RHSA-2019:4126: Moderate: httpd24-httpd security, bug fix, and enhancement update

First published: Tue Dec 10 2019(Updated: )

The Apache HTTP Server is a powerful, efficient, and extensible web server. The httpd24 packages provide a recent stable release of version 2.4 of the Apache HTTP Server, along with the mod_auth_kerb module.<br>Security Fix(es):<br><li> httpd: mod_session_cookie does not respect expiry time (CVE-2018-17199)</li> <li> httpd: mod_auth_digest: access control bypass due to race condition (CVE-2019-0217)</li> <li> httpd: null-pointer dereference in mod_remoteip (CVE-2019-10097)</li> <li> httpd: mod_http2: DoS via slow, unneeded request bodies (CVE-2018-17189)</li> <li> httpd: URL normalization inconsistency (CVE-2019-0220)</li> <li> httpd: limited cross-site scripting in mod_proxy error page (CVE-2019-10092)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.<br>Bug Fix(es):<br><li> `ExtendedStatus Off` directive when using mod_systemd causes systemctl to hang (BZ#1669213)</li> <li> httpd can not be started with mod_md enabled (BZ#1673019)</li> <li> Rebuild metapackage with latest scl-utils (BZ#1696527)</li> <li> fix a regression introduced in r1740928 (BZ#1707636)</li> <li> duplicated cookie in Apache httpd with mod_session (BZ#1725922)</li> <li> Unexpected OCSP in proxy SSL connection (BZ#1744120)</li> Enhancement(s):<br><li> RFE: updated collection for httpd 2.4 (BZ#1726706)</li> Additional Changes:<br>For detailed information on changes in this release, see the Red Hat Software Collections 3.4 Release Notes linked from the References section.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/description
• agent/event
• agent/first-publish-date
• agent/last-modified-date
• agent/references
• agent/remedy
• agent/severity
• agent/softwarecombine
• agent/tags
• agent/title
• agent/type
• agent/weakness
• collector/redhat-errata
• source/Red Hat
• anchor-id/RHSA-2019:4126
• agent/software-canonical-lookup
• package-manager/redhat