Multiple cross-site scripting (XSS) vulnerabilities in the makevariantlist function in modnegotiation.c in the modnegotiation module in the Apache HTTP Server 2.4.x before 2.4.3, when the MultiViews option is enabled, allow remote attackers to inject arbitrary web script or HTML via a crafted filename that is not properly handled during construction of a variant list.

A flaw [1] was found in modlogconfig. If an administrator configured the "%{cookiename}C" log format string to be used, a remote attacker could send a specific cookie which would cause a crash. This crash would only be a denial of service if using a threaded MPM (such as event or worker). Note that Red Hat Enterprise Linux and Fedora use the prefork MPM by default.

This will be fixed upstream [2] in 2.2.22 and affects versions 2.2.17 up to and including 2.2.21.

[1] https://issues.apache.org/bugzilla/showbug.cgi?id=52256 [2] http://svn.apache.org/viewvc?view=revision&revision=1227292

Statement:

Not vulnerable. This issue did not affect the versions of httpd as shipped with Red Hat Enterprise Linux 4, 5, or 6.