CVE-2015-3185
First published: Wed Jul 15 2015(Updated: )
Apache HTTP Server 2.4.16 release fixes the following issue: *) SECURITY: <a href="https://access.redhat.com/security/cve/CVE-2015-3185">CVE-2015-3185</a> (cve.mitre.org) Replacement of ap_some_auth_required (unusable in Apache httpd 2.4) with new ap_some_authn_required and ap_force_authn hook. [Ben Reser] External References: <a href="http://httpd.apache.org/security/vulnerabilities_24.html#2.4.16">http://httpd.apache.org/security/vulnerabilities_24.html#2.4.16</a>
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/jbcs-httpd24-httpd | <0:2.4.23-122.jbcs.el6 | 0:2.4.23-122.jbcs.el6 |
| redhat/jbcs-httpd24-openssl | <1:1.0.2h-14.jbcs.el6 | 1:1.0.2h-14.jbcs.el6 |
| redhat/jbcs-httpd24-httpd | <0:2.4.23-122.jbcs.el7 | 0:2.4.23-122.jbcs.el7 |
| redhat/jbcs-httpd24-openssl | <1:1.0.2h-14.jbcs.el7 | 1:1.0.2h-14.jbcs.el7 |
| redhat/httpd | <0:2.4.6-31.el7_1.1 | 0:2.4.6-31.el7_1.1 |
| redhat/httpd24-httpd | <0:2.4.12-4.el6.2 | 0:2.4.12-4.el6.2 |
| redhat/httpd24-httpd | <0:2.4.12-6.el7.1 | 0:2.4.12-6.el7.1 |
| redhat/httpd | <2.4.16 | 2.4.16 |
| Canonical Ubuntu Linux | =12.04 | |
| Canonical Ubuntu Linux | =14.04 | |
| Canonical Ubuntu Linux | =15.04 | |
| Apache HTTP Server | =2.4.0 | |
| Apache HTTP Server | =2.4.1 | |
| Apache HTTP Server | =2.4.2 | |
| Apache HTTP Server | =2.4.3 | |
| Apache HTTP Server | =2.4.4 | |
| Apache HTTP Server | =2.4.6 | |
| Apache HTTP Server | =2.4.7 | |
| Apache HTTP Server | =2.4.8 | |
| Apache HTTP Server | =2.4.9 | |
| Apache HTTP Server | =2.4.10 | |
| Apache HTTP Server | =2.4.12 | |
| Apache HTTP Server | =2.4.13 | |
| Apple Xcode | =7.0 | |
| Apple Mac OS X | =10.10.4 | |
| Apple Mac OS X Server | =5.0.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2015-3185 https://nvd.nist.gov/vuln/detail/CVE-2015-3185 http://httpd.apache.org/security/vulnerabilities_24.html#2.4.16
- https://bugzilla.redhat.com/show_bug.cgi?id=1243888
- https://access.redhat.com/errata/RHSA-2017:2710
- https://access.redhat.com/errata/RHSA-2017:2709
- https://access.redhat.com/errata/RHSA-2015:1667
- https://access.redhat.com/errata/RHSA-2016:2957
- https://access.redhat.com/errata/RHSA-2017:2708
- https://access.redhat.com/errata/RHSA-2015:1666
- https://access.redhat.com/security/cve/CVE-2015-3185
- http://httpd.apache.org/security/vulnerabilities_24.html
- http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
- http://lists.apple.com/archives/security-announce/2015/Sep/msg00002.html
- http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html
- http://lists.opensuse.org/opensuse-updates/2015-10/msg00011.html
- http://rhn.redhat.com/errata/RHSA-2015-1666.html
- http://rhn.redhat.com/errata/RHSA-2015-1667.html
- http://rhn.redhat.com/errata/RHSA-2016-2957.html
- http://www.apache.org/dist/httpd/CHANGES_2.4
- http://www.debian.org/security/2015/dsa-3325
- http://www.securityfocus.com/bid/75965
- http://www.securitytracker.com/id/1032967
- http://www.ubuntu.com/usn/USN-2686-1
- https://github.com/apache/httpd/commit/cd2b7a26c776b0754fb98426a67804fd48118708
- https://github.com/apache/httpd/commit/db81019ab88734ed35fa70294a0cfa7a19743f73
- https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
- https://support.apple.com/HT205217
- https://support.apple.com/HT205219
- https://support.apple.com/kb/HT205031
- http://httpd.apache.org/security/vulnerabilities_24.html#2.4.16
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1243894
- https://svn.apache.org/viewvc?view=revision&revision=1684525
- https://rhn.redhat.com/errata/RHSA-2015-1666.html
- https://rhn.redhat.com/errata/RHSA-2015-1667.html
- https://rhn.redhat.com/errata/RHSA-2016-2957.html
- https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E
Parent vulnerabilities
(Appears in the following advisories)
- collector/redhat-cve
- agent/type
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2015-3185
- agent/software-canonical-lookup
- agent/weakness
- agent/severity
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/description
- agent/event
- agent/trending
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- agent/source
- package-manager/redhat
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/12.04
- version/canonical ubuntu linux/14.04
- version/canonical ubuntu linux/15.04
- vendor/apache
- canonical/apache http server
- version/apache http server/2.4.0
- version/apache http server/2.4.1
- version/apache http server/2.4.2
- version/apache http server/2.4.3
- version/apache http server/2.4.4
- version/apache http server/2.4.6
- version/apache http server/2.4.7
- version/apache http server/2.4.8
- version/apache http server/2.4.9
- version/apache http server/2.4.10
- version/apache http server/2.4.12
- version/apache http server/2.4.13
- vendor/apple
- canonical/apple xcode
- version/apple xcode/7.0
- canonical/apple mac os x
- version/apple mac os x/10.10.4
- canonical/apple mac os x server
- version/apple mac os x server/5.0.3