Issued:
2017-10-19
Updated:
2017-10-19

RHSA-2017:2972 - Moderate: httpd security update

Synopsis

Moderate: httpd security update

Type/Severity

Security Advisory Moderate

Topic

An update for httpd is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

  • A use-after-free flaw was found in the way httpd handled invalid and previously unregistered HTTP methods specified in the Limit directive used in an .htaccess file. A remote attacker could possibly use this flaw to disclose portions of the server memory, or cause httpd child process to crash. (CVE-2017-9798)

  • A regression was found in the Red Hat Enterprise Linux 6.9 version of httpd, causing comments in the "Allow" and "Deny" configuration lines to be parsed incorrectly. A web administrator could unintentionally allow any client to access a restricted HTTP resource. (CVE-2017-12171)

Red Hat would like to thank Hanno Böck for reporting CVE-2017-9798 and KAWAHARA Masashi for reporting CVE-2017-12171.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon will be restarted automatically.

Affected Products

ProductVersionArch
Red Hat Enterprise Linux for Scientific Computing6x86_64
Red Hat Enterprise Linux for Power, big endian6ppc64
Red Hat Enterprise Linux for IBM z Systems6s390x
Red Hat Enterprise Linux Workstation6x86_64
Red Hat Enterprise Linux Workstation6i386
Red Hat Enterprise Linux Server6x86_64
Red Hat Enterprise Linux Server6i386
Red Hat Enterprise Linux Server - Extended Life Cycle Support6x86_64
Red Hat Enterprise Linux Server - Extended Life Cycle Support6i386
Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension6x86_64
Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension6i386
Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems)6s390x
Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems)6s390x
Red Hat Enterprise Linux Desktop6x86_64
Red Hat Enterprise Linux Desktop6i386

Updated Packages

  • httpd-tools-2.2.15-60.el6_9.6.i686.rpm
  • httpd-tools-2.2.15-60.el6_9.6.s390x.rpm
  • httpd-tools-2.2.15-60.el6_9.6.ppc64.rpm
  • httpd-devel-2.2.15-60.el6_9.6.i686.rpm
  • httpd-devel-2.2.15-60.el6_9.6.ppc64.rpm
  • httpd-debuginfo-2.2.15-60.el6_9.6.ppc.rpm
  • httpd-devel-2.2.15-60.el6_9.6.s390.rpm
  • httpd-manual-2.2.15-60.el6_9.6.noarch.rpm
  • mod_ssl-2.2.15-60.el6_9.6.i686.rpm
  • httpd-debuginfo-2.2.15-60.el6_9.6.x86_64.rpm
  • httpd-2.2.15-60.el6_9.6.ppc64.rpm
  • httpd-2.2.15-60.el6_9.6.i686.rpm
  • httpd-debuginfo-2.2.15-60.el6_9.6.i686.rpm
  • httpd-2.2.15-60.el6_9.6.s390x.rpm
  • httpd-devel-2.2.15-60.el6_9.6.x86_64.rpm
  • mod_ssl-2.2.15-60.el6_9.6.x86_64.rpm
  • httpd-debuginfo-2.2.15-60.el6_9.6.ppc64.rpm
  • mod_ssl-2.2.15-60.el6_9.6.ppc64.rpm
  • httpd-debuginfo-2.2.15-60.el6_9.6.s390x.rpm
  • httpd-devel-2.2.15-60.el6_9.6.s390x.rpm
  • httpd-2.2.15-60.el6_9.6.x86_64.rpm
  • httpd-devel-2.2.15-60.el6_9.6.ppc.rpm
  • httpd-tools-2.2.15-60.el6_9.6.x86_64.rpm
  • mod_ssl-2.2.15-60.el6_9.6.s390x.rpm
  • httpd-debuginfo-2.2.15-60.el6_9.6.s390.rpm
  • httpd-2.2.15-60.el6_9.6.src.rpm

Fixes

CVEs

References

Additional information