CentOS Errata and Security Advisory CESA-2016:1422
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.
Note: After this update, httpd will no longer pass the value of the Proxy request header to scripts via the HTTP_PROXY environment variable.
Red Hat would like to thank Scott Geary (VendHQ) for reporting this issue.
In a caching proxy configuration, the mod_cache module would treat content as stale if the Expires header changed when refreshing a cached response. As a consequence, an origin server returning content without a fixed Expires header would not be treated as cacheable. The mod_cache module has been fixed to ignore changes in the Expires header when refreshing content. As a result, such content is now cacheable, improving performance and reducing load at the origin server. (BZ#1347648)
The HTTP status code 451 "Unavailable For Legal Reasons" was not usable in the httpd configuration. As a consequence, modules such as mod_rewrite could not be configured to return a 451 error if required for legal purposes. The 451 status code has been added to the list of available error codes, and modules can now be configured to return a 451 error if required. (BZ#1353269)
Merged security bulletin from advisories: http://lists.centos.org/pipermail/centos-announce/2016-July/021979.html
Affected packages: httpd httpd-devel httpd-manual httpd-tools mod_ldap mod_proxy_html mod_session mod_ssl
Upstream details at: https://rhn.redhat.com/errata/RHSA-2016-1422.html