httpd, mod_ldap, mod_proxy_html, mod_session, mod_ssl security update

2016-07-18T16:26:29
ID CESA-2016:1422
Type centos
Reporter CentOS Project
Modified 2016-07-18T16:26:29

Description

CentOS Errata and Security Advisory CESA-2016:1422

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

  • It was discovered that httpd used the value of the Proxy header from HTTP requests to initialize the HTTP_PROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a malicious HTTP request. (CVE-2016-5387)

Note: After this update, httpd will no longer pass the value of the Proxy request header to scripts via the HTTP_PROXY environment variable.

Red Hat would like to thank Scott Geary (VendHQ) for reporting this issue.

Bug Fix(es):

  • In a caching proxy configuration, the mod_cache module would treat content as stale if the Expires header changed when refreshing a cached response. As a consequence, an origin server returning content without a fixed Expires header would not be treated as cacheable. The mod_cache module has been fixed to ignore changes in the Expires header when refreshing content. As a result, such content is now cacheable, improving performance and reducing load at the origin server. (BZ#1347648)

  • The HTTP status code 451 "Unavailable For Legal Reasons" was not usable in the httpd configuration. As a consequence, modules such as mod_rewrite could not be configured to return a 451 error if required for legal purposes. The 451 status code has been added to the list of available error codes, and modules can now be configured to return a 451 error if required. (BZ#1353269)

Merged security bulletin from advisories: http://lists.centos.org/pipermail/centos-announce/2016-July/021979.html

Affected packages: httpd httpd-devel httpd-manual httpd-tools mod_ldap mod_proxy_html mod_session mod_ssl

Upstream details at: https://rhn.redhat.com/errata/RHSA-2016-1422.html