RHSA-2021:1809: Moderate: httpd:2.4 security, bug fix, and enhancement update
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.Security Fix(es): httpd: modsessioncookie does not respect expiry time (CVE-2018-17199) httpd: modproxyuwsgi buffer overflow (CVE-2020-11984) httpd: modhttp2 concurrent pool usage (CVE-2020-11993) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Additional Changes:For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes linked from the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/httpdto a version that resolves this vulnerability.Fixed in 2.4.37-39.module+el8.4.0+9658+b87b2deb - Upgrade
Upgrade
redhat/httpd-filesystemto a version that resolves this vulnerability.Fixed in 2.4.37-39.module+el8.4.0+9658+b87b2deb - Upgrade
Upgrade
redhat/httpd-manualto a version that resolves this vulnerability.Fixed in 2.4.37-39.module+el8.4.0+9658+b87b2deb - Upgrade
Upgrade
redhat/httpd-debuginfoto a version that resolves this vulnerability.Fixed in 2.4.37-39.module+el8.4.0+9658+b87b2deb - Upgrade
Upgrade
redhat/httpd-debugsourceto a version that resolves this vulnerability.Fixed in 2.4.37-39.module+el8.4.0+9658+b87b2deb - Upgrade
Upgrade
redhat/httpd-develto a version that resolves this vulnerability.Fixed in 2.4.37-39.module+el8.4.0+9658+b87b2deb - Upgrade
Upgrade
redhat/httpd-toolsto a version that resolves this vulnerability.Fixed in 2.4.37-39.module+el8.4.0+9658+b87b2deb - Upgrade
Upgrade
redhat/httpd-tools-debuginfoto a version that resolves this vulnerability.Fixed in 2.4.37-39.module+el8.4.0+9658+b87b2deb - Upgrade
Upgrade
redhat/httpdto a version that resolves this vulnerability.Fixed in 2.4.37-39.module+el8.4.0+9658+b87b2deb.aa - Upgrade
Upgrade
redhat/httpd-debuginfoto a version that resolves this vulnerability.Fixed in 2.4.37-39.module+el8.4.0+9658+b87b2deb.aa - Upgrade
Upgrade
redhat/httpd-debugsourceto a version that resolves this vulnerability.Fixed in 2.4.37-39.module+el8.4.0+9658+b87b2deb.aa - Upgrade
Upgrade
redhat/httpd-develto a version that resolves this vulnerability.Fixed in 2.4.37-39.module+el8.4.0+9658+b87b2deb.aa - Upgrade
Upgrade
redhat/httpd-toolsto a version that resolves this vulnerability.Fixed in 2.4.37-39.module+el8.4.0+9658+b87b2deb.aa - Upgrade
Upgrade
redhat/httpd-tools-debuginfoto a version that resolves this vulnerability.Fixed in 2.4.37-39.module+el8.4.0+9658+b87b2deb.aa - Compensating control
Apply the Red Hat httpd update described in the advisory (covers CVE-2020-11993, CVE-2020-11984, and CVE-2018-17199).
- Operational
After installing the updated httpd packages, allow/ensure the httpd daemon restarts automatically.
Event History
Frequently Asked Questions
What is the severity of RHSA-2021:1809?
The severity of RHSA-2021:1809 is classified as moderate due to the potential exploitation of vulnerabilities affecting the Apache HTTP Server.
How do I fix RHSA-2021:1809?
To fix RHSA-2021:1809, update to the fixed version 2.4.37-39.module+el8.4.0+9658+b87b2deb or later of the affected httpd packages.
What vulnerabilities are addressed in RHSA-2021:1809?
RHSA-2021:1809 addresses vulnerabilities such as CVE-2018-17199 and CVE-2020-11984 affecting mod_session_cookie and mod_proxy_uwsgi respectively.
Which packages are affected by RHSA-2021:1809?
Affected packages include httpd, httpd-debuginfo, httpd-devel, httpd-tools, and several others from the Red Hat distributions.
Is it necessary to restart services after applying RHSA-2021:1809?
Yes, it is generally necessary to restart the Apache HTTP Server service to apply the updates and address vulnerabilities after patching.