Lucene search

K
oraclelinuxOracleLinuxELSA-2024-3121
HistoryMay 24, 2024 - 12:00 a.m.

httpd:2.4 security update

2024-05-2400:00:00
linux.oracle.com
9
httpd
security update
mod_http2
oracle's index page
vulnerability
media type handling
dos
reset requests
http request splitting
sni feature refactor
null dereference
ssrf
method injection
pool usage
push diary crash
read-after-free
denial of service
slow request
continuous settings
cve-2023-31122
cve-2024-27316
cve-2023-44487
cve-2023-45802
cve-2023-25690
cve-2021-44224
cve-2021-33193
cve-2020-11993
cve-2020-9490
cve-2019-10082
cve-2019-0197
cve-2019-0196
cve-2018-17189
cve-2019-9511
cve-2019-9516
cve-2019-9517
cve-2018-11763
cve-2018-1302

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.5 High

AI Score

Confidence

Low

0.01 Low

EPSS

Percentile

83.8%

httpd
[2.4.37-64.0.1]

  • Replace index.html with Oracle’s index page oracle_index.html
    [2.4.37-64]
  • Resolves: RHEL-14448 - httpd: mod_macro: out-of-bounds read
    vulnerability (CVE-2023-31122)
    [2.4.37-63]
  • mod_xml2enc: fix media type handling
    Resolves: RHEL-14321
    mod_http2
    [1.15.7-10]
  • Resolves: RHEL-29817 - httpd:2.4/mod_http2: httpd: CONTINUATION frames
    DoS (CVE-2024-27316)
    [1.15.7-9.3]
  • Resolves: RHEL-13367 - httpd:2.4/mod_http2: reset requests exhaust memory
    (incomplete fix of CVE-2023-44487)(CVE-2023-45802)
    [1.15.7-8.3]
  • Resolves: #2177748 - CVE-2023-25690 httpd:2.4/httpd: HTTP request splitting
    with mod_rewrite and mod_proxy
    [1.15.7-7]
  • Resolves: #2095650 - Dependency from mod_http2 on httpd broken
    [1.15.7-6]
  • Backport SNI feature refactor
  • Resolves: rhbz#2137257
    [1.15.7-5]
  • Resolves: #2035030 - CVE-2021-44224 httpd:2.4/httpd: possible NULL dereference
    or SSRF in forward proxy configurations
    [1.15.7-4]
  • Resolves: #1966728 - CVE-2021-33193 httpd:2.4/mod_http2: httpd:
    Request splitting via HTTP/2 method injection and mod_proxy
    [1.15.7-3]
  • Resolves: #1869077 - CVE-2020-11993 httpd:2.4/mod_http2: httpd:
    mod_http2 concurrent pool usage
    [1.15.7-2]
  • Resolves: #1869073 - CVE-2020-9490 httpd:2.4/mod_http2: httpd:
    Push diary crash on specifically crafted HTTP/2 header
    [1.15.7-1]
  • new version 1.15.7
  • Resolves: #1814236 - RFE: mod_http2 rebase
  • Resolves: #1747289 - CVE-2019-10082 httpd:2.4/mod_http2: httpd:
    read-after-free in h2 connection shutdown
  • Resolves: #1696099 - CVE-2019-0197 httpd:2.4/mod_http2: httpd:
    mod_http2: possible crash on late upgrade
  • Resolves: #1696094 - CVE-2019-0196 httpd:2.4/mod_http2: httpd:
    mod_http2: read-after-free on a string compare
  • Resolves: #1677591 - CVE-2018-17189 httpd:2.4/mod_http2: httpd:
    mod_http2: DoS via slow, unneeded request bodies
    [1.11.3-3]
  • Resolves: #1744999 - CVE-2019-9511 httpd:2.4/mod_http2: HTTP/2: large amount
    of data request leads to denial of service
  • Resolves: #1745086 - CVE-2019-9516 httpd:2.4/mod_http2: HTTP/2: 0-length
    headers leads to denial of service
  • Resolves: #1745154 - CVE-2019-9517 httpd:2.4/mod_http2: HTTP/2: request for
    large response leads to denial of service
    [1.11.3-2]
  • update release (#1695587)
    [1.11.3-1]
  • new version 1.11.3
  • Resolves: #1633401 - CVE-2018-11763 mod_http2: httpd: DoS for HTTP/2
    connections by continuous SETTINGS
    [1.10.20-1]
  • update to 1.10.20
    [1.10.18-1]
  • update to 1.10.18
    [1.10.16-1]
  • update to 1.10.16 (CVE-2018-1302)
    [1.10.13-2]
  • Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
    [1.10.13-1]
  • update to 1.10.13
    [1.10.12-1]
  • update to 1.10.12
    [1.10.10-2]
  • Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
    [1.10.10-1]
  • update to 1.10.10
    [1.10.7-2]
  • Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
    [1.10.7-1]
  • update to 1.10.7
    [1.10.6-1]
  • update to 1.10.6
    [1.10.5-1]
  • update to 1.10.5
    [1.10.1-1]
  • Initial import (#1440780).
    mod_md

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.5 High

AI Score

Confidence

Low

0.01 Low

EPSS

Percentile

83.8%