Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
centosCentOS ProjectCESA-2020:1121
HistoryApr 08, 2020 - 6:07 p.m.

httpd, mod_ldap, mod_proxy_html, mod_session, mod_ssl security update

2020-04-0818:07:48
CentOS Project
lists.centos.org
127

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

0.026 Low

EPSS

Percentile

90.4%

JSON

CentOS Errata and Security Advisory CESA-2020:1121

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

  • httpd: mod_session_cookie does not respect expiry time (CVE-2018-17199)

  • httpd: Out of bounds write in mod_authnz_ldap when using too small Accept-Language values (CVE-2017-15710)

  • httpd: Out of bounds access after failure in reading the HTTP request (CVE-2018-1301)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.8 Release Notes linked from the References section.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-cr-announce/2020-April/032533.html

Affected packages:
httpd
httpd-devel
httpd-manual
httpd-tools
mod_ldap
mod_proxy_html
mod_session
mod_ssl

Upstream details at:
https://access.redhat.com/errata/RHSA-2020:1121

Related

redhat 2
oraclelinux 2
nessus 56
ibm 27
debian 4
openvas 37
osv 8
ubuntu 3
redhatcve 3
prion 3
cvelist 3
ubuntucve 3
debiancve 3
httpd 3
cve 3
veracode 3
nvd 3
f5 3
alpinelinux 3
suse 4
fedora 3
mageia 2
kaspersky 2
archlinux 2
altlinux 6
freebsd 2
amazon 2
almalinux 1
rocky 1
slackware 1
gentoo 1
redhat
redhat
(RHSA-2020:1121) Moderate: httpd security, bug fix, and enhancement update
2020-03-31 09:21:40
(RHSA-2021:1809) Moderate: httpd:2.4 security, bug fix, and enhancement update
2021-05-18 06:08:34
oraclelinux
oraclelinux
httpd security, bug fix, and enhancement update
2020-04-06 00:00:00
httpd:2.4 security, bug fix, and enhancement update
2021-05-25 00:00:00
nessus
nessus
Oracle Linux 7 : httpd (ELSA-2020-1121)
2023-09-07 00:00:00
NewStart CGSL CORE 5.05 / MAIN 5.05 : httpd Multiple Vulnerabilities (NS-SA-2020-0110)
2020-12-09 00:00:00
RHEL 7 : httpd (RHSA-2020:1121)
2020-04-01 00:00:00
ibm
ibm
Security Bulletin: Vulnerability in httpd (CVE-2018-17199 and CVE-2018-1301).
2021-09-22 23:38:15
Security Bulletin: Multiple vulnerabilities in the IBM HTTP Server bundled with IBM WebSphere Application Server Patterns and IBM WebSphere Application Server for Cloud (CVE-2017-15710, CVE-2017-15715, CVE-2018-1301)
2018-06-15 07:09:13
Security Bulletin: Multiple vulnerabilities in IBM HTTP Server affect Rational Build Forge (CVE-2017-15710, CVE-2017-15715, CVE-2018-1301)
2020-04-20 14:39:53
debian
debian
[SECURITY] [DLA 1389-1] apache2 security update
2018-05-30 13:24:40
[SECURITY] [DLA 1647-1] apache2 security update
2019-01-29 21:28:38
[SECURITY] [DSA 4164-1] apache2 security update
2018-04-03 16:02:15
openvas
openvas
SUSE: Security Advisory (SUSE-SU-2018:1079-1)
2021-06-09 00:00:00
Debian: Security Advisory (DLA-1389-1)
2018-06-03 00:00:00
Ubuntu: Security Advisory (USN-3937-2)
2022-08-26 00:00:00
osv
osv
apache2 - security update
2018-05-30 00:00:00
apache2 - security update
2019-01-29 00:00:00
CVE-2017-15710
2018-03-26 15:29:00
ubuntu
ubuntu
Apache vulnerabilities
2019-04-10 00:00:00
Apache HTTP Server vulnerabilities
2018-04-30 00:00:00
Apache HTTP Server vulnerabilities
2018-04-19 00:00:00
redhatcve
redhatcve
CVE-2018-17199
2019-01-22 21:50:18
CVE-2017-15710
2018-03-26 14:48:56
CVE-2018-1301
2018-03-26 16:18:55
prion
prion
Session fixation
2019-01-30 22:29:00
Design/Logic Flaw
2018-03-26 15:29:00
Design/Logic Flaw
2018-03-26 15:29:00
cvelist
cvelist
CVE-2018-17199
2019-01-22 00:00:00
CVE-2017-15710
2018-03-23 00:00:00
CVE-2018-1301
2018-03-23 00:00:00
ubuntucve
ubuntucve
CVE-2018-17199
2019-01-30 00:00:00
CVE-2017-15710
2018-03-26 00:00:00
CVE-2018-1301
2018-03-26 00:00:00
debiancve
debiancve
CVE-2018-17199
2019-01-30 22:29:00
CVE-2017-15710
2018-03-26 15:29:00
CVE-2018-1301
2018-03-26 15:29:00
httpd
httpd
Apache Httpd < 2.4.38 : mod_session_cookie does not respect expiry time
2018-10-08 00:00:00
Apache Httpd < 2.4.33 : Out of bound write in mod_authnz_ldap when using too small Accept-Language values
2017-12-07 00:00:00
Apache Httpd < 2.4.33 : Possible out of bound access after failure in reading the HTTP request
2018-01-23 00:00:00
cve
cve
CVE-2018-17199
2019-01-30 22:29:00
CVE-2017-15710
2018-03-26 15:29:00
CVE-2018-1301
2018-03-26 15:29:00
veracode
veracode
Denial Of Service (DoS)
2019-05-16 03:21:40
Improper Session Management
2019-11-21 00:17:08
Denial Of Service (DoS)
2019-05-16 03:21:43
nvd
nvd
CVE-2018-17199
2019-01-30 22:29:00
CVE-2017-15710
2018-03-26 15:29:00
CVE-2018-1301
2018-03-26 15:29:00
f5
f5
K54296221 : Apache httpd vulnerability CVE-2018-17199
2019-02-05 00:00:00
K14027805 : Apache vulnerability CVE-2017-15710
2018-03-30 00:00:00
K78131906 : Apache HTTPD vulnerability CVE-2018-1301
2018-04-11 00:00:00
alpinelinux
alpinelinux
CVE-2018-17199
2019-01-30 22:29:00
CVE-2018-1301
2018-03-26 15:29:00
CVE-2017-15710
2018-03-26 15:29:00
suse
suse
Security update for apache2 (important)
2018-04-05 21:09:45
Security update for apache2 (moderate)
2019-03-06 00:00:00
Security update for apache2 (important)
2018-04-09 03:07:20
fedora
fedora
[SECURITY] Fedora 28 Update: httpd-2.4.33-2.fc28
2018-04-05 11:50:14
[SECURITY] Fedora 27 Update: httpd-2.4.33-2.fc27
2018-04-05 23:59:00
[SECURITY] Fedora 26 Update: httpd-2.4.33-4.fc26
2018-05-12 18:27:28
mageia
mageia
Updated apache packages fix security vulnerability
2019-03-15 00:39:55
Updated apache packages fix security vulnerabilities
2018-11-20 14:11:24
kaspersky
kaspersky
KLA12361 Multiple vulnerabilities in Apache HTTP Server
2018-03-21 00:00:00
KLA12364 Multiple vulnerabilities in Apache HTTP Server
2019-02-28 00:00:00
archlinux
archlinux
[ASA-201804-4] apache: multiple issues
2018-04-04 00:00:00
[ASA-201901-14] apache: multiple issues
2019-01-24 00:00:00
altlinux
altlinux
Security fix for the ALT Linux 9 package apache2 version 1:2.4.33-alt1
2018-03-31 00:00:00
Security fix for the ALT Linux 10 package apache2 version 1:2.4.33-alt1
2018-03-31 00:00:00
Security fix for the ALT Linux 8 package apache2 version 1:2.4.33-alt1
2018-03-31 00:00:00
freebsd
freebsd
apache -- multiple vulnerabilities
2018-03-23 00:00:00
Apache -- vulnerability
2019-01-22 00:00:00
amazon
amazon
Medium: httpd24
2018-05-03 16:29:00
Important: httpd24
2019-03-06 22:21:00
almalinux
almalinux
Moderate: httpd:2.4 security, bug fix, and enhancement update
2021-05-18 06:08:34
rocky
rocky
httpd:2.4 security, bug fix, and enhancement update
2021-05-18 06:08:34
slackware
slackware
[slackware-security] httpd
2019-01-23 04:41:31
gentoo
gentoo
Apache: Multiple vulnerabilities
2019-03-28 00:00:00

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

0.026 Low

EPSS

Percentile

90.4%

JSON
Related for CESA-2020:1121
redhat2oraclelinux2nessus56ibm27debian4openvas37osv8ubuntu3redhatcve3prion3cvelist3ubuntucve3debiancve3httpd3cve3veracode3nvd3f53alpinelinux3suse4fedora3mageia2kaspersky2archlinux2altlinux6freebsd2amazon2almalinux1rocky1slackware1gentoo1