RHSA-2020:4751 — Red Hat Security Advisory: httpd:2.4 security, bug fix, and enhancement update

Fixed packages 22

Release	Package	Fixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream	httpd	0:2.4.37-30.module+el8.3.0+7001+0766b9e7
Red Hat · RHEL 8 enterprise_linux:8::appstream	httpd-debuginfo	0:2.4.37-30.module+el8.3.0+7001+0766b9e7
Red Hat · RHEL 8 enterprise_linux:8::appstream	httpd-debugsource	0:2.4.37-30.module+el8.3.0+7001+0766b9e7
Red Hat · RHEL 8 enterprise_linux:8::appstream	httpd-devel	0:2.4.37-30.module+el8.3.0+7001+0766b9e7
Red Hat · RHEL 8 enterprise_linux:8::appstream	httpd-filesystem	0:2.4.37-30.module+el8.3.0+7001+0766b9e7
Red Hat · RHEL 8 enterprise_linux:8::appstream	httpd-manual	0:2.4.37-30.module+el8.3.0+7001+0766b9e7
Red Hat · RHEL 8 enterprise_linux:8::appstream	httpd-tools	0:2.4.37-30.module+el8.3.0+7001+0766b9e7
Red Hat · RHEL 8 enterprise_linux:8::appstream	httpd-tools-debuginfo	0:2.4.37-30.module+el8.3.0+7001+0766b9e7
Red Hat · RHEL 8 enterprise_linux:8::appstream	mod_http2	0:1.15.7-2.module+el8.3.0+7670+8bf57d29
Red Hat · RHEL 8 enterprise_linux:8::appstream	mod_http2-debuginfo	0:1.15.7-2.module+el8.3.0+7670+8bf57d29
Red Hat · RHEL 8 enterprise_linux:8::appstream	mod_http2-debugsource	0:1.15.7-2.module+el8.3.0+7670+8bf57d29
Red Hat · RHEL 8 enterprise_linux:8::appstream	mod_ldap	0:2.4.37-30.module+el8.3.0+7001+0766b9e7
Red Hat · RHEL 8 enterprise_linux:8::appstream	mod_ldap-debuginfo	0:2.4.37-30.module+el8.3.0+7001+0766b9e7
Red Hat · RHEL 8 enterprise_linux:8::appstream	mod_md	1:2.0.8-8.module+el8.3.0+6814+67d1e611
Red Hat · RHEL 8 enterprise_linux:8::appstream	mod_md-debuginfo	1:2.0.8-8.module+el8.3.0+6814+67d1e611
Red Hat · RHEL 8 enterprise_linux:8::appstream	mod_md-debugsource	1:2.0.8-8.module+el8.3.0+6814+67d1e611
Red Hat · RHEL 8 enterprise_linux:8::appstream	mod_proxy_html	1:2.4.37-30.module+el8.3.0+7001+0766b9e7
Red Hat · RHEL 8 enterprise_linux:8::appstream	mod_proxy_html-debuginfo	1:2.4.37-30.module+el8.3.0+7001+0766b9e7
Red Hat · RHEL 8 enterprise_linux:8::appstream	mod_session	0:2.4.37-30.module+el8.3.0+7001+0766b9e7
Red Hat · RHEL 8 enterprise_linux:8::appstream	mod_session-debuginfo	0:2.4.37-30.module+el8.3.0+7001+0766b9e7
Red Hat · RHEL 8 enterprise_linux:8::appstream	mod_ssl	1:2.4.37-30.module+el8.3.0+7001+0766b9e7
Red Hat · RHEL 8 enterprise_linux:8::appstream	mod_ssl-debuginfo	1:2.4.37-30.module+el8.3.0+7001+0766b9e7

Vulnerabilities 10

Unscored —

CVE-2018-17189 EPSS 19%

In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the …

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine

Jan 30, 2019
Unscored —

CVE-2019-0196 EPSS 19%

A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handli…

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine

Jun 11, 2019
Unscored —

CVE-2019-0197

A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade…

Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine

Jun 11, 2019
Unscored —

CVE-2019-10081 EPSS 14%

HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwr…

apache2 apache2 apache2 Debian Ubuntu Alpine

Aug 15, 2019
Unscored —

CVE-2019-10082 EPSS 17%

In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memo…

apache2 apache2 apache2 Debian Ubuntu Alpine

Sep 26, 2019
Unscored —

CVE-2019-10092 Public exploit Scanner template EPSS 81%

In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error pag…

apache2 apache2 apache2 Debian Ubuntu Alpine

Sep 26, 2019
Unscored —

CVE-2019-10097 EPSS 53%

In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using …

apache2 apache2 Debian Alpine

Sep 26, 2019
Unscored —

CVE-2019-10098 Public exploit Scanner template EPSS 74%

In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential …

apache2 apache2 apache2 Debian Ubuntu Alpine

Sep 25, 2019
Unscored —

CVE-2020-1927 EPSS 57%

In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential …

Apache Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine

Apr 1, 2020
Unscored —

CVE-2020-1934 EPSS 52%

In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP serv…

Apache Apache HTTP Server apache2 apache2 Debian Ubuntu Alpine

Apr 1, 2020

References

article
https://access.redhat.com/security/updates/classification/#moderate
article
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/
report
https://bugzilla.redhat.com/show_bug.cgi?id=1209162
report
https://bugzilla.redhat.com/show_bug.cgi?id=1668497
report
https://bugzilla.redhat.com/show_bug.cgi?id=1695030
report
https://bugzilla.redhat.com/show_bug.cgi?id=1695042
report
https://bugzilla.redhat.com/show_bug.cgi?id=1743956
report
https://bugzilla.redhat.com/show_bug.cgi?id=1743959
report
https://bugzilla.redhat.com/show_bug.cgi?id=1743966
report
https://bugzilla.redhat.com/show_bug.cgi?id=1743974
report
https://bugzilla.redhat.com/show_bug.cgi?id=1743996
report
https://bugzilla.redhat.com/show_bug.cgi?id=1771847
report
https://bugzilla.redhat.com/show_bug.cgi?id=1814236
report
https://bugzilla.redhat.com/show_bug.cgi?id=1820761
report
https://bugzilla.redhat.com/show_bug.cgi?id=1820772
report
https://bugzilla.redhat.com/show_bug.cgi?id=1832844
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4751.json
report
https://access.redhat.com/security/cve/CVE-2018-17189
advisory
https://www.cve.org/CVERecord?id=CVE-2018-17189
advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-17189
report
https://access.redhat.com/security/cve/CVE-2019-0196
advisory
https://www.cve.org/CVERecord?id=CVE-2019-0196
advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-0196
article
http://www.apache.org/dist/httpd/CHANGES_2.4
article
https://httpd.apache.org/security/vulnerabilities_24.html
report
https://access.redhat.com/security/cve/CVE-2019-0197
advisory
https://www.cve.org/CVERecord?id=CVE-2019-0197
advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-0197
report
https://access.redhat.com/security/cve/CVE-2019-10081
advisory
https://www.cve.org/CVERecord?id=CVE-2019-10081
advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-10081
report
https://access.redhat.com/security/cve/CVE-2019-10082
advisory
https://www.cve.org/CVERecord?id=CVE-2019-10082
advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-10082
report
https://access.redhat.com/security/cve/CVE-2019-10092
advisory
https://www.cve.org/CVERecord?id=CVE-2019-10092
advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-10092
report
https://access.redhat.com/security/cve/CVE-2019-10097
advisory
https://www.cve.org/CVERecord?id=CVE-2019-10097

Red Hat Security Advisory: httpd:2.4 security, bug fix, and enhancement update

Fixed packages 22

Vulnerabilities 10

In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the …

A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handli…

A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade…

HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwr…

In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memo…

In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error pag…

In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using …

In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential …

In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential …

In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP serv…

References