RHBA-2011:0237 - Bug Fix Advisory

Topic

Updated httpd packages that fix multiple bugs and add two enhancements are now
available for Red Hat Enterprise Linux 4.

Description

The Apache HTTP Server is a popular web server.

This update fixes the following bugs:

• Previously the handling of error documents could trigger a recursive error.

Due to this behavior,an additional error message appeared on error pages. This
updated resolves the recursive error. Now, this additional error message does no
longer appear.

• Previously, the warning message "Additionally a <code> error was encountered

while trying to use an ErrorDocument to handle the request." was incorrectly
displayed when an HTTP error (for example 403 Forbidden or 404 Not Found) was
reported. This update backports this issue. The 403 error is now displayed as
intended, but not the `Additionally a 403 error ...' message. (BZ#245483)

• Previously, a memory allocation failure occurred when a large integer was

passed to the "-n" argument for the benchmarking tool. Due to this behavior, the
"ab" tool terminated with a segmentation fault. This update catches the error
condition. The "ab" tool now terminates with an error message in this case.
(BZ#456363)

• Previously, a POST request triggered a redirect that caused the request body

of the POST request being discarded, if the "SSLVerifyClient" directive was used
in Directory or Location context. Due to this behavior, the form or a similar
application input was not processed. With this update, the POST request body is
now preserved correctly across a redirect in a context that allows the form or
other application input to be processed correctly. (BZ#488939)

• Previously, an error in mod_ssl's handling of pending SSL/TLS output data

caused the SSL or TLS not to complete the handshake if the server was configured
to send more than 85 Certificate Authority names in a client certificate
request. This update resolves this error. SSL and TLS handshakes now complete.
(BZ#510518)

• Previously, the hard-coded default location of the pid file used by the httpd

differed from the default used in the httpd.conf configuration file. Due to this
behavior, the init script did not stop or reload the server correctly if the
"PidFile" directive was removed from httpd.conf. With this update, the
hard-coded default pid file location matches the configured default. The init
script now works correctly. (BZ#512221)

This update also adds the following enhancements:

• This update back-ports the "DPI" flag to the mod_rewrite's RewriteRule

directive. This allows a rewrite rule to be used which discards the PATH_INFO
component of the URI. (BZ#517495)

• This update adds the "TraceEnable" directive. This allows the "TRACE" method

to be forcibly disabled. (BZ#478535)

All users of httpd are advised to upgrade to these updated packages, which fix
these bugs and add these enhancements.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

• BZ - 214571 - mod_rewrite adds path info postfix after a substitution occured
• BZ - 245483 - Bogus "recursive" errors
• BZ - 456363 - ab -n overflows
• BZ - 478535 - TraceEnable not an option in current httpd
• BZ - 488939 - mod_rewrite+mod_ssl+SSLVerifyClient = no POST variables
• BZ - 510518 - mod_ssl cannot handle more than 85 CAs
• BZ - 512221 - httpd init script does not work when PidFile option is not set in httpd.conf
• BZ - 517495 - "could not get next bucket brigade" while a client is doing a PUT results in data loss
• BZ - 566671 - mod_ssl: Add SSLInsecureRenegotiation directive [rhel-4]

CVEs

(none)

References

(none)