REDHAT-BUG-2419139: Medium severity Apache HTTP Server vulnerability
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs.
This issue affects Apache HTTP Server from 2.4.0 through 2.4.65.
Users are recommended to upgrade to version 2.4.66 which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache HTTP Serverto a version that resolves this vulnerability.Fixed in 2.4.66
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2419139?
The severity of REDHAT-BUG-2419139 is classified as moderate.
How do I fix REDHAT-BUG-2419139?
To fix REDHAT-BUG-2419139, update to Apache HTTP Server version 2.4.66 or later.
Which Apache HTTP Server versions are affected by REDHAT-BUG-2419139?
REDHAT-BUG-2419139 affects Apache HTTP Server versions from 2.4.0 to 2.4.65.
What type of vulnerability is REDHAT-BUG-2419139?
REDHAT-BUG-2419139 is an improper neutralization of escape, meta, or control sequences vulnerability.
What impact does REDHAT-BUG-2419139 have on CGI programs?
REDHAT-BUG-2419139 allows environment variables set via Apache configuration to improperly supersede server-calculated variables for CGI programs.