RHSA-2019:4126: Moderate: httpd24-httpd security, bug fix, and enhancement update

The Apache HTTP Server is a powerful, efficient, and extensible web server. The httpd24 packages provide a recent stable release of version 2.4 of the Apache HTTP Server, along with the modauthkerb module.Security Fix(es): httpd: modsessioncookie does not respect expiry time (CVE-2018-17199) httpd: modauthdigest: access control bypass due to race condition (CVE-2019-0217) httpd: null-pointer dereference in modremoteip (CVE-2019-10097) httpd: modhttp2: DoS via slow, unneeded request bodies (CVE-2018-17189) httpd: URL normalization inconsistency (CVE-2019-0220) httpd: limited cross-site scripting in modproxy error page (CVE-2019-10092) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Bug Fix(es): ExtendedStatus Off directive when using modsystemd causes systemctl to hang (BZ#1669213) httpd can not be started with modmd enabled (BZ#1673019) Rebuild metapackage with latest scl-utils (BZ#1696527) fix a regression introduced in r1740928 (BZ#1707636) duplicated cookie in Apache httpd with modsession (BZ#1725922) Unexpected OCSP in proxy SSL connection (BZ#1744120) Enhancement(s): RFE: updated collection for httpd 2.4 (BZ#1726706) Additional Changes:For detailed information on changes in this release, see the Red Hat Software Collections 3.4 Release Notes linked from the References section.