Description
A regression was found in the Red Hat Enterprise Linux 6.9 version of httpd 2.2.15-60, causing comments in the "Allow" and "Deny" configuration lines to be parsed incorrectly. A web administrator could unintentionally allow any client to access a restricted HTTP resource.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | httpd | 2.2.15-60 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | httpd +3 | 2.2.15-60.el6_9.6 | RHSA-2017:2972 |
| RHEL 6 | mod_ssl | 1:2.2.15-60.el6_9.6 | RHSA-2017:2972 |
Advisories 1
- RHSA-2017:2972 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
References
- 101516 vdb-entry
- RHSA-2017:2972 vendor-advisory
- 1039633 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12171