Red Hat Security Advisory: httpd24-httpd security, bug fix, and enhancement update

Fixed packages 34

Vulnerabilities 6

• Unscored —
  CVE-2018-17189 EPSS 19%

  In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the …

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
  Jan 30, 2019
• Unscored —
  CVE-2018-17199 EPSS 20%

  In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the sess…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
  Jan 30, 2019
• Unscored —
  CVE-2019-0217 Public exploit EPSS 16%

  In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded serv…

  Apache Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
  Apr 8, 2019
• Unscored —
  CVE-2019-0220 EPSS 18%

  A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains mult…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine
  Jun 11, 2019
• Unscored —
  CVE-2019-10092 Public exploit Scanner template EPSS 81%

  In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error pag…

  apache2 apache2 apache2 Debian Ubuntu Alpine
  Sep 26, 2019
• Unscored —
  CVE-2019-10097 EPSS 53%

  In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using …

  apache2 apache2 Debian Alpine
  Sep 26, 2019

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_software_collections/3/html/3.4_release_notes/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1668493
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1668497
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1669213
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1673019
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1695020
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1695036
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1696527
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1707636
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1725922
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1743956
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1743996
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1744120
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_4126.json
• report
  https://access.redhat.com/security/cve/CVE-2018-17189
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-17189
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-17189
• report
  https://access.redhat.com/security/cve/CVE-2018-17199
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-17199
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-17199
• report
  https://access.redhat.com/security/cve/CVE-2019-0217
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-0217
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-0217
• article
  http://www.apache.org/dist/httpd/CHANGES_2.4
• article
  https://httpd.apache.org/security/vulnerabilities_24.html
• report
  https://access.redhat.com/security/cve/CVE-2019-0220
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-0220
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-0220
• report
  https://access.redhat.com/security/cve/CVE-2019-10092
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-10092
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-10092
• report
  https://access.redhat.com/security/cve/CVE-2019-10097
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-10097
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-10097