5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
0.467 Medium
EPSS
Percentile
97.4%
CentOS Errata and Security Advisory CESA-2015:1249
The httpd packages provide the Apache HTTP Server, a powerful, efficient,
and extensible web server.
A flaw was found in the way httpd handled HTTP Trailer headers when
processing requests using chunked encoding. A malicious client could use
Trailer headers to set additional HTTP headers after header processing was
performed by other modules. This could, for example, lead to a bypass of
header restrictions defined with mod_headers. (CVE-2013-5704)
This update also fixes the following bugs:
The order of mod_proxy workers was not checked when httpd configuration
was reloaded. When mod_proxy workers were removed, added, or their order
was changed, their parameters and scores could become mixed. The order of
mod_proxy workers has been made internally consistent during configuration
reload. (BZ#1149906)
The local host certificate created during firstboot contained CA
extensions, which caused the httpd service to return warning messages.
This has been addressed by local host certificates being generated with the
โ-extensions v3_reqโ option. (BZ#906476)
The default mod_ssl configuration no longer enables support for SSL
cipher suites using the single DES, IDEA, or SEED encryption algorithms.
(BZ#1086771)
The apachectl script did not take into account the HTTPD_LANG variable
set in the /etc/sysconfig/httpd file during graceful restarts.
Consequently, httpd did not use a changed value of HTTPD_LANG when the
daemon was restarted gracefully. The script has been fixed to handle the
HTTPD_LANG variable correctly. (BZ#963146)
The mod_deflate module failed to check the original file size while
extracting files larger than 4 GB, making it impossible to extract large
files. Now, mod_deflate checks the original file size properly according to
RFC1952, and it is able to decompress files larger than 4 GB. (BZ#1057695)
The httpd service did not check configuration before restart. When a
configuration contained an error, an attempt to restart httpd gracefully
failed. Now, httpd checks configuration before restart and if the
configuration is in an inconsistent state, an error message is printed,
httpd is not stopped and a restart is not performed. (BZ#1146194)
The SSL_CLIENT_VERIFY environment variable was incorrectly handled when
the โSSLVerifyClient optional_no_caโ and โSSLSessionCacheโ options were
used. When an SSL session was resumed, the SSL_CLIENT_VERIFY value was set
to โSUCCESSโ instead of the previously set โGENEROUSโ. SSL_CLIENT_VERIFY is
now correctly set to GENEROUS in this scenario. (BZ#1149703)
The ab utility did not correctly handle situations when an SSL connection
was closed after some data had already been read. As a consequence, ab did
not work correctly with SSL servers and printed โSSL read failedโ error
messages. With this update, ab works as expected with HTTPS servers.
(BZ#1045477)
When a client presented a revoked certificate, log entries were created
only at the debug level. The log level of messages regarding a revoked
certificate has been increased to INFO, and administrators are now properly
informed of this situation. (BZ#1161328)
In addition, this update adds the following enhancement:
Users of httpd are advised to upgrade to these updated packages, which
contain backported patches to correct these issues and add this
enhancement. After installing the updated packages, the httpd service will
be restarted automatically.
Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-cr-announce/2015-July/028351.html
Affected packages:
httpd
httpd-devel
httpd-manual
httpd-tools
mod_ssl
Upstream details at:
https://access.redhat.com/errata/RHSA-2015:1249
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
CentOS | 6 | i686 | httpd | <ย 2.2.15-45.el6.centos | httpd-2.2.15-45.el6.centos.i686.rpm |
CentOS | 6 | i686 | httpd-devel | <ย 2.2.15-45.el6.centos | httpd-devel-2.2.15-45.el6.centos.i686.rpm |
CentOS | 6 | noarch | httpd-manual | <ย 2.2.15-45.el6.centos | httpd-manual-2.2.15-45.el6.centos.noarch.rpm |
CentOS | 6 | i686 | httpd-tools | <ย 2.2.15-45.el6.centos | httpd-tools-2.2.15-45.el6.centos.i686.rpm |
CentOS | 6 | i686 | mod_ssl | <ย 2.2.15-45.el6.centos | mod_ssl-2.2.15-45.el6.centos.i686.rpm |
CentOS | 6 | x86_64 | httpd | <ย 2.2.15-45.el6.centos | httpd-2.2.15-45.el6.centos.x86_64.rpm |
CentOS | 6 | i686 | httpd-devel | <ย 2.2.15-45.el6.centos | httpd-devel-2.2.15-45.el6.centos.i686.rpm |
CentOS | 6 | x86_64 | httpd-devel | <ย 2.2.15-45.el6.centos | httpd-devel-2.2.15-45.el6.centos.x86_64.rpm |
CentOS | 6 | noarch | httpd-manual | <ย 2.2.15-45.el6.centos | httpd-manual-2.2.15-45.el6.centos.noarch.rpm |
CentOS | 6 | x86_64 | httpd-tools | <ย 2.2.15-45.el6.centos | httpd-tools-2.2.15-45.el6.centos.x86_64.rpm |