Summary
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.
The following packages have been upgraded to a later upstream version: mod_http2 (1.15.7). (BZ#1814236)
Security Fix(es):
* httpd: memory corruption on early pushes (CVE-2019-10081)
* httpd: read-after-free in h2 connection shutdown (CVE-2019-10082)
* httpd: null-pointer dereference in mod_remoteip (CVE-2019-10097)
* httpd: mod_rewrite configurations vulnerable to open redirect (CVE-2020-1927)
* httpd: mod_http2: DoS via slow, unneeded request bodies (CVE-2018-17189)
* httpd: mod_http2: read-after-free on a string compare (CVE-2019-0196)
* httpd: mod_http2: possible crash on late upgrade (CVE-2019-0197)
* httpd: limited cross-site scripting in mod_proxy error page (CVE-2019-10092)
* httpd: mod_rewrite potential open redirect (CVE-2019-10098)
* httpd: mod_proxy_ftp use of uninitialized value (CVE-2020-1934)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | mod_md | 1:2.0.8-8.module+el8.5.0+695+1fa8055e |
| Rocky Linux · 8 | mod_md | 1:2.0.8-8.module+el8.4.0+553+7a69454b |
Vulnerabilities 10
-
Unscored —CVE-2018-17189 EPSS 19%
In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the …
-
Unscored —CVE-2019-0196 EPSS 19%
A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handli…
-
Unscored —
A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade…
-
Unscored —CVE-2019-10081 EPSS 14%
HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwr…
-
Unscored —CVE-2019-10082 EPSS 17%
In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memo…
-
Unscored —
In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error pag…
-
Unscored —CVE-2019-10097 EPSS 53%
In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using …
-
Unscored —
In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential …
-
Unscored —CVE-2020-1927 EPSS 57%
In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential …
-
Unscored —CVE-2020-1934 EPSS 52%
In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP serv…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1209162
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1668497
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1695030
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1695042
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1743956
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1743959
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1743966
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1743974
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1743996
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1771847
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1814236
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1820761
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1820772
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1832844