This update for apache2 fixes the following issues :

Security issues fixed :

  - CVE-2016-8743: Fixed liberal whitespace interpretation     accepted from requests and sent in response lines and     headers. Accepting these different behaviors represented     a security concern when httpd participates in any chain     of proxies or interacts with back-end application     servers, either through mod_proxy or using conventional     CGI mechanisms, and may result in request smuggling,     response splitting and cache pollution. (bsc#1016715)

  - CVE-2016-4975: Fixed possible CRLF injection allowing     HTTP response splitting attacks for sites which use     mod_userdir. This issue was mitigated by changes which     prohibit CR or LF injection into the 'Location' or other     outbound header key or value. (bsc#1104826) This update     was imported from the SUSE:SLE-12-SP2:Update update     project.

This update for apache2 fixes the following issues :

Security issues fixed :

CVE-2016-8743: Fixed liberal whitespace interpretation accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution. (bsc#1016715)

CVE-2016-4975: Fixed possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes which prohibit CR or LF injection into the 'Location' or other outbound header key or value. (bsc#1104826)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of Apache running on the remote host is 2.2.x prior to 2.2.32. It is, therefore, affected by the following vulnerabilities :

  - The Apache HTTP Server is affected by a     man-in-the-middle vulnerability known as 'httpoxy' due     to a failure to properly resolve namespace conflicts in     accordance with RFC 3875 section 4.1.18. The HTTP_PROXY     environment variable is set based on untrusted user data     in the 'Proxy' header of HTTP requests. The HTTP_PROXY     environment variable is used by some web client     libraries to specify a remote proxy server. An     unauthenticated, remote attacker can exploit this, via a     crafted 'Proxy' header in an HTTP request, to redirect     an application's internal HTTP traffic to an arbitrary     proxy server where it may be observed or manipulated.
    (CVE-2016-5387)

  - A flaw exists due to improper handling of whitespace     patterns in user-agent headers. An unauthenticated,     remote attacker can exploit this, via a specially     crafted user-agent header, to cause the program to     incorrectly process sequences of requests, resulting in     interpreting responses incorrectly, polluting the cache,     or disclosing the content from one request to a second     downstream user-agent. (CVE-2016-8743)

  - A CRLF injection allowing HTTP response splitting attacks for     sites which use mod_userdir (CVE-2016-4975)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Possible CRLF injection allowing HTTP response     splitting attacks for sites which use mod_userdir. This     issue was mitigated by changes made in 2.4.25 and     2.2.32 which prohibit CR or LF injection into the     'Location' or other outbound header key or value. Fixed     in Apache HTTP Server 2.4.25 (Affected 2.4.1-2.4.23).
    Fixed in Apache HTTP Server 2.2.32 (Affected     2.2.0-2.2.31).(CVE-2016-4975)

  - A specially crafted request could have crashed the     Apache HTTP Server prior to version 2.4.30, due to an     out of bound access after a size limit is reached by     reading the HTTP header. This vulnerability is     considered very hard if not impossible to trigger in     non-debug mode (both log and build level), so it is     classified as low risk for common server     usage.(CVE-2018-1301)

  - In Apache httpd 2.4.0 to 2.4.29, when mod_session is     configured to forward its session data to CGI     applications (SessionEnv on, not the default), a remote     user may influence their content by using a 'Session'     header. This comes from the 'HTTP_SESSION' variable     name used by mod_session to forward its data to CGIs,     since the prefix 'HTTP_' is also used by the Apache     HTTP Server to pass HTTP header fields, per CGI     specifications.(CVE-2018-1283)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its banner, the version of Apache running on the remote host is 2.4.x prior to 2.4.25. It is, therefore, affected by the following vulnerabilities :

 - A flaw exists in the mod_session_crypto module due to encryption for data and cookies using the configured ciphers with possibly either CBC or ECB modes of operation (AES256-CBC by default). An unauthenticated, remote attacker can exploit this, via a padding oracle attack, to decrypt information
without knowledge of the encryption key, resulting in the disclosure of potentially sensitive information. (CVE-2016-0736)

 - A denial of service vulnerability exists in the mod_auth_digest module during client entry allocation. An unauthenticated, remote attacker can exploit this, via specially crafted input, to exhaust shared memory resources, resulting in a server crash. (CVE-2016-2161)

 - The Apache HTTP Server is affected by a man-in-the-middle vulnerability known as 'httpoxy' due to a failure to properly resolve namespace conflicts in accordance with RFC 3875 section 4.1.18. The HTTP_PROXY environment variable is set based on untrusted user data in the 'Proxy' header of HTTP
requests. The HTTP_PROXY environment variable is used by some web client libraries to specify a remote proxy server. An unauthenticated, remote attacker can exploit this, via a crafted 'Proxy' header in an HTTP request, to redirect an application's internal HTTP traffic to an arbitrary proxy server
where it may be observed or manipulated. (CVE-2016-5387)

 - A denial of service vulnerability exists in the mod_http2 module due to improper handling of the LimitRequestFields directive. An unauthenticated, remote attacker can exploit this, via specially crafted CONTINUATION frames in an HTTP/2 request, to inject unlimited request headers into the server
, resulting in the exhaustion of memory resources. (CVE-2016-8740)

 - A flaw exists due to improper handling of whitespace patterns in user-agent headers. An unauthenticated, remote attacker can exploit this, via a specially crafted user-agent header, to cause the program to incorrectly process sequences of requests, resulting in interpreting responses incorrectly
, polluting the cache, or disclosing the content from one request to a second downstream user-agent. (CVE-2016-8743)

 - A CRLF vulnerability exists in the mod_userdir module. An unauthenticated, remote attacker can exploit this, allowing HTTP response splitting attacks. (CVE-2016-4975)

 Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its banner, the version of Apache running on the remote host is 2.4.x prior to 2.4.25. It is, therefore, affected by the following vulnerabilities :

  - A flaw exists in the mod_session_crypto module due to     encryption for data and cookies using the configured     ciphers with possibly either CBC or ECB modes of     operation (AES256-CBC by default). An unauthenticated,     remote attacker can exploit this, via a padding oracle     attack, to decrypt information without knowledge of the     encryption key, resulting in the disclosure of     potentially sensitive information. (CVE-2016-0736)

  - A denial of service vulnerability exists in the     mod_auth_digest module during client entry allocation.
    An unauthenticated, remote attacker can exploit this,     via specially crafted input, to exhaust shared memory     resources, resulting in a server crash. (CVE-2016-2161)

  - The Apache HTTP Server is affected by a     man-in-the-middle vulnerability known as 'httpoxy' due     to a failure to properly resolve namespace conflicts in     accordance with RFC 3875 section 4.1.18. The HTTP_PROXY     environment variable is set based on untrusted user data     in the 'Proxy' header of HTTP requests. The HTTP_PROXY     environment variable is used by some web client     libraries to specify a remote proxy server. An     unauthenticated, remote attacker can exploit this, via a     crafted 'Proxy' header in an HTTP request, to redirect     an application's internal HTTP traffic to an arbitrary     proxy server where it may be observed or manipulated.
    (CVE-2016-5387)

  - A denial of service vulnerability exists in the     mod_http2 module due to improper handling of the     LimitRequestFields directive. An unauthenticated, remote     attacker can exploit this, via specially crafted     CONTINUATION frames in an HTTP/2 request, to inject     unlimited request headers into the server, resulting in     the exhaustion of memory resources. (CVE-2016-8740)

  - A flaw exists due to improper handling of whitespace     patterns in user-agent headers. An unauthenticated,     remote attacker can exploit this, via a specially     crafted user-agent header, to cause the program to     incorrectly process sequences of requests, resulting in     interpreting responses incorrectly, polluting the cache,     or disclosing the content from one request to a second     downstream user-agent. (CVE-2016-8743)

  - A CRLF injection allowing HTTP response splitting attacks for     sites which use mod_userdir (CVE-2016-4975)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Red Hat JBoss Core Services Pack Apache Server 2.4.29 packages are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this release as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

This release adds the new Apache HTTP Server 2.4.29 packages that are part of the JBoss Core Services offering.

This release serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.23, and includes bug fixes and enhancements.
Refer to the Release Notes for information on the most significant bug fixes, enhancements and component upgrades included in this release.

This release upgrades OpenSSL to version 1.0.2.n

Security Fix(es) :

* openssl: Out-of-bounds write caused by unchecked errors in BN_bn2dec() (CVE-2016-2182)

* openssl: Insufficient TLS session ticket HMAC length checks (CVE-2016-6302)

* openssl: certificate message OOB reads (CVE-2016-6306)

* openssl: Carry propagating bug in Montgomery multiplication (CVE-2016-7055)

* openssl: Truncated packet could crash via OOB read (CVE-2017-3731)

* openssl: BN_mod_exp may produce incorrect results on x86_64 (CVE-2017-3732)

* openssl: bn_sqrx8x_internal carry bug on x86_64 (CVE-2017-3736)

* openssl: Read/write after SSL object in error state (CVE-2017-3737)

* openssl: rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738)

Red Hat would like to thank the OpenSSL project for reporting CVE-2016-6306 and CVE-2016-7055. Upstream acknowledges Shi Lei (Gear Team of Qihoo 360 Inc.) as the original reporter of CVE-2016-6306.

Red Hat JBoss Core Services Pack Apache Server 2.4.29 packages are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this release as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

This release adds the new Apache HTTP Server 2.4.29 packages that are part of the JBoss Core Services offering.

This release serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.23, and includes bug fixes and enhancements.
Refer to the Release Notes for information on the most significant bug fixes, enhancements and component upgrades included in this release.

This release upgrades OpenSSL to version 1.0.2.n

Security Fix(es) :

* openssl: Out-of-bounds write caused by unchecked errors in BN_bn2dec() (CVE-2016-2182)

* openssl: Insufficient TLS session ticket HMAC length checks (CVE-2016-6302)

* openssl: certificate message OOB reads (CVE-2016-6306)

* openssl: Carry propagating bug in Montgomery multiplication (CVE-2016-7055)

* openssl: Truncated packet could crash via OOB read (CVE-2017-3731)

* openssl: BN_mod_exp may produce incorrect results on x86_64 (CVE-2017-3732)

* openssl: bn_sqrx8x_internal carry bug on x86_64 (CVE-2017-3736)

* openssl: Read/write after SSL object in error state (CVE-2017-3737)

* openssl: rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738)

Red Hat would like to thank the OpenSSL project for reporting CVE-2016-6306 and CVE-2016-7055. Upstream acknowledges Shi Lei (Gear Team of Qihoo 360 Inc.) as the original reporter of CVE-2016-6306.

ID	Name	Product	Family	Published	Updated	Severity
117789	openSUSE Security Update : apache2 (openSUSE-2018-1046)	Nessus	SuSE Local Security Checks	2018/09/27	2018/09/27	medium
118291	SUSE SLES12 Security Update : apache2 (SUSE-SU-2018:2815-2)	Nessus	SuSE Local Security Checks	2018/10/22	2019/09/10	medium
112199	SUSE SLES12 Security Update : apache2 (SUSE-SU-2018:2554-1)	Nessus	SuSE Local Security Checks	2018/08/31	2019/09/10	medium
117695	SUSE SLES12 Security Update : apache2 (SUSE-SU-2018:2815-1)	Nessus	SuSE Local Security Checks	2018/09/25	2019/09/10	medium
96450	Apache 2.2.x < 2.2.32 Multiple Vulnerabilities (httpoxy)	Nessus	Web Servers	2017/01/12	2019/03/27	medium
131894	EulerOS 2.0 SP2 : httpd (EulerOS-SA-2019-2402)	Nessus	Huawei Local Security Checks	2019/12/10	2019/12/10	medium
98910	Apache 2.4.x < 2.4.25 Multiple Vulnerabilities (httpoxy)	Web Application Scanning	Component Vulnerability	2019/01/09	2019/04/10	medium
96451	Apache 2.4.x < 2.4.25 Multiple Vulnerabilities (httpoxy)	Nessus	Web Servers	2017/01/12	2019/11/13	medium
111146	RHEL 7 : Red Hat JBoss Core Services Apache HTTP Server 2.4.29 RHEL 7 (RHSA-2018:2185)	Nessus	Red Hat Local Security Checks	2018/07/18	2019/10/24	high
111147	RHEL 6 : Red Hat JBoss Core Services Apache HTTP Server 2.4.29 RHEL 6 (RHSA-2018:2186)	Nessus	Red Hat Local Security Checks	2018/07/18	2019/10/24	high

Plugins Search