Lucene search

K
oraclelinuxOracleLinuxELSA-2023-5050
HistorySep 12, 2023 - 12:00 a.m.

httpd:2.4 security update

2023-09-1200:00:00
linux.oracle.com
12

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

7.7 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.019 Low

EPSS

Percentile

88.4%

httpd
[2.4.37-56.0.1.7]

  • Resolves: #2176723 - CVE-2023-27522 httpd:2.4/httpd: mod_proxy_uwsgi HTTP
    response splitting
    [2.4.37-56.0.1.6]
  • Set vstring per ORACLE_SUPPORT_PRODUCT [Orabug: 29892262]
  • Replace index.html with Oracle’s index page oracle_index.html
    [2.4.37-56.6]
  • Resolves: #2190133 - mod_rewrite regression with CVE-2023-25690
    [2.4.37-56.4]
  • Resolves: #2177748 - CVE-2023-25690 httpd:2.4/httpd: HTTP request splitting
    with mod_rewrite and mod_proxy
    [2.4.37-56]
  • Resolves: #2162499 - CVE-2006-20001 httpd: mod_dav: out-of-bounds read/write
    of zero byte
  • Resolves: #2162485 - CVE-2022-37436 httpd: mod_proxy: HTTP response splitting
  • Resolves: #2162509 - CVE-2022-36760 httpd: mod_proxy_ajp: Possible request
    smuggling
    [2.4.37-55]
  • Resolves: #2155961 - prevent sscg creating /dhparams.pem
    [2.4.37-54]
  • Resolves: #2095650 - Dependency from mod_http2 on httpd broken
    [2.4.37-53]
  • Resolves: #2050888 - httpd with SSL fails to start unless hostname command
    was installed
    [2.4.37-52]
  • Add the SNI support in mod_proxy_wstunnel module for Apache httpd
  • Resolves: rhbz#2017543
    mod_http2
    [1.15.7-8.3]
  • Resolves: #2177748 - CVE-2023-25690 httpd:2.4/httpd: HTTP request splitting
    with mod_rewrite and mod_proxy
    [1.15.7-7]
  • Resolves: #2095650 - Dependency from mod_http2 on httpd broken
    [1.15.7-6]
  • Backport SNI feature refactor
  • Resolves: rhbz#2137257

mod_md

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

7.7 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.019 Low

EPSS

Percentile

88.4%