Red Hat Product Errata RHSA-2019:2343 - Security Advisory
Issued:
2019-08-06
Updated:
2019-08-06

RHSA-2019:2343 - Security Advisory

Synopsis

Moderate: httpd security and bug fix update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for httpd is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

  • httpd: mod_auth_digest: access control bypass due to race condition (CVE-2019-0217)
  • httpd: URL normalization inconsistency (CVE-2019-0220)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon will be restarted automatically.

Affected Products

  • Red Hat Enterprise Linux Server 7 x86_64
  • Red Hat Enterprise Linux Workstation 7 x86_64
  • Red Hat Enterprise Linux Desktop 7 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 7 s390x
  • Red Hat Enterprise Linux for Power, big endian 7 ppc64
  • Red Hat Enterprise Linux for Scientific Computing 7 x86_64
  • Red Hat Enterprise Linux for Power, little endian 7 ppc64le

Fixes

  • BZ - 1695020 - CVE-2019-0217 httpd: mod_auth_digest: access control bypass due to race condition
  • BZ - 1695036 - CVE-2019-0220 httpd: URL normalization inconsistency

Red Hat Enterprise Linux Server 7

SRPM
httpd-2.4.6-90.el7.src.rpm SHA-256: d52c45065956d0be65161f2c5012bffcb582ba830b3b1b63693aaf9bf479c0a8
x86_64
httpd-2.4.6-90.el7.x86_64.rpm SHA-256: 5bbf77f4780cc6164551e8347d456f0cea2e7acd2906d0f8ddb554a583b0353e
httpd-debuginfo-2.4.6-90.el7.x86_64.rpm SHA-256: 17413664c69b1826134f8a3e41046d6a15424f2402c56833d54608e36763430e
httpd-debuginfo-2.4.6-90.el7.x86_64.rpm SHA-256: 17413664c69b1826134f8a3e41046d6a15424f2402c56833d54608e36763430e
httpd-devel-2.4.6-90.el7.x86_64.rpm SHA-256: e1c5a24aa227dd10f5313dd1c2218c990ff6d68df0169d33ac01dfe24cd4e137
httpd-manual-2.4.6-90.el7.noarch.rpm SHA-256: 89c4f044614d795854e5aa8de713ea26b791782f31d31268e9d1ffc9326d978a
httpd-tools-2.4.6-90.el7.x86_64.rpm SHA-256: 1622f751978c18ba91b6d3e66f99e68e0f17a9b7f906b3334a2356d59fca7969
mod_ldap-2.4.6-90.el7.x86_64.rpm SHA-256: 3db8ec5f41c5982ece50f6323cf2f60fc60d284cf3d6a028e5ff832e0537d77c
mod_proxy_html-2.4.6-90.el7.x86_64.rpm SHA-256: 22c9f0cd56a3bc6490d377f152d08d7cb7ff2b14006da344d202ed1200f981d4
mod_session-2.4.6-90.el7.x86_64.rpm SHA-256: 6f2e40b6b80d64b8d5130d47a21bf6d90cbb95c018fa65aa8bc643231398f1d2
mod_ssl-2.4.6-90.el7.x86_64.rpm SHA-256: 1f6c9ef5441f7e62446f0c9bbbf1437b0c12b93fb2137bb9bd72781c47993c34

Red Hat Enterprise Linux Workstation 7

SRPM
httpd-2.4.6-90.el7.src.rpm SHA-256: d52c45065956d0be65161f2c5012bffcb582ba830b3b1b63693aaf9bf479c0a8
x86_64
httpd-2.4.6-90.el7.x86_64.rpm SHA-256: 5bbf77f4780cc6164551e8347d456f0cea2e7acd2906d0f8ddb554a583b0353e
httpd-debuginfo-2.4.6-90.el7.x86_64.rpm SHA-256: 17413664c69b1826134f8a3e41046d6a15424f2402c56833d54608e36763430e
httpd-debuginfo-2.4.6-90.el7.x86_64.rpm SHA-256: 17413664c69b1826134f8a3e41046d6a15424f2402c56833d54608e36763430e
httpd-devel-2.4.6-90.el7.x86_64.rpm SHA-256: e1c5a24aa227dd10f5313dd1c2218c990ff6d68df0169d33ac01dfe24cd4e137
httpd-manual-2.4.6-90.el7.noarch.rpm SHA-256: 89c4f044614d795854e5aa8de713ea26b791782f31d31268e9d1ffc9326d978a
httpd-tools-2.4.6-90.el7.x86_64.rpm SHA-256: 1622f751978c18ba91b6d3e66f99e68e0f17a9b7f906b3334a2356d59fca7969
mod_ldap-2.4.6-90.el7.x86_64.rpm SHA-256: 3db8ec5f41c5982ece50f6323cf2f60fc60d284cf3d6a028e5ff832e0537d77c
mod_proxy_html-2.4.6-90.el7.x86_64.rpm SHA-256: 22c9f0cd56a3bc6490d377f152d08d7cb7ff2b14006da344d202ed1200f981d4
mod_session-2.4.6-90.el7.x86_64.rpm SHA-256: 6f2e40b6b80d64b8d5130d47a21bf6d90cbb95c018fa65aa8bc643231398f1d2
mod_ssl-2.4.6-90.el7.x86_64.rpm SHA-256: 1f6c9ef5441f7e62446f0c9bbbf1437b0c12b93fb2137bb9bd72781c47993c34

Red Hat Enterprise Linux Desktop 7

SRPM
httpd-2.4.6-90.el7.src.rpm SHA-256: d52c45065956d0be65161f2c5012bffcb582ba830b3b1b63693aaf9bf479c0a8
x86_64
httpd-2.4.6-90.el7.x86_64.rpm SHA-256: 5bbf77f4780cc6164551e8347d456f0cea2e7acd2906d0f8ddb554a583b0353e
httpd-debuginfo-2.4.6-90.el7.x86_64.rpm SHA-256: 17413664c69b1826134f8a3e41046d6a15424f2402c56833d54608e36763430e
httpd-devel-2.4.6-90.el7.x86_64.rpm SHA-256: e1c5a24aa227dd10f5313dd1c2218c990ff6d68df0169d33ac01dfe24cd4e137
httpd-manual-2.4.6-90.el7.noarch.rpm SHA-256: 89c4f044614d795854e5aa8de713ea26b791782f31d31268e9d1ffc9326d978a
httpd-tools-2.4.6-90.el7.x86_64.rpm SHA-256: 1622f751978c18ba91b6d3e66f99e68e0f17a9b7f906b3334a2356d59fca7969
mod_ldap-2.4.6-90.el7.x86_64.rpm SHA-256: 3db8ec5f41c5982ece50f6323cf2f60fc60d284cf3d6a028e5ff832e0537d77c
mod_proxy_html-2.4.6-90.el7.x86_64.rpm SHA-256: 22c9f0cd56a3bc6490d377f152d08d7cb7ff2b14006da344d202ed1200f981d4
mod_session-2.4.6-90.el7.x86_64.rpm SHA-256: 6f2e40b6b80d64b8d5130d47a21bf6d90cbb95c018fa65aa8bc643231398f1d2
mod_ssl-2.4.6-90.el7.x86_64.rpm SHA-256: 1f6c9ef5441f7e62446f0c9bbbf1437b0c12b93fb2137bb9bd72781c47993c34

Red Hat Enterprise Linux for IBM z Systems 7

SRPM
httpd-2.4.6-90.el7.src.rpm SHA-256: d52c45065956d0be65161f2c5012bffcb582ba830b3b1b63693aaf9bf479c0a8
s390x
httpd-2.4.6-90.el7.s390x.rpm SHA-256: 83257e9710896e012f08807451f57a540671e503f2fa111401ba16be925650f0
httpd-debuginfo-2.4.6-90.el7.s390x.rpm SHA-256: 139f2c2be02f096926e81dc1e517200d760096f00aea62c761125199de4aa7ef
httpd-debuginfo-2.4.6-90.el7.s390x.rpm SHA-256: 139f2c2be02f096926e81dc1e517200d760096f00aea62c761125199de4aa7ef
httpd-devel-2.4.6-90.el7.s390x.rpm SHA-256: a5cb337dd8d137431ce12c1044f30da9b05b9f1757f592ab7b1bbe77aa7fc109
httpd-manual-2.4.6-90.el7.noarch.rpm SHA-256: 89c4f044614d795854e5aa8de713ea26b791782f31d31268e9d1ffc9326d978a
httpd-tools-2.4.6-90.el7.s390x.rpm SHA-256: 291d81b0082f8f62466167daec0ea5943b08b4807f48bb7ab27ac6c9239f85ae
mod_ldap-2.4.6-90.el7.s390x.rpm SHA-256: c9dfabeaa8b9ebf684311da56083fb55b75f2c7cdb4aca184ad671dd788cffe2
mod_proxy_html-2.4.6-90.el7.s390x.rpm SHA-256: e3ebf4567ebdc92fa1710bfe45963fe30c4a295a035c0f302092127d4d8814a6
mod_session-2.4.6-90.el7.s390x.rpm SHA-256: 5b4e42653573e895fa7c00bf439b514d819594ce1e7ceab3915d9473a067b6f5
mod_ssl-2.4.6-90.el7.s390x.rpm SHA-256: a37eac47e73d2f069476b755ee423888ce1236cb9c3014d7affbd517c6ee1f86

Red Hat Enterprise Linux for Power, big endian 7

SRPM
httpd-2.4.6-90.el7.src.rpm SHA-256: d52c45065956d0be65161f2c5012bffcb582ba830b3b1b63693aaf9bf479c0a8
ppc64
httpd-2.4.6-90.el7.ppc64.rpm SHA-256: f26e45ad990582cd4ad11dcc480183400baa6d66c0cb0ed8f2f3b5aac864fac1
httpd-debuginfo-2.4.6-90.el7.ppc64.rpm SHA-256: b9838c4ebc7d7e824aa2d70c89bfc912eba870b773e703ff67b4eee437fd5afd
httpd-debuginfo-2.4.6-90.el7.ppc64.rpm SHA-256: b9838c4ebc7d7e824aa2d70c89bfc912eba870b773e703ff67b4eee437fd5afd
httpd-devel-2.4.6-90.el7.ppc64.rpm SHA-256: 35b2be69e060be027aad1e570d8e058644a2ceb122da8a7da474879b4ae5584c
httpd-manual-2.4.6-90.el7.noarch.rpm SHA-256: 89c4f044614d795854e5aa8de713ea26b791782f31d31268e9d1ffc9326d978a
httpd-tools-2.4.6-90.el7.ppc64.rpm SHA-256: 0c3e63169581ffddef5326ffd80f4437bd78eea03e87e32ca215021b6e630922
mod_ldap-2.4.6-90.el7.ppc64.rpm SHA-256: ab98541a5db94b871305d8fe9fb108d84b13bb193b67485a6c2da23edfe6e6b6
mod_proxy_html-2.4.6-90.el7.ppc64.rpm SHA-256: cea0e121d6798405dc42ed737692373ca88cb35d3c696fca9fc4ab9f7f83d371
mod_session-2.4.6-90.el7.ppc64.rpm SHA-256: 9e2e91e568ccd29468550d1d5205887f5cf3e164d8cbe3aa0009a741e3ffb5d2
mod_ssl-2.4.6-90.el7.ppc64.rpm SHA-256: 8da313dd88271cf87c1d5e434dacc0f9ed1c6b9d90ebe1a73f0bf7c9bbfead85

Red Hat Enterprise Linux for Scientific Computing 7

SRPM
httpd-2.4.6-90.el7.src.rpm SHA-256: d52c45065956d0be65161f2c5012bffcb582ba830b3b1b63693aaf9bf479c0a8
x86_64
httpd-2.4.6-90.el7.x86_64.rpm SHA-256: 5bbf77f4780cc6164551e8347d456f0cea2e7acd2906d0f8ddb554a583b0353e
httpd-debuginfo-2.4.6-90.el7.x86_64.rpm SHA-256: 17413664c69b1826134f8a3e41046d6a15424f2402c56833d54608e36763430e
httpd-devel-2.4.6-90.el7.x86_64.rpm SHA-256: e1c5a24aa227dd10f5313dd1c2218c990ff6d68df0169d33ac01dfe24cd4e137
httpd-manual-2.4.6-90.el7.noarch.rpm SHA-256: 89c4f044614d795854e5aa8de713ea26b791782f31d31268e9d1ffc9326d978a
httpd-tools-2.4.6-90.el7.x86_64.rpm SHA-256: 1622f751978c18ba91b6d3e66f99e68e0f17a9b7f906b3334a2356d59fca7969
mod_ldap-2.4.6-90.el7.x86_64.rpm SHA-256: 3db8ec5f41c5982ece50f6323cf2f60fc60d284cf3d6a028e5ff832e0537d77c
mod_proxy_html-2.4.6-90.el7.x86_64.rpm SHA-256: 22c9f0cd56a3bc6490d377f152d08d7cb7ff2b14006da344d202ed1200f981d4
mod_session-2.4.6-90.el7.x86_64.rpm SHA-256: 6f2e40b6b80d64b8d5130d47a21bf6d90cbb95c018fa65aa8bc643231398f1d2
mod_ssl-2.4.6-90.el7.x86_64.rpm SHA-256: 1f6c9ef5441f7e62446f0c9bbbf1437b0c12b93fb2137bb9bd72781c47993c34

Red Hat Enterprise Linux for Power, little endian 7

SRPM
httpd-2.4.6-90.el7.src.rpm SHA-256: d52c45065956d0be65161f2c5012bffcb582ba830b3b1b63693aaf9bf479c0a8
ppc64le
httpd-2.4.6-90.el7.ppc64le.rpm SHA-256: 5ab708ec8c63fd9f787af4b9b0ed189b53dd71a13fae69c83e6c55c331cb5a0d
httpd-debuginfo-2.4.6-90.el7.ppc64le.rpm SHA-256: 5339c98ba515ddc05121a368e7880a0b27df5329d2c3b8e4ac2b42445edf4769
httpd-debuginfo-2.4.6-90.el7.ppc64le.rpm SHA-256: 5339c98ba515ddc05121a368e7880a0b27df5329d2c3b8e4ac2b42445edf4769
httpd-devel-2.4.6-90.el7.ppc64le.rpm SHA-256: 001a76195d5ebc5cc0794b4f9d96e7d117400bd8daaac89d0339b6fef4fd459a
httpd-manual-2.4.6-90.el7.noarch.rpm SHA-256: 89c4f044614d795854e5aa8de713ea26b791782f31d31268e9d1ffc9326d978a
httpd-tools-2.4.6-90.el7.ppc64le.rpm SHA-256: 46b8d091e9a55482febeee0ab332be885f36da057efcf98db5e9b3f922a355f6
mod_ldap-2.4.6-90.el7.ppc64le.rpm SHA-256: d0b599c298b3e9e36b086cd6b4033903b0fa259e016571976ca652dd71726b66
mod_proxy_html-2.4.6-90.el7.ppc64le.rpm SHA-256: 3ee3b5356d00399b55afc4a602ba10c5f1e6c78cc054a88d8c26cded97924533
mod_session-2.4.6-90.el7.ppc64le.rpm SHA-256: 46317b063881ce2e744a5255aa691d8c2d6654861adabd47f0ed19dc23f4a3a1
mod_ssl-2.4.6-90.el7.ppc64le.rpm SHA-256: eb5aa8f1157a33f1a580e9c50ec91ec57f78f9c041573e407cb332b4570c52b8

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.