-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: httpd24-httpd security, bug fix, and enhancement update
Advisory ID:       RHSA-2017:1161-01
Product:           Red Hat Software Collections
Advisory URL:      https://access.redhat.com/errata/RHSA-2017:1161
Issue date:        2017-04-26
CVE Names:         CVE-2016-0736 CVE-2016-1546 CVE-2016-2161 
                   CVE-2016-8740 CVE-2016-8743 
=====================================================================

1. Summary:

Updated httpd24 packages are now available as a part of Red Hat Software
Collections 2.4 for Red Hat Enterprise Linux.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - noarch, x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch, x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) - noarch, x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3) - noarch, x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - noarch, x86_64
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch, x86_64

3. Description:

The Apache HTTP Server is a powerful, efficient, and extensible web server.
The httpd24 packages provide a recent stable release of version 2.4 of the
Apache HTTP Server, along with the mod_auth_kerb module.

The httpd24 Software Collection has been upgraded to version 2.4.25, which
provides a number of bug fixes and enhancements over the previous version.
For detailed changes, see the Red Hat Software Collections 2.4 Release
Notes linked from the References section. (BZ#1404778)

Security Fix(es):

* It was discovered that the mod_session_crypto module of httpd did not use
any mechanisms to verify integrity of the encrypted session data stored in
the user's browser. A remote attacker could use this flaw to decrypt and
modify session data using a padding oracle attack. (CVE-2016-0736)

* A denial of service flaw was found in httpd's mod_http2 module. A remote
attacker could use this flaw to block server threads for long times,
causing starvation of worker threads, by manipulating the flow control
windows on streams. (CVE-2016-1546)

* It was discovered that the mod_auth_digest module of httpd did not
properly check for memory allocation failures. A remote attacker could use
this flaw to cause httpd child processes to repeatedly crash if the server
used HTTP digest authentication. (CVE-2016-2161)

* It was discovered that the HTTP parser in httpd incorrectly allowed
certain characters not permitted by the HTTP protocol specification to
appear unencoded in HTTP request headers. If httpd was used in conjunction
with a proxy or backend server that interpreted those characters
differently, a remote attacker could possibly use this flaw to inject data
into HTTP responses, resulting in proxy cache poisoning. (CVE-2016-8743)

Note: The fix for the CVE-2016-8743 issue causes httpd to return "400 Bad
Request" error to HTTP clients which do not strictly follow HTTP protocol
specification. A newly introduced configuration directive
"HttpProtocolOptions Unsafe" can be used to re-enable the old less strict
parsing. However, such setting also re-introduces the CVE-2016-8743 issue.

* A vulnerability was found in httpd's handling of the LimitRequestFields
directive in mod_http2, affecting servers with HTTP/2 enabled. An attacker
could send crafted requests with headers larger than the server's available
memory, causing httpd to crash. (CVE-2016-8740)

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon will be restarted
automatically.

5. Bugs fixed (https://bugzilla.redhat.com/):

1329639 - error in service httpd24-httpd configtest
1335616 - Backport Apache PR58118 to fix mod_proxy_fcgi spamming non-errors: AH01075: Error dispatching request to : (passing brigade to output filters)
1336350 - CVE-2016-1546 httpd: mod_http2 denial-of-service by thread starvation
1401528 - CVE-2016-8740 httpd: Incomplete handling of LimitRequestFields directive in mod_http2
1406744 - CVE-2016-0736 httpd: Padding Oracle in Apache mod_session_crypto
1406753 - CVE-2016-2161 httpd: DoS vulnerability in mod_auth_digest
1406822 - CVE-2016-8743 httpd: Apache HTTP Request Parsing Whitespace Defects
1414037 - mod_proxy_fcgi regression in 2.4.23+
1432249 - must fail startup with conflicting Listen directives
1433474 - wrong requires  of httpd24-httpd and  httpd24-httpd-tools

6. Package List:

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6):

Source:
httpd24-httpd-2.4.25-9.el6.src.rpm

noarch:
httpd24-httpd-manual-2.4.25-9.el6.noarch.rpm

x86_64:
httpd24-httpd-2.4.25-9.el6.x86_64.rpm
httpd24-httpd-debuginfo-2.4.25-9.el6.x86_64.rpm
httpd24-httpd-devel-2.4.25-9.el6.x86_64.rpm
httpd24-httpd-tools-2.4.25-9.el6.x86_64.rpm
httpd24-mod_ldap-2.4.25-9.el6.x86_64.rpm
httpd24-mod_proxy_html-2.4.25-9.el6.x86_64.rpm
httpd24-mod_session-2.4.25-9.el6.x86_64.rpm
httpd24-mod_ssl-2.4.25-9.el6.x86_64.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7):

Source:
httpd24-httpd-2.4.25-9.el6.src.rpm

noarch:
httpd24-httpd-manual-2.4.25-9.el6.noarch.rpm

x86_64:
httpd24-httpd-2.4.25-9.el6.x86_64.rpm
httpd24-httpd-debuginfo-2.4.25-9.el6.x86_64.rpm
httpd24-httpd-devel-2.4.25-9.el6.x86_64.rpm
httpd24-httpd-tools-2.4.25-9.el6.x86_64.rpm
httpd24-mod_ldap-2.4.25-9.el6.x86_64.rpm
httpd24-mod_proxy_html-2.4.25-9.el6.x86_64.rpm
httpd24-mod_session-2.4.25-9.el6.x86_64.rpm
httpd24-mod_ssl-2.4.25-9.el6.x86_64.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6):

Source:
httpd24-httpd-2.4.25-9.el6.src.rpm

noarch:
httpd24-httpd-manual-2.4.25-9.el6.noarch.rpm

x86_64:
httpd24-httpd-2.4.25-9.el6.x86_64.rpm
httpd24-httpd-debuginfo-2.4.25-9.el6.x86_64.rpm
httpd24-httpd-devel-2.4.25-9.el6.x86_64.rpm
httpd24-httpd-tools-2.4.25-9.el6.x86_64.rpm
httpd24-mod_ldap-2.4.25-9.el6.x86_64.rpm
httpd24-mod_proxy_html-2.4.25-9.el6.x86_64.rpm
httpd24-mod_session-2.4.25-9.el6.x86_64.rpm
httpd24-mod_ssl-2.4.25-9.el6.x86_64.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7):

Source:
httpd24-httpd-2.4.25-9.el7.src.rpm

noarch:
httpd24-httpd-manual-2.4.25-9.el7.noarch.rpm

x86_64:
httpd24-httpd-2.4.25-9.el7.x86_64.rpm
httpd24-httpd-debuginfo-2.4.25-9.el7.x86_64.rpm
httpd24-httpd-devel-2.4.25-9.el7.x86_64.rpm
httpd24-httpd-tools-2.4.25-9.el7.x86_64.rpm
httpd24-mod_ldap-2.4.25-9.el7.x86_64.rpm
httpd24-mod_proxy_html-2.4.25-9.el7.x86_64.rpm
httpd24-mod_session-2.4.25-9.el7.x86_64.rpm
httpd24-mod_ssl-2.4.25-9.el7.x86_64.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3):

Source:
httpd24-httpd-2.4.25-9.el7.src.rpm

noarch:
httpd24-httpd-manual-2.4.25-9.el7.noarch.rpm

x86_64:
httpd24-httpd-2.4.25-9.el7.x86_64.rpm
httpd24-httpd-debuginfo-2.4.25-9.el7.x86_64.rpm
httpd24-httpd-devel-2.4.25-9.el7.x86_64.rpm
httpd24-httpd-tools-2.4.25-9.el7.x86_64.rpm
httpd24-mod_ldap-2.4.25-9.el7.x86_64.rpm
httpd24-mod_proxy_html-2.4.25-9.el7.x86_64.rpm
httpd24-mod_session-2.4.25-9.el7.x86_64.rpm
httpd24-mod_ssl-2.4.25-9.el7.x86_64.rpm

Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7):

Source:
httpd24-httpd-2.4.25-9.el7.src.rpm

noarch:
httpd24-httpd-manual-2.4.25-9.el7.noarch.rpm

x86_64:
httpd24-httpd-2.4.25-9.el7.x86_64.rpm
httpd24-httpd-debuginfo-2.4.25-9.el7.x86_64.rpm
httpd24-httpd-devel-2.4.25-9.el7.x86_64.rpm
httpd24-httpd-tools-2.4.25-9.el7.x86_64.rpm
httpd24-mod_ldap-2.4.25-9.el7.x86_64.rpm
httpd24-mod_proxy_html-2.4.25-9.el7.x86_64.rpm
httpd24-mod_session-2.4.25-9.el7.x86_64.rpm
httpd24-mod_ssl-2.4.25-9.el7.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2016-0736
https://access.redhat.com/security/cve/CVE-2016-1546
https://access.redhat.com/security/cve/CVE-2016-2161
https://access.redhat.com/security/cve/CVE-2016-8740
https://access.redhat.com/security/cve/CVE-2016-8743
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-US/Red_Hat_Software_Collections/2/html/2.4_Release_Notes/chap-RHSCL.html#sect-RHSCL-Changes-httpd

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2017 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iD8DBQFZAJq1XlSAg2UNWIIRAlGKAJ9zNHkvJQ9/I+imHbgRwjelvV9xKgCeLyYO
SjFZr+hN7gjeQOgcC0kswCY=
=m+ZH
-----END PGP SIGNATURE-----


--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce