Most recent entries from all

ALSA-2021:1809 — Moderate: httpd:2.4 security, bug fix, and enhancement update

Affected: AlmaLinux:8: mod_http2, AlmaLinux:8: mod_md

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

* httpd: mod_session_cookie does not respect expiry time (CVE-2018-17199)

* httpd: mod_proxy_uwsgi buffer overflow (CVE-2020-11984)

* httpd: mod_http2 concurrent pool usage (CVE-2020-11993)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2019-01564

Withdrawn: BELL-CVE-2018-17199 — CVE-2018-17199 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2019-avi-031 — De multiples vulnérabilités ont été découvertes dans Apache Httpd. Elles permettent à un attaquant de provoquer un déni…

certfr-2019-avi-031

cnvd-2019-41283

EUVD-2026-170109

fkie_cve-2018-17199

In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since the expiry time is loaded when the session is decoded.

GHSA-gxfm-3qhv-h52c

gsd-2018-17199

openSUSE-SU-2019:0296-1 — Security update for apache2

Security update for apache2

RHSA-2019:3932 — Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 6

openssl: timing side channel attack in the DSA signature algorithm openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys openssl: Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) httpd: mod_http2: DoS via slow, unneeded request bodies httpd: mod_session_cookie does not respect expiry time httpd: mod_http2: read-after-free on a string compare httpd: mod_http2: possible crash on late upgrade httpd: mod_auth_digest: access control bypass due to race condition HTTP/2: large amount of data requests leads to denial of service HTTP/2: flood using PRIORITY frames results in excessive resource consumption HTTP/2: 0-length headers lead to denial of service HTTP/2: request for large response leads to denial of service

SUSE-SU-2019:0498-1 — Security update for apache2

Security update for apache2

UBUNTU-CVE-2018-17199

Affected: Ubuntu:14.04:LTS: apache2, Ubuntu:16.04:LTS: apache2, Ubuntu:18.04:LTS: apache2