This update includes the latest upstream release of the Apache HTTP Server, version 2.4.33. A number of security vulnerabilities are fixed in this release :

  - *Low*: Possible out of bound read in mod_cache_socache     (CVE-2018-1303)

  - *Low*: Possible out of bound access after failure in     reading the HTTP request (CVE-2018-1301)

  - *Low*: Weak Digest auth nonce generation in     mod_auth_digest (CVE-2018-1312)

  - *Low*: <FilesMatch> bypass with a trailing newline in     the file name (CVE-2017-15715)

  - *Low*: Out of bound write in mod_authnz_ldap when using     too small Accept-Language values (CVE-2017-15710)

  - *Moderate*: Tampering of mod_session data for CGI     applications (CVE-2018-1283)

For more information about changes in this release, see:
https://www.apache.org/dist/httpd/CHANGES_2.4.33

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the httpd package has been released.

Several vulnerabilities have been found in the Apache HTTPD server.

  - CVE-2017-15710     Alex Nichols and Jakob Hirsch reported that     mod_authnz_ldap, if configured with     AuthLDAPCharsetConfig, could cause an out of bound write     if supplied with a crafted Accept-Language header. This     could potentially be used for a Denial of Service     attack.

  - CVE-2017-15715     Elar Lang discovered that expression specified in     <FilesMatch> could match '$' to a newline character in a     malicious filename, rather than matching only the end of     the filename. This could be exploited in environments     where uploads of some files are externally blocked, but     only by matching the trailing portion of the filename.

  - CVE-2018-1283     When mod_session is configured to forward its session     data to CGI applications (SessionEnv on, not the     default), a remote user could influence their content by     using a 'Session' header.

  - CVE-2018-1301     Robert Swiecki reported that a specially crafted request     could have crashed the Apache HTTP Server, due to an out     of bound access after a size limit is reached by reading     the HTTP header.

  - CVE-2018-1303     Robert Swiecki reported that a specially crafted HTTP     request header could have crashed the Apache HTTP Server     if using mod_cache_socache, due to an out of bound read     while preparing data to be cached in shared memory.

  - CVE-2018-1312     Nicolas Daniels discovered that when generating an HTTP     Digest authentication challenge, the nonce sent by     mod_auth_digest to prevent replay attacks was not     correctly generated using a pseudo-random seed. In a     cluster of servers using a common Digest authentication     configuration, HTTP requests could be replayed across     servers by an attacker without detection.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30     due to an out of bound read while preparing data to be cached in shared memory. It could be used as a     Denial of Service attack against users of mod_cache_socache. The vulnerability is considered as low risk     since mod_cache_socache is not widely used, mod_cache_disk is not concerned by this vulnerability.
    (CVE-2018-1303)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3558 advisory.

    The Apache HTTP Server is a powerful, efficient, and extensible web server. The httpd24 packages provide a     recent stable release of version 2.4 of the Apache HTTP Server, along with the mod_auth_kerb module.

    The following packages have been upgraded to a later upstream version: httpd24-httpd (2.4.34),     httpd24-curl (7.61.1). (BZ#1590833, BZ#1648928)

    Security Fix(es):

    * httpd: Improper handling of headers in mod_session can allow a remote user to modify session data for     CGI applications (CVE-2018-1283)

    * httpd: Out of bounds read in mod_cache_socache can allow a remote attacker to cause DoS (CVE-2018-1303)

    * httpd: mod_http2: Too much time allocated to workers, possibly leading to DoS (CVE-2018-1333)

    * httpd: DoS for HTTP/2 connections by continuous SETTINGS frames (CVE-2018-11763)

    * httpd: Out of bounds write in mod_authnz_ldap when using too small Accept-Language values     (CVE-2017-15710)

    * httpd: <FilesMatch> bypass with a trailing newline in the file name (CVE-2017-15715)

    * httpd: Out of bounds access after failure in reading the HTTP request (CVE-2018-1301)

    * httpd: Weak Digest auth nonce generation in mod_auth_digest (CVE-2018-1312)

    * curl: Multiple security issues were fixed in httpd24-curl (CVE-2016-5419, CVE-2016-5420, CVE-2016-5421,     CVE-2016-7141, CVE-2016-7167, CVE-2016-8615, CVE-2016-8616, CVE-2016-8617, CVE-2016-8618, CVE-2016-8619,     CVE-2016-8620, CVE-2016-8621, CVE-2016-8622, CVE-2016-8623, CVE-2016-8624, CVE-2016-8625, CVE-2016-9586,     CVE-2017-1000100, CVE-2017-1000101, CVE-2017-1000254, CVE-2017-1000257, CVE-2017-7407, CVE-2017-8816,     CVE-2017-8817, CVE-2018-1000007, CVE-2018-1000120, CVE-2018-1000121, CVE-2018-1000122, CVE-2018-1000301,     CVE-2018-14618)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank the Curl project for reporting CVE-2017-8816, CVE-2017-8817, CVE-2017-1000254,     CVE-2017-1000257, CVE-2018-1000007, CVE-2018-1000120, CVE-2018-1000122, CVE-2018-1000301, CVE-2016-9586,     CVE-2017-1000100, CVE-2017-1000101, CVE-2018-14618, and CVE-2018-1000121. Upstream acknowledges Alex     Nichols as the original reporter of CVE-2017-8816; the OSS-Fuzz project as the original reporter of     CVE-2017-8817 and CVE-2018-1000301; Max Dymond as the original reporter of CVE-2017-1000254 and     CVE-2018-1000122; Brian Carpenter and the OSS-Fuzz project as the original reporters of CVE-2017-1000257;
    Craig de Stigter as the original reporter of CVE-2018-1000007; Duy Phan Thanh as the original reporter of     CVE-2018-1000120; Even Rouault as the original reporter of CVE-2017-1000100; Brian Carpenter as the     original reporter of CVE-2017-1000101; Zhaoyang Wu as the original reporter of CVE-2018-14618; and Dario     Weisser as the original reporter of CVE-2018-1000121.

    Bug Fix(es):

    * Previously, the Apache HTTP Server from the httpd24 Software Collection was unable to handle situations     when static content was repeatedly requested in a browser by refreshing the page. As a consequence, HTTP/2     connections timed out and httpd became unresponsive. This bug has been fixed, and HTTP/2 connections now     work as expected in the described scenario. (BZ#1518737)

    Enhancement(s):

    * This update adds the mod_md module to the httpd24 Software Collection. This module enables managing     domains across virtual hosts and certificate provisioning using the Automatic Certificate Management     Environment (ACME) protocol. The mod_md module is available only for Red Hat Enterprise Linux 7.
    (BZ#1640722)

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Software Collections 3.2 Release     Notes linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-3739:01 advisory.

    * httpd: Improper handling of headers in mod_session can allow a remote user to modify session data for     CGI applications (CVE-2018-1283)
    * httpd: Out of bounds read in mod_cache_socache can allow a remote attacker to cause DoS (CVE-2018-1303)
    * httpd: mod_http2: Too much time allocated to workers, possibly leading to DoS (CVE-2018-1333)
    * httpd: DoS for HTTP/2 connections by continuous SETTINGS frames (CVE-2018-11763)
    * httpd: Out of bounds write in mod_authnz_ldap when using too small Accept-Language values     (CVE-2017-15710)
    * httpd:  bypass with a trailing newline in the file name (CVE-2017-15715)
    * httpd: Out of bounds access after failure in reading the HTTP request (CVE-2018-1301)
    * httpd: Weak Digest auth nonce generation in mod_auth_digest (CVE-2018-1312)
    * curl: Multiple security issues were fixed in httpd24-curl (CVE-2016-5419, CVE-2016-5420, CVE-2016-5421,     CVE-2016-7141, CVE-2016-7167, CVE-2016-8615, CVE-2016-8616, CVE-2016-8617, CVE-2016-8618, CVE-2016-8619,     CVE-2016-8620, CVE-2016-8621, CVE-2016-8622, CVE-2016-8623, CVE-2016-8624, CVE-2016-8625, CVE-2016-9586,     CVE-2017-1000100, CVE-2017-1000101, CVE-2017-1000254, CVE-2017-1000257, CVE-2017-7407, CVE-2017-8816,     CVE-2017-8817, CVE-2018-1000007, CVE-2018-1000120, CVE-2018-1000121, CVE-2018-1000122, CVE-2018-1000301,     CVE-2018-14618)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:0367 advisory.

    Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This     software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged     under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent     update experience.

    This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.29 Service Pack 1 serves as an update     to Red Hat JBoss Core Services Apache HTTP Server 2.4.29, and includes bug fixes for CVEs which are linked     to in the References section.

    Security Fixes:

    * httpd: DoS for HTTP/2 connections by continuous SETTINGS (CVE-2018-11763)

    * httpd: Weak Digest auth nonce generation in mod_auth_digest     (CVE-2018-1312)

    * httpd: Out of bound access after failure in reading the HTTP request     (CVE-2018-1301)

    * httpd: Use-after-free on HTTP/2 stream shutdown (CVE-2018-1302)

    * httpd: <FilesMatch> bypass with a trailing newline in the file name     (CVE-2017-15715)

    * httpd: Out of bound write in mod_authnz_ldap when using too small     Accept-Language values (CVE-2017-15710)

    * httpd: Out of bounds read in mod_cache_socache can allow a remote     attacker to cause a denial of service (CVE-2018-1303)

    * httpd: Improper handling of headers in mod_session can allow a remote     user to modify session data for CGI applications (CVE-2018-1283)

    * httpd: mod_http2: too much time allocated to workers, possibly leading to     DoS (CVE-2018-1333)

    * mod_jk: connector path traversal due to mishandled HTTP requests in httpd     (CVE-2018-11759)

    * nghttp2: Null pointer dereference when too large ALTSVC frame is received     (CVE-2018-1000168)

    * openssl: Handling of crafted recursive ASN.1 structures can cause a stack     overflow and resulting denial of service (CVE-2018-0739)

    Details around each issue, including information about the CVE, severity of     the issue, and the CVSS score, can be found on the CVE pages listed in the     Reference section below.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of AOS installed on the remote host is prior to 5.19.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AOS-5.19.1 advisory.

  - In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length     checks. In cases where the application calling the library did not perform a sanity check on the inputs it     could result in a crash due to a buffer overflow. (CVE-2019-17006)

  - Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. (CVE-2019-5482)

  - In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives.
    When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may     contain files with permissions the attacker did not have or in paths he did not have access to. Extracting     those archives from a high-privilege user without carefully reviewing them may lead to the compromise of     the system. (CVE-2019-14866)

  - If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to     8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the     HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP     headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This     could lead to users seeing responses for unexpected resources. (CVE-2020-13943)

  - Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported     versions that are affected are 5.6.45 and prior, 5.7.27 and prior and 8.0.17 and prior. Easily exploitable     vulnerability allows low privileged attacker with network access via multiple protocols to compromise     MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang     or frequently repeatable crash (complete DOS) of MySQL Server. (CVE-2019-2974)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
120484	Fedora 28 : httpd (2018-6744ca470d)	Nessus	Fedora Local Security Checks	1/3/2019	7/5/2024	critical
121822	Photon OS 1.0: Httpd PHSA-2018-1.0-0126	Nessus	PhotonOS Local Security Checks	2/7/2019	3/20/2025	high
108816	Debian DSA-4164-1 : apache2 - security update	Nessus	Debian Local Security Checks	4/4/2018	11/21/2024	critical
222358	Linux Distros Unpatched Vulnerability : CVE-2018-1303	Nessus	Misc.	3/4/2025	8/4/2026	high
194113	RHEL 6 / 7 : httpd24 (RHSA-2018:3558)	Nessus	Red Hat Local Security Checks	4/27/2024	3/16/2025	critical
289086	MiracleLinux 7 : httpd24-nghttp2-1.7.1-7.el7, httpd24-curl-7.61.1-1.el7, httpd24-httpd-2.4.34-7.el7 (AXSA:2019-3739:01)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/16/2026	critical
122292	RHEL 6 / 7 : Red Hat JBoss Core Services Apache HTTP Server 2.4.29 (RHSA-2019:0367)	Nessus	Red Hat Local Security Checks	2/19/2019	11/6/2024	critical
164584	Nutanix AOS : Multiple Vulnerabilities (NXSA-AOS-5.19.1)	Nessus	Misc.	9/1/2022	7/22/2025	critical

Detections

Analytics

Plugins Search

critical

high

critical

high

critical

critical

critical

critical