Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.29 security update

Fixed packages 84

Vulnerabilities 12

• High 7.5
  CVE-2018-1000168 EPSS 11%

  nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC f…

  nodejs nghttp2 nghttp2 Debian Ubuntu Alpine
  May 8, 2018
• Unscored —
  CVE-2017-15710 EPSS 18%

  In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured with AuthLDAPCha…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
  Mar 26, 2018
• Unscored —
  CVE-2017-15715 Public exploit Scanner template EPSS 86%

  In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a m…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
  Mar 26, 2018
• Unscored —
  CVE-2018-0739 EPSS 19%

  Constructed ASN.1 types with a recursive definition could exceed the stack

  Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL…

  OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine
  Mar 27, 2018
• Unscored —
  CVE-2018-11759 Public exploit Scanner template EPSS 91%

  The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map…

  Apache Software Foundation Apache Tomcat Connectors libapache-mod-jk Debian
  Oct 31, 2018
• Unscored —
  CVE-2018-11763 EPSS 51%

  In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, …

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
  Sep 25, 2018
• Unscored —
  CVE-2018-1283

  In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (Sessio…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
  Mar 26, 2018
• Unscored —
  CVE-2018-1301 EPSS 14%

  A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound a…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
  Mar 26, 2018
• Unscored —
  CVE-2018-1302 EPSS 13%

  When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have writ…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
  Mar 26, 2018
• Unscored —
  CVE-2018-1303 EPSS 70%

  A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
  Mar 26, 2018
• Unscored —
  CVE-2018-1312 EPSS 16%

  In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent rep…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
  Mar 26, 2018
• Unscored —
  CVE-2018-1333 EPSS 17%

  DoS for HTTP/2 connections by crafted requests

  By specially crafting HTTP/2 requests, workers would be allocated 60 seconds longer than necessary, leading to worker exhaustion and a denial of service. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.18-2.4.30,2.4.33).

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
  Jun 18, 2018

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1560395
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1560399
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1560599
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1560614
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1560625
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1560634
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1560643
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1561266
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1565035
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1605048
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1633399
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1645589
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0367.json
• report
  https://access.redhat.com/security/cve/CVE-2017-15710
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-15710
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-15710
• article
  https://httpd.apache.org/security/vulnerabilities_24.html
• report
  https://access.redhat.com/security/cve/CVE-2017-15715
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-15715
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-15715
• report
  https://access.redhat.com/security/cve/CVE-2018-0739
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-0739
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-0739
• article
  https://www.openssl.org/news/secadv/20180327.txt
• report
  https://access.redhat.com/security/cve/CVE-2018-1283
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-1283
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-1283
• report
  https://access.redhat.com/security/cve/CVE-2018-1301
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-1301
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-1301
• report
  https://access.redhat.com/security/cve/CVE-2018-1302
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-1302
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-1302
• report
  https://access.redhat.com/security/cve/CVE-2018-1303
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-1303
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-1303
• report
  https://access.redhat.com/security/cve/CVE-2018-1312
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-1312