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7	httpd24-mod_ssl	1:2.4.34-7.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7	httpd24-nghttp2	0:1.7.1-7.el7
Red Hat · RHEL 3 rhel_software_collections:3::el7	httpd24-nghttp2-debuginfo	0:1.7.1-7.el7

Vulnerabilities 38

Critical 9.8

CVE-2017-8816

The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denia…

curl curl curl Debian Ubuntu Alpine

Nov 29, 2017
Critical 9.8

CVE-2017-8817 EPSS 11%

The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-o…

curl curl curl Debian Ubuntu Alpine

Nov 29, 2017
Critical 9.8

CVE-2018-1000120 EPSS 12%

curl FTP path confusion leads to NIL byte out of bounds write

A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse.

curl curl curl curl Debian Ubuntu Alpine NuGet

Mar 14, 2018
Critical 9.1

CVE-2017-1000257

An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the da…

curl curl curl Debian Ubuntu Alpine

Oct 31, 2017
Critical 9.1

CVE-2018-1000301

curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of s…

curl curl curl Debian Ubuntu Alpine

May 24, 2018
High 7.5

CVE-2018-14618 EPSS 11%

curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Cur…

[UNKNOWN] curl curl curl Debian Ubuntu Alpine

Sep 5, 2018
Medium 6.5

CVE-2016-8620

The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read v…

The curl Project curl curl curl Debian Ubuntu Alpine

Aug 1, 2018
Medium 6.5

CVE-2017-1000100

When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 b…

curl curl curl Debian Ubuntu Alpine

Oct 4, 2017
Medium 6.5

CVE-2017-1000101

curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those number…

curl curl curl Debian Ubuntu Alpine

Oct 4, 2017
Medium 5.9

CVE-2016-9586

curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's imp…

Red Hat curl curl curl Debian Ubuntu Alpine

Apr 23, 2018
Medium 5.3

CVE-2016-8615

A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back…

The curl Project curl curl curl Debian Ubuntu Alpine

Aug 1, 2018
Medium 5.3

CVE-2016-8618

The libcurl API function called `curl_maprintf()` before version 7.51.0 can be tricked into doing a double-free due to …

The curl Project curl curl curl Debian Ubuntu Alpine

Jul 31, 2018
Medium 5.3

CVE-2016-8619

The function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory double free.

The curl Project curl curl curl Debian Ubuntu Alpine

Aug 1, 2018
Medium 5.3

CVE-2016-8621

The `curl_getdate` function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receives an inpu…

The curl Project curl curl curl Debian Ubuntu Alpine

Jul 31, 2018
Medium 5.3

CVE-2016-8624

curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with…

The curl Project curl curl curl Debian Ubuntu Alpine

Jul 31, 2018
Medium 5.3

CVE-2016-8625

curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead user…

The curl Project curl curl curl Debian Ubuntu Alpine

Aug 1, 2018
Low 3.7

CVE-2016-8616

A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons …

The curl Project curl curl curl Debian Ubuntu Alpine

Aug 1, 2018
Low 3.7

CVE-2016-8622

The URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`. Internally, even if t…

The curl Project curl curl curl Debian Ubuntu Alpine

Jul 31, 2018
Low 3.3

CVE-2016-8617

The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if…

The curl Project curl curl curl Debian Ubuntu Alpine

Jul 31, 2018
Low 3.3

CVE-2016-8623

A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-aft…

The curl Project curl curl curl Debian Ubuntu Alpine

Aug 1, 2018
Low 2.4

CVE-2017-7407

The ourWriteOut function in tool_writeout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensiti…

curl curl curl Debian Ubuntu Alpine

Apr 3, 2017
Unscored —

CVE-2016-5419 EPSS 15%

curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which all…

curl curl curl Debian Ubuntu Alpine

Aug 10, 2016
Unscored —

CVE-2016-5420 EPSS 15%

curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which mig…

curl curl curl Debian Ubuntu Alpine

Aug 10, 2016
Unscored —

CVE-2016-5421

Use-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which connection is used or possibly …

curl curl curl Debian Ubuntu Alpine

Aug 10, 2016
Unscored —

CVE-2016-7141

curl and libcurl before 7.50.2, when built with NSS and the libnsspem.so library is available at runtime, allow remote …

curl curl curl Debian Ubuntu Alpine

Oct 3, 2016
Unscored —

CVE-2016-7167 EPSS 12%

Multiple integer overflows in the (1) curl_escape, (2) curl_easy_escape, (3) curl_unescape, and (4) curl_easy_unescape …

curl curl curl Debian Ubuntu Alpine

Oct 7, 2016
Unscored —

CVE-2017-1000254

libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successf…

curl curl curl Debian Ubuntu Alpine

Oct 6, 2017
Unscored —

CVE-2017-15710 EPSS 18%

In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured with AuthLDAPCha…

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine

Mar 26, 2018
Unscored —

CVE-2017-15715 Public exploit Scanner template EPSS 86%

In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a m…

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine

Mar 26, 2018
Unscored —

CVE-2018-1000007

libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom head…

curl curl Debian Ubuntu

Jan 24, 2018
Unscored —

CVE-2018-1000121

A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker …

curl curl curl Debian Ubuntu Alpine

Mar 14, 2018
Unscored —

CVE-2018-1000122

A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an atta…

curl curl curl Debian Ubuntu Alpine

Mar 14, 2018
Unscored —

CVE-2018-11763 EPSS 51%

In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, …

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine

Sep 25, 2018
Unscored —

CVE-2018-1283

In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (Sessio…

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine

Mar 26, 2018
Unscored —

CVE-2018-1301 EPSS 14%

A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound a…

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine

Mar 26, 2018
Unscored —

CVE-2018-1303 EPSS 70%

A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out…

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine

Mar 26, 2018
Unscored —

CVE-2018-1312 EPSS 16%

In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent rep…

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine

Mar 26, 2018
Unscored —

CVE-2018-1333 EPSS 17%

DoS for HTTP/2 connections by crafted requests

By specially crafting HTTP/2 requests, workers would be allocated 60 seconds longer than necessary, leading to worker exhaustion and a denial of service. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.18-2.4.30,2.4.33).

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine

Jun 18, 2018

References

article
https://access.redhat.com/security/updates/classification/#moderate
article
https://access.redhat.com/documentation/en-us/red_hat_software_collections/3/html/3.2_release_notes/chap-rhscl#sect-RHSCL-Changes-httpd
report
https://bugzilla.redhat.com/show_bug.cgi?id=1362183
report
https://bugzilla.redhat.com/show_bug.cgi?id=1362190
report
https://bugzilla.redhat.com/show_bug.cgi?id=1362199
report
https://bugzilla.redhat.com/show_bug.cgi?id=1373229
report
https://bugzilla.redhat.com/show_bug.cgi?id=1375906
report
https://bugzilla.redhat.com/show_bug.cgi?id=1388370
report
https://bugzilla.redhat.com/show_bug.cgi?id=1388371
report
https://bugzilla.redhat.com/show_bug.cgi?id=1388377
report
https://bugzilla.redhat.com/show_bug.cgi?id=1388378
report
https://bugzilla.redhat.com/show_bug.cgi?id=1388379
report
https://bugzilla.redhat.com/show_bug.cgi?id=1388382
report
https://bugzilla.redhat.com/show_bug.cgi?id=1388385
report
https://bugzilla.redhat.com/show_bug.cgi?id=1388386
report
https://bugzilla.redhat.com/show_bug.cgi?id=1388388
report
https://bugzilla.redhat.com/show_bug.cgi?id=1388390
report
https://bugzilla.redhat.com/show_bug.cgi?id=1388392
report
https://bugzilla.redhat.com/show_bug.cgi?id=1406712
report
https://bugzilla.redhat.com/show_bug.cgi?id=1439190
report
https://bugzilla.redhat.com/show_bug.cgi?id=1478309
report
https://bugzilla.redhat.com/show_bug.cgi?id=1478310
report
https://bugzilla.redhat.com/show_bug.cgi?id=1495541
report
https://bugzilla.redhat.com/show_bug.cgi?id=1503705
report
https://bugzilla.redhat.com/show_bug.cgi?id=1515757
report
https://bugzilla.redhat.com/show_bug.cgi?id=1515760
report
https://bugzilla.redhat.com/show_bug.cgi?id=1518737
report
https://bugzilla.redhat.com/show_bug.cgi?id=1537125
report
https://bugzilla.redhat.com/show_bug.cgi?id=1540167
report
https://bugzilla.redhat.com/show_bug.cgi?id=1552628
report
https://bugzilla.redhat.com/show_bug.cgi?id=1552631
report
https://bugzilla.redhat.com/show_bug.cgi?id=1553398
report
https://bugzilla.redhat.com/show_bug.cgi?id=1558450
report
https://bugzilla.redhat.com/show_bug.cgi?id=1560395
report
https://bugzilla.redhat.com/show_bug.cgi?id=1560399
report
https://bugzilla.redhat.com/show_bug.cgi?id=1560599
report
https://bugzilla.redhat.com/show_bug.cgi?id=1560614
report
https://bugzilla.redhat.com/show_bug.cgi?id=1560634
report
https://bugzilla.redhat.com/show_bug.cgi?id=1560643

Red Hat Security Advisory: httpd24 security, bug fix, and enhancement update

Fixed packages 35

Vulnerabilities 38

The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denia…

The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-o…

curl FTP path confusion leads to NIL byte out of bounds write

An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the da…

curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of s…

curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Cur…

The 'globbing' feature in curl before version 7.51.0 has a flaw that leads to integer overflow and out-of-bounds read v…

When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 b…

curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those number…

curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in libcurl's imp…

A flaw was found in curl before version 7.51. If cookie state is written into a cookie jar file that is later read back…

The libcurl API function called `curl_maprintf()` before version 7.51.0 can be tricked into doing a double-free due to …

The function `read_data()` in security.c in curl before version 7.51.0 is vulnerable to memory double free.

The `curl_getdate` function in curl before version 7.51.0 is vulnerable to an out of bounds read if it receives an inpu…

curl before version 7.51.0 doesn't parse the authority component of the URL correctly when the host name part ends with…

curl before version 7.51.0 uses outdated IDNA 2003 standard to handle International Domain Names and this may lead user…

A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons …

The URL percent-encoding decode function in libcurl before 7.51.0 is called `curl_easy_unescape`. Internally, even if t…

The base64 encode function in curl before version 7.51.0 is prone to a buffer being under allocated in 32bit systems if…

A flaw was found in curl before version 7.51.0. The way curl handles cookies permits other threads to trigger a use-aft…

The ourWriteOut function in tool_writeout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensiti…

curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which all…

curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which mig…

Use-after-free vulnerability in libcurl before 7.50.1 allows attackers to control which connection is used or possibly …

curl and libcurl before 7.50.2, when built with NSS and the libnsspem.so library is available at runtime, allow remote …

Multiple integer overflows in the (1) curl_escape, (2) curl_easy_escape, (3) curl_unescape, and (4) curl_easy_unescape …

libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successf…

In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured with AuthLDAPCha…

In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a m…

libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom head…

A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker …

A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an atta…

In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, …

In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (Sessio…

A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound a…

A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out…

In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent rep…

DoS for HTTP/2 connections by crafted requests

References