Summary
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.
Security Fix(es):
* httpd: mod_proxy NULL pointer dereference (CVE-2020-13950)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | httpd | 0:2.4.37-47.module+el8.6.0+823+f143cee1.1 |
| Rocky Linux · 8 | mod_http2 | 0:1.15.7-5.module+el8.6.0+823+f143cee1 |
| Rocky Linux · 8 | mod_md | 1:2.0.8-8.module+el8.5.0+695+1fa8055e |
| Rocky Linux · 8 | mod_md | 1:2.0.8-8.module+el8.4.0+553+7a69454b |
Vulnerabilities 1
-
Unscored —CVE-2020-13950 EPSS 50%
mod_proxy_http NULL pointer dereference
Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer dereference) with specially crafted requests using both Content-Length and Transfer-Encoding headers, leading to a Denial of Service
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1966738