Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
redhatRedHatRHSA-2011:1392
HistoryOct 20, 2011 - 12:00 a.m.

(RHSA-2011:1392) Moderate: httpd security and bug fix update

2011-10-2000:00:00
access.redhat.com
24

7.8 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

0.974 High

EPSS

Percentile

99.9%

JSON

The Apache HTTP Server is a popular web server.

It was discovered that the Apache HTTP Server did not properly validate the
request URI for proxied requests. In certain configurations, if a reverse
proxy used the ProxyPassMatch directive, or if it used the RewriteRule
directive with the proxy flag, a remote attacker could make the proxy
connect to an arbitrary server, possibly disclosing sensitive information
from internal web servers not directly accessible to the attacker.
(CVE-2011-3368)

Red Hat would like to thank Context Information Security for reporting this
issue.

This update also fixes the following bug:

  • The fix for CVE-2011-3192 provided by the RHSA-2011:1245 update
    introduced regressions in the way httpd handled certain Range HTTP header
    values. This update corrects those regressions. (BZ#736593, BZ#736594)

All httpd users should upgrade to these updated packages, which contain
backported patches to correct these issues. After installing the updated
packages, the httpd daemon must be restarted for the update to take effect.

OSVersionArchitecturePackageVersionFilename
RedHat5i386httpd-manual< 2.2.3-53.el5_7.3httpd-manual-2.2.3-53.el5_7.3.i386.rpm
RedHat5i386mod_ssl< 2.2.3-53.el5_7.3mod_ssl-2.2.3-53.el5_7.3.i386.rpm
RedHatanys390httpd< 2.0.52-49.enthttpd-2.0.52-49.ent.s390.rpm
RedHatanyx86_64httpd-manual< 2.0.52-49.enthttpd-manual-2.0.52-49.ent.x86_64.rpm
RedHat5s390xhttpd-manual< 2.2.3-53.el5_7.3httpd-manual-2.2.3-53.el5_7.3.s390x.rpm
RedHatanyx86_64httpd-devel< 2.0.52-49.enthttpd-devel-2.0.52-49.ent.x86_64.rpm
RedHatanyia64httpd-suexec< 2.0.52-49.enthttpd-suexec-2.0.52-49.ent.ia64.rpm
RedHatanys390httpd-devel< 2.0.52-49.enthttpd-devel-2.0.52-49.ent.s390.rpm
RedHatanyia64httpd< 2.0.52-49.enthttpd-2.0.52-49.ent.ia64.rpm
RedHatanys390xhttpd-suexec< 2.0.52-49.enthttpd-suexec-2.0.52-49.ent.s390x.rpm
Rows per page:
1-10 of 541

Related

openvas 51
centos 2
nessus 40
suse 8
redhat 9
oraclelinux 3
securityvulns 5
seebug 6
packetstorm 4
cve 5
httpd 5
freebsd 2
debiancve 4
altlinux 6
ubuntucve 3
checkpoint_advisories 4
threatpost 3
veracode 4
prion 5
exploitpack 2
f5 3
fedora 2
amazon 2
debian 5
hackerone 2
ibm 2
cert 1
cisa 1
checkpoint_security 1
zdt 1
slackware 2
ubuntu 1
exploitdb 1
thn 1
kaspersky 1
osv 1
jvn 1
openvas
openvas
CentOS Update for httpd CESA-2011:1392 centos4 x86_64
2012-07-30 00:00:00
CentOS Update for httpd CESA-2011:1392 centos5 x86_64
2012-07-30 00:00:00
CentOS Update for httpd CESA-2011:1392 centos4 i386
2011-11-11 00:00:00
centos
centos
httpd, mod_ssl security update
2011-10-20 21:19:56
httpd, mod_ssl security update
2011-09-01 11:41:08
nessus
nessus
CentOS 4 / 5 : httpd (CESA-2011:1392)
2011-10-21 00:00:00
RHEL 4 / 5 : httpd (RHSA-2011:1392)
2011-10-21 00:00:00
Scientific Linux Security Update : httpd on SL4.x, SL5.x i386/x86_64
2012-08-01 00:00:00
suse
suse
Security update for Apache2 (important)
2011-11-04 09:08:25
apache2: Fixed several security issues (important)
2011-11-04 09:08:34
Security update for apache2 (important)
2011-11-09 19:08:34
redhat
redhat
(RHSA-2011:1391) Moderate: httpd security and bug fix update
2011-10-20 00:00:00
(RHSA-2011:1330) Important: JBoss Enterprise Web Server 1.0.2 security update
2011-09-21 16:00:45
(RHSA-2011:1369) Important: httpd security update
2011-10-13 00:00:00
oraclelinux
oraclelinux
httpd security and bug fix update
2011-10-20 00:00:00
httpd security and bug fix update
2011-10-20 00:00:00
httpd security update
2011-08-31 00:00:00
securityvulns
securityvulns
[ MDVSA-2011:144 ] apache
2011-10-12 00:00:00
Cisco Security Advisory: Apache HTTPd Range Header Denial of Service Vulnerability
2011-08-30 00:00:00
Advisory: Range header DoS vulnerability Apache HTTPD 1.3/2.x &#40;CVE-2011-3192&#41;
2011-08-27 00:00:00
seebug
seebug
Apache HTTP Server 'mod_proxy'反向代理信息泄露漏洞
2011-10-08 00:00:00
Apache mod_proxy Reverse Proxy Exposure Vulnerability PoC
2011-10-12 00:00:00
Apache mod_proxy Reverse Proxy Exposure
2011-10-06 00:00:00
packetstorm
packetstorm
Apache Reverse Proxy Bypass
2011-10-06 00:00:00
Apache mod_proxy Proof Of Concept
2011-10-11 00:00:00
Obehotel CMS Denial Of Service / SQL Injection
2013-08-26 00:00:00
cve
cve
CVE-2011-3368
2011-10-05 22:55:00
CVE-2011-3639
2011-11-30 04:05:00
CVE-2011-4317
2011-11-30 04:05:00
httpd
httpd
Apache Httpd < 1.3-never : mod_proxy reverse proxy exposure
2011-09-16 00:00:00
Apache Httpd < 2.0.65 : mod_proxy reverse proxy exposure
2011-09-16 00:00:00
Apache Httpd < 2.2.22 : mod_proxy reverse proxy exposure
2011-09-16 00:00:00
freebsd
freebsd
Apache 1.3 -- mod_proxy reverse proxy exposure
2011-10-05 00:00:00
apache -- Range header DoS vulnerability
2011-08-24 00:00:00
debiancve
debiancve
CVE-2011-3368
2011-10-05 22:55:00
CVE-2011-4317
2011-11-30 04:05:00
CVE-2011-3639
2011-11-30 04:05:00
altlinux
altlinux
Security fix for the ALT Linux 10 package apache2 version 2.2.21-alt2
2011-11-19 00:00:00
Security fix for the ALT Linux 9 package apache2 version 2.2.21-alt2
2011-11-19 00:00:00
Security fix for the ALT Linux 8 package apache2 version 2.2.21-alt2
2011-11-19 00:00:00
ubuntucve
ubuntucve
CVE-2011-3368
2011-10-05 00:00:00
CVE-2011-3639
2011-11-30 00:00:00
CVE-2011-4317
2011-11-29 00:00:00
checkpoint_advisories
checkpoint_advisories
Apache HTTPD mod_proxy Security Bypass (CVE-2011-3368)
2012-03-05 00:00:00
Apache HTTPD mod_proxy Information Disclosure (CVE-2011-3368)
2011-11-01 00:00:00
Apache HTTPD Ranges Header Field Denial of Service (CVE-2011-3192)
2011-09-14 00:00:00
threatpost
threatpost
New Apache Reverse Proxy Issue Uncovered
2011-11-26 23:41:49
Apache Fixes Range Header DoS Flaw
2011-08-31 10:30:00
Apache Releases Version 2.2.21 With New Fix For Range Header Flaw
2011-09-14 15:29:14
veracode
veracode
Information Disclosure
2020-04-10 01:03:06
Denial Of Service (DoS)
2020-04-10 01:02:22
Man-in-the-Middle (MitM)
2020-04-10 01:10:15
prion
prion
Design/Logic Flaw
2011-10-05 22:55:00
Design/Logic Flaw
2011-11-30 04:05:00
Design/Logic Flaw
2011-11-30 04:05:00
exploitpack
exploitpack
Apache mod_proxy - Reverse Proxy Exposure
2011-10-11 00:00:00
Apache - Denial of Service
2011-12-09 00:00:00
f5
f5
K13114 : Apache Range header vulnerability - CVE-2011-3192
2013-09-12 00:00:00
SOL13114 - Apache Range header vulnerability - CVE-2011-3192
2011-10-06 00:00:00
K20979231 : Apache vulnerability CVE-2011-3639
2015-12-29 00:00:00
fedora
fedora
[SECURITY] Fedora 16 Update: httpd-2.2.21-1.fc16
2011-09-30 19:07:35
[SECURITY] Fedora 15 Update: httpd-2.2.21-1.fc15
2011-09-16 01:58:28
amazon
amazon
Medium: httpd
2011-09-27 22:46:00
Medium: httpd
2011-10-31 18:19:00
debian
debian
[BSA-049] Security Update for apache2
2011-09-06 02:06:51
[SECURITY] [DSA 2298-2] apache2 regression fix
2011-09-05 19:20:44
[SECURITY] [DSA 2298-1] apache2 security update
2011-08-29 21:16:25
hackerone
hackerone
ownCloud: Apache Range Header Denial of Service Attack (Confirmed PoC)
2015-09-14 22:55:12
Gratipay: grtp.co is vulnerable to http-vuln-cve2011-3192
2016-01-25 13:01:41
ibm
ibm
Security Bulletin: API Connect is affected by an Apache HTTP Server vulnerability (CVE-2011-3192)
2018-06-15 07:07:54
Security Bulletin: Potential security exposure with IBM HTTP Server 8.0 and earlier (PM46234) (CVE-2011-3192)
2022-09-08 00:26:26
cert
cert
Apache HTTPD 1.3/2.x Range header DoS vulnerability
2011-08-26 00:00:00
cisa
cisa
Oracle Releases Security Alert for Oracle HTTP Server Products
2011-09-19 00:00:00
checkpoint_security
checkpoint_security
Check Point Response to Apache HTTP Server CVE-2011-3192 Denial Of Service Vulnerability
2011-08-24 21:00:00
zdt
zdt
Obehotel CMS SQL Injection Vulnerability
2013-08-27 00:00:00
slackware
slackware
[slackware-security] httpd
2011-09-09 14:05:46
[slackware-security] httpd
2011-10-14 23:59:50
ubuntu
ubuntu
Apache vulnerability
2011-09-01 00:00:00
exploitdb
exploitdb
Apache mod_proxy - Reverse Proxy Exposure
2011-10-11 00:00:00
thn
thn
New Apache Reverse Proxy Flaw Allows Access to Internal Network
2011-11-27 08:58:00
kaspersky
kaspersky
KLA10065 Multiple vulnerabilities in Apache httpd
2013-07-22 00:00:00
osv
osv
apache2 - denial of service
2011-09-05 00:00:00
jvn
jvn
JVN#23809730: GIGAPOD vulnerable to denial-of-service (DoS)
2014-10-16 00:00:00

7.8 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

0.974 High

EPSS

Percentile

99.9%

JSON
Related for RHSA-2011:1392
openvas51centos2nessus40suse8redhat9oraclelinux3securityvulns5seebug6packetstorm4cve5httpd5freebsd2debiancve4altlinux6ubuntucve3checkpoint_advisories4threatpost3veracode4prion5exploitpack2f53fedora2amazon2debian5hackerone2ibm2cert1cisa1checkpoint_security1zdt1slackware2ubuntu1exploitdb1thn1kaspersky1osv1jvn1