Low CentOS httpd Update

Metadata

medium
4.3
httpd-2.2.3-74.el5.centos.i386.rpm, httpd-2.2.3-74.el5.centos.src.rpm, httpd-2.2.3-74.el5.centos.x86_64.rpm, httpd-devel-2.2.3-74.el5.centos.i386.rpm, httpd-devel-2.2.3-74.el5.centos.x86_64.rpm, httpd-manual-2.2.3-74.el5.centos.i386.rpm, httpd-manual-2.2.3-74.el5.centos.x86_64.rpm, mod_ssl-2.2.3-74.el5.centos.i386.rpm, mod_ssl-2.2.3-74.el5.centos.x86_64.rpm
CVE-2008-0455, CVE-2008-0456, CVE-2012-2687
rhn.redhat.com, lists.centos.org, lists.centos.org
2013-01-09
2017-07-27 19:04
Low CentOS httpd Update
CVE-2008-0456 apache2
CVE-2012-2687 apache2
CVE-2008-0455 apache2
CVE-2012-2687
2017-04-01 19:06
2017-01-05 20:10

Description


Updated httpd packages that fix multiple security issues, various bugs,
and add enhancements are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

The httpd packages contain the Apache HTTP Server (httpd), which is the
namesake project of The Apache Software Foundation.

Input sanitization flaws were found in the mod_negotiation module. A remote
attacker able to upload or create files with arbitrary names in a directory
that has the MultiViews options enabled, could use these flaws to conduct
cross-site scripting and HTTP response splitting attacks against users
visiting the site. (CVE-2008-0455, CVE-2008-0456, CVE-2012-2687)

Bug fixes:

* Previously, no check was made to see if the
/etc/pki/tls/private/localhost.key file was a valid key prior to running
the "%post" script for the "mod_ssl" package. Consequently, when
/etc/pki/tls/certs/localhost.crt did not exist and "localhost.key" was
present but invalid, upgrading the Apache HTTP Server daemon (httpd) with
mod_ssl failed. The "%post" script has been fixed to test for an existing
SSL key. As a result, upgrading httpd with mod_ssl now proceeds as
expected. (BZ#752618)

* The "mod_ssl" module did not support operation under FIPS mode.
Consequently, when operating Red Hat Enterprise Linux 5 with FIPS mode
enabled, httpd failed to start. An upstream patch has been applied to
disable non-FIPS functionality if operating under FIPS mode and httpd now
starts as expected. (BZ#773473)

* Prior to this update, httpd exit status codes were not Linux Standard
Base (LSB) compliant. When the command "service httpd reload" was run and
httpd failed, the exit status code returned was "0" and not in the range 1
to 6 as expected. A patch has been applied to the init script and httpd now
returns "1" as an exit status code. (BZ#783242)

* Chunked Transfer Coding is described in RFC 2616. Previously, the
Apache server did not correctly handle a chunked encoded POST request with
a "chunk-size" or "chunk-extension" value of 32 bytes or more.
Consequently, when such a POST request was made the server did not respond.
An upstream patch has been applied and the problem no longer occurs.
(BZ#840845)

* Due to a regression, when mod_cache received a non-cacheable 304
response, the headers were served incorrectly. Consequently, compressed
data could be returned to the client without the cached headers to indicate
the data was compressed. An upstream patch has been applied to merge
response and cached headers before data from the cache is served to the
client. As a result, cached data is now correctly interpreted by the
client. (BZ#845532)

* In a proxy configuration, certain response-line strings were not handled
correctly. If a response-line without a "description" string was received
from the origin server, for a non-standard status code, such as the "450"
status code, a "500 Internal Server Error" would be returned to the client.
This bug has been fixed so that the original response line is returned to
the client. (BZ#853128)

Enhancements:

* The configuration directive "LDAPReferrals" is now supported in addition
to the previously introduced "LDAPChaseReferrals". (BZ#727342)

* The AJP support module for "mod_proxy", "mod_proxy_ajp", now supports the
"ProxyErrorOverride" directive. Consequently, it is now possible to
configure customized error pages for web applications running on a backend
server accessed via AJP. (BZ#767890)

* The "%posttrans" scriptlet which automatically restarts the httpd service
after a package upgrade can now be disabled. If the file
/etc/sysconfig/httpd-disable-posttrans exists, the scriptlet will not
restart the daemon. (BZ#833042)

* The output of "httpd -S" now includes configured alias names for each
virtual host. (BZ#833043)

* New certificate variable names are now exposed by "mod_ssl" using the
"_DN_userID" suffix, such as "SSL_CLIENT_S_DN_userID", which use the
commonly used object identifier (OID) definition of "userID", OID
0.9.2342.19200300.100.1.1. (BZ#840036)

All users of httpd are advised to upgrade to these updated packages, which
fix these issues and add these enhancements.
Please see https://www.redhat.com/footer/terms-of-use.html

Am I vulnerable?

The constraints below list the versions that this vulnerability is patched in, and versions that are unaffected. If a patch is ready but unrealeased, then it is pending.

Or, you can just let us figure it out for you! Appcanary continously monitor your installed packages, and tell you if any of them are vulnerable.

Sign up for monitoring

Affected package information

Release Package Patched in
5 httpd httpd-2.2.3-74.el5.centos.i386.rpm
httpd httpd-2.2.3-74.el5.centos.src.rpm
httpd httpd-2.2.3-74.el5.centos.x86_64.rpm
httpd-devel httpd-devel-2.2.3-74.el5.centos.i386.rpm
httpd-devel httpd-devel-2.2.3-74.el5.centos.x86_64.rpm
httpd-manual httpd-manual-2.2.3-74.el5.centos.i386.rpm
httpd-manual httpd-manual-2.2.3-74.el5.centos.x86_64.rpm
mod_ssl mod_ssl-2.2.3-74.el5.centos.i386.rpm
mod_ssl mod_ssl-2.2.3-74.el5.centos.x86_64.rpm