httpd, mod_ssl security update

2008-11-1120:45:50

CentOS Project

lists.centos.org

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.054 Low

EPSS

Percentile

93.0%

JSON

CentOS Errata and Security Advisory CESA-2008:0967

The Apache HTTP Server is a popular Web server.

A flaw was found in the mod_proxy Apache module. An attacker in control of
a Web server to which requests were being proxied could have caused a
limited denial of service due to CPU consumption and stack exhaustion.
(CVE-2008-2364)

A flaw was found in the mod_proxy_ftp Apache module. If Apache was
configured to support FTP-over-HTTP proxying, a remote attacker could have
performed a cross-site scripting attack. (CVE-2008-2939)

In addition, these updated packages fix a bug found in the handling of the
“ProxyRemoteMatch” directive in the Red Hat Enterprise Linux 4 httpd
packages. This bug is not present in the Red Hat Enterprise Linux 3 or Red
Hat Enterprise Linux 5 packages.

Users of httpd should upgrade to these updated packages, which contain
backported patches to correct these issues.

Affected packages:
httpd
httpd-devel
httpd-manual
httpd-suexec
mod_ssl

Upstream details at:
https://access.redhat.com/errata/RHSA-2008:0967

OSVersionArchitecturePackageVersionFilename
CentOS5i386httpd< 2.2.3-11.el5.centos.4httpd-2.2.3-11.el5.centos.4.i386.rpm
CentOS5i386httpd-devel< 2.2.3-11.el5.centos.4httpd-devel-2.2.3-11.el5.centos.4.i386.rpm
CentOS5i386httpd-manual< 2.2.3-11.el5.centos.4httpd-manual-2.2.3-11.el5.centos.4.i386.rpm
CentOS5i386mod_ssl< 2.2.3-11.el5.centos.4mod_ssl-2.2.3-11.el5.centos.4.i386.rpm
CentOS5x86_64httpd< 2.2.3-11.el5.centos.4httpd-2.2.3-11.el5.centos.4.x86_64.rpm
CentOS5i386httpd-devel< 2.2.3-11.el5.centos.4httpd-devel-2.2.3-11.el5.centos.4.i386.rpm
CentOS5x86_64httpd-devel< 2.2.3-11.el5.centos.4httpd-devel-2.2.3-11.el5.centos.4.x86_64.rpm
CentOS5x86_64httpd-manual< 2.2.3-11.el5.centos.4httpd-manual-2.2.3-11.el5.centos.4.x86_64.rpm
CentOS5x86_64mod_ssl< 2.2.3-11.el5.centos.4mod_ssl-2.2.3-11.el5.centos.4.x86_64.rpm
CentOS3i386httpd< 2.0.46-71.enthttpd-2.0.46-71.ent.i386.rpm

OS	Version	Architecture	Package	Version	Filename
CentOS	5	i386	httpd	< 2.2.3-11.el5.centos.4	httpd-2.2.3-11.el5.centos.4.i386.rpm
CentOS	5	i386	httpd-devel	< 2.2.3-11.el5.centos.4	httpd-devel-2.2.3-11.el5.centos.4.i386.rpm
CentOS	5	i386	httpd-manual	< 2.2.3-11.el5.centos.4	httpd-manual-2.2.3-11.el5.centos.4.i386.rpm
CentOS	5	i386	mod_ssl	< 2.2.3-11.el5.centos.4	mod_ssl-2.2.3-11.el5.centos.4.i386.rpm
CentOS	5	x86_64	httpd	< 2.2.3-11.el5.centos.4	httpd-2.2.3-11.el5.centos.4.x86_64.rpm
CentOS	5	i386	httpd-devel	< 2.2.3-11.el5.centos.4	httpd-devel-2.2.3-11.el5.centos.4.i386.rpm
CentOS	5	x86_64	httpd-devel	< 2.2.3-11.el5.centos.4	httpd-devel-2.2.3-11.el5.centos.4.x86_64.rpm
CentOS	5	x86_64	httpd-manual	< 2.2.3-11.el5.centos.4	httpd-manual-2.2.3-11.el5.centos.4.x86_64.rpm
CentOS	5	x86_64	mod_ssl	< 2.2.3-11.el5.centos.4	mod_ssl-2.2.3-11.el5.centos.4.x86_64.rpm
CentOS	3	i386	httpd	< 2.0.46-71.ent	httpd-2.0.46-71.ent.i386.rpm