- Issued:
- 2019-09-24
- Updated:
- 2019-09-24
RHSA-2019:2893 - Security Advisory
Synopsis
Important: httpd:2.4 security update
Type/Severity
Security Advisory: Important
Topic
An update for the httpd:2.4 module is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Description
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.
Security Fix(es):
- HTTP/2: request for large response leads to denial of service (CVE-2019-9517)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Solution
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing the updated packages, the httpd daemon will be restarted automatically.
Affected Products
- Red Hat Enterprise Linux for x86_64 8 x86_64
- Red Hat Enterprise Linux for IBM z Systems 8 s390x
- Red Hat Enterprise Linux for Power, little endian 8 ppc64le
- Red Hat Enterprise Linux for ARM 64 8 aarch64
Fixes
- BZ - 1741868 - CVE-2019-9517 HTTP/2: request for large response leads to denial of service
CVEs
References
Note:
More recent versions of these packages may be available.
Click a package name for more details.
Red Hat Enterprise Linux for x86_64 8
| SRPM | |
|---|---|
| httpd-2.4.37-12.module+el8.0.0+4096+eb40e6da.src.rpm | SHA-256: b5bee6c08a36abf29b13c1cf173665e8ca0129ffc26f76c23c6256aca802d071 |
| mod_http2-1.11.3-3.module+el8.0.0+4096+eb40e6da.src.rpm | SHA-256: 927b29a7221a892f069f0d7aa3f2022566159cb34b58d3163ccc6e04d8f2275d |
| x86_64 | |
| httpd-filesystem-2.4.37-12.module+el8.0.0+4096+eb40e6da.noarch.rpm | SHA-256: 6be202e6c2337c15310d3b93e46d7f23aaff148e09b2da5ef5f79a8963f323f6 |
| httpd-manual-2.4.37-12.module+el8.0.0+4096+eb40e6da.noarch.rpm | SHA-256: f9ef71f5547db0030d0559ad475b1940501aa860d29ef2327456e69833d72cf8 |
| httpd-2.4.37-12.module+el8.0.0+4096+eb40e6da.x86_64.rpm | SHA-256: c71964aa835ff68d73f5e051f1c57a02892fa8a943093a18b8bda630c6915c44 |
| httpd-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.x86_64.rpm | SHA-256: e5c582a0e343af04fbc4865cff762e08da39de204f1df6b0dd5c7df6c0a4bcb9 |
| httpd-debugsource-2.4.37-12.module+el8.0.0+4096+eb40e6da.x86_64.rpm | SHA-256: 689516dcbdd65ae8ddbbca4b826af5c97f13df2388eadbda1e328a31918cfdb4 |
| httpd-devel-2.4.37-12.module+el8.0.0+4096+eb40e6da.x86_64.rpm | SHA-256: ae68a34c749e02bb9834255404da2b91f2a0ed8673d9fa76f8bd4476103cf975 |
| httpd-tools-2.4.37-12.module+el8.0.0+4096+eb40e6da.x86_64.rpm | SHA-256: 3aa3645beaa60ab6e4bc7def1b09bf69b4cdd0df93f5c96a6b6867299691dcad |
| httpd-tools-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.x86_64.rpm | SHA-256: 19ddacd72dd01ec4254dae22c46e93ba93bdf882d6a3d52b5c929d4e8dae9a9b |
| mod_http2-1.11.3-3.module+el8.0.0+4096+eb40e6da.x86_64.rpm | SHA-256: ee82fa2d7e4c9970a59242db79959e222ddbd92e601550e66067fc2733e6d0e6 |
| mod_http2-debuginfo-1.11.3-3.module+el8.0.0+4096+eb40e6da.x86_64.rpm | SHA-256: a91c0cdb0572e40ce9d6eb6c9ffe418605c5a228b69e6070abf203f10ea9870d |
| mod_http2-debugsource-1.11.3-3.module+el8.0.0+4096+eb40e6da.x86_64.rpm | SHA-256: 6156b89b9c50d7b4fe853e22d571e37bc99ab6bf4a2271264733a3cda203f6a3 |
| mod_ldap-2.4.37-12.module+el8.0.0+4096+eb40e6da.x86_64.rpm | SHA-256: 3d65bbe5c8f5e2341a4b93d73414ddb515e43d38cb91a55b846cb18c0d31744c |
| mod_ldap-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.x86_64.rpm | SHA-256: bb9ffb8e47fb2b6964899814e549cff2cc0d26f5e196405baee53a301b819379 |
| mod_md-2.4.37-12.module+el8.0.0+4096+eb40e6da.x86_64.rpm | SHA-256: 49e2195d02fe300b1cf4d412c77924a7de25714cb5f28dd3c57f410a0fd21313 |
| mod_md-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.x86_64.rpm | SHA-256: 44aa174b3f845cfa801f9baf396b26768d4ecca88f81d6f74b9fbfe97f2651bd |
| mod_proxy_html-2.4.37-12.module+el8.0.0+4096+eb40e6da.x86_64.rpm | SHA-256: 80d452fd6817b7ebb1827ffca507529a2cb5a88d9a0d102c0ed59c2650b9d160 |
| mod_proxy_html-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.x86_64.rpm | SHA-256: 8d7411dfbcc49443e91d79a54a632c775c4e863e47a9dcc6dda9f3ff1120cf5b |
| mod_session-2.4.37-12.module+el8.0.0+4096+eb40e6da.x86_64.rpm | SHA-256: db044ef3796809af7cc870be75d7b02ad9a5f9730c0adcfa6ba91845da18535c |
| mod_session-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.x86_64.rpm | SHA-256: 2dad6c18705b9ea1fa71b4435d85c68ccd325b71ebe4c91cdc48ad547bb7d5f3 |
| mod_ssl-2.4.37-12.module+el8.0.0+4096+eb40e6da.x86_64.rpm | SHA-256: aef4721c76fc55c853f63d4862994c491a9d333b5070d8ab5960356b83938e09 |
| mod_ssl-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.x86_64.rpm | SHA-256: 09334dc4b39bea1e793e3ec616153c9c2ab355c9999dfe1d407f23decae32638 |
Red Hat Enterprise Linux for IBM z Systems 8
| SRPM | |
|---|---|
| httpd-2.4.37-12.module+el8.0.0+4096+eb40e6da.src.rpm | SHA-256: b5bee6c08a36abf29b13c1cf173665e8ca0129ffc26f76c23c6256aca802d071 |
| mod_http2-1.11.3-3.module+el8.0.0+4096+eb40e6da.src.rpm | SHA-256: 927b29a7221a892f069f0d7aa3f2022566159cb34b58d3163ccc6e04d8f2275d |
| s390x | |
| httpd-2.4.37-12.module+el8.0.0+4096+eb40e6da.s390x.rpm | SHA-256: 57d7887e631e36ef7fb467cd6ce15e4db01a417a2383f890819bddfb5ad9c7a0 |
| httpd-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.s390x.rpm | SHA-256: 062b7e75ce500a8f6ad39c638ed38e738175d591131b92e3a3487551322f93b0 |
| httpd-debugsource-2.4.37-12.module+el8.0.0+4096+eb40e6da.s390x.rpm | SHA-256: c698b23bf6d4af2e918f56c0e7f72581b0af6ebc2031d92f882280cbc0406e43 |
| httpd-devel-2.4.37-12.module+el8.0.0+4096+eb40e6da.s390x.rpm | SHA-256: 801181ca63c7835606181476b00bab941faa226903e07b3a98378c7c4ec5eaae |
| httpd-filesystem-2.4.37-12.module+el8.0.0+4096+eb40e6da.noarch.rpm | SHA-256: 6be202e6c2337c15310d3b93e46d7f23aaff148e09b2da5ef5f79a8963f323f6 |
| httpd-manual-2.4.37-12.module+el8.0.0+4096+eb40e6da.noarch.rpm | SHA-256: f9ef71f5547db0030d0559ad475b1940501aa860d29ef2327456e69833d72cf8 |
| httpd-tools-2.4.37-12.module+el8.0.0+4096+eb40e6da.s390x.rpm | SHA-256: 4ffc2f3eccd4f40cdf560975d01ed5920a4b7853225b96c7de33423a9d87d83b |
| httpd-tools-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.s390x.rpm | SHA-256: 222d594c378a6fa91433905f2d1a84de90980dc679256c902c2e64c2dd05eb84 |
| mod_http2-1.11.3-3.module+el8.0.0+4096+eb40e6da.s390x.rpm | SHA-256: f3abcf22c6f3a51e2d8e016ad518206d14d6a86350e57bb64213d4b0160e7ac7 |
| mod_http2-debuginfo-1.11.3-3.module+el8.0.0+4096+eb40e6da.s390x.rpm | SHA-256: 2b7dba80a311b6fee1428c969aa7b11e1a48fc51ae03bcaf81f6f68f4eb59c4b |
| mod_http2-debugsource-1.11.3-3.module+el8.0.0+4096+eb40e6da.s390x.rpm | SHA-256: 1711cf50cbc3ed950f226170f5e669c250188c01065e1728867304b7dcdea7f4 |
| mod_ldap-2.4.37-12.module+el8.0.0+4096+eb40e6da.s390x.rpm | SHA-256: 79d049fa038358aa8ccb5c848e8f1d3f3b4ed0d1292f0f0d11a80cc733463668 |
| mod_ldap-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.s390x.rpm | SHA-256: e40bd43e7e29fb30586375aa5bcda9e6f217c084a30ee5dc06f08b1d97d6e890 |
| mod_md-2.4.37-12.module+el8.0.0+4096+eb40e6da.s390x.rpm | SHA-256: 81c790ccaa0107a31b2645dadd69e9a10236251343793a7e0556c23b37c3a7de |
| mod_md-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.s390x.rpm | SHA-256: f8e74b6c8ed7db9e622c93f1096d919e05ff91fb3ad739f5b8a9de85d9ecebd2 |
| mod_proxy_html-2.4.37-12.module+el8.0.0+4096+eb40e6da.s390x.rpm | SHA-256: 7675b9e7774452b191f636fa08934853df5885198f0a2e63c9f9b0b5753d2dd5 |
| mod_proxy_html-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.s390x.rpm | SHA-256: 5f7e726fc678c1fd96f8e71d52a3e6b96b96dcad311e6bf53496ea8d4a1afde0 |
| mod_session-2.4.37-12.module+el8.0.0+4096+eb40e6da.s390x.rpm | SHA-256: df0394a42f9a6905708cf70d672da9ba98ca990ae8ec4848e8cdfa91855bf062 |
| mod_session-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.s390x.rpm | SHA-256: fc0a7d3d22de3193accf0475597ca73332d425f36ff33106cf15f932a5a82501 |
| mod_ssl-2.4.37-12.module+el8.0.0+4096+eb40e6da.s390x.rpm | SHA-256: efe03514655a68e037db563eb47cf29d309368ce47ed3c88e355f9cf410dcfd7 |
| mod_ssl-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.s390x.rpm | SHA-256: 82fff34b64aefcea3bcc7e71b1fd7a3d8c85b22a76c662fca57c2b836e9d8f1c |
Red Hat Enterprise Linux for Power, little endian 8
| SRPM | |
|---|---|
| httpd-2.4.37-12.module+el8.0.0+4096+eb40e6da.src.rpm | SHA-256: b5bee6c08a36abf29b13c1cf173665e8ca0129ffc26f76c23c6256aca802d071 |
| mod_http2-1.11.3-3.module+el8.0.0+4096+eb40e6da.src.rpm | SHA-256: 927b29a7221a892f069f0d7aa3f2022566159cb34b58d3163ccc6e04d8f2275d |
| ppc64le | |
| httpd-filesystem-2.4.37-12.module+el8.0.0+4096+eb40e6da.noarch.rpm | SHA-256: 6be202e6c2337c15310d3b93e46d7f23aaff148e09b2da5ef5f79a8963f323f6 |
| httpd-manual-2.4.37-12.module+el8.0.0+4096+eb40e6da.noarch.rpm | SHA-256: f9ef71f5547db0030d0559ad475b1940501aa860d29ef2327456e69833d72cf8 |
| httpd-2.4.37-12.module+el8.0.0+4096+eb40e6da.ppc64le.rpm | SHA-256: 728485980bb7d2ce2eadbb576aee7d604810c5b9023eb6a447376a9fee0b93a2 |
| httpd-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.ppc64le.rpm | SHA-256: bfbaabb95d8584af88700aad4d2bd5e553eef1f3aab425e7ea3a521609c10016 |
| httpd-debugsource-2.4.37-12.module+el8.0.0+4096+eb40e6da.ppc64le.rpm | SHA-256: 209084da6f1aa8f820401e4b9c713e0ddf89b92ec9afaee6b638c787bed0c137 |
| httpd-devel-2.4.37-12.module+el8.0.0+4096+eb40e6da.ppc64le.rpm | SHA-256: 7e4f5d3ab3792e7a353718b135acb943ced3a3cd6c248dd8b48152619e2cab0b |
| httpd-tools-2.4.37-12.module+el8.0.0+4096+eb40e6da.ppc64le.rpm | SHA-256: 07f0a20e2b15d1d6ef610cb0c450e066f68ee4fbc970338665471b1b1ec71a93 |
| httpd-tools-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.ppc64le.rpm | SHA-256: 2f1fc145b8ed16b590f40db4e3ebf48f101ed2e7de80c7ef15d5113f3dfc84a0 |
| mod_http2-1.11.3-3.module+el8.0.0+4096+eb40e6da.ppc64le.rpm | SHA-256: a5a352cece7429b6ff586254206df7748e8cebadfdf35444d409878872275c27 |
| mod_http2-debuginfo-1.11.3-3.module+el8.0.0+4096+eb40e6da.ppc64le.rpm | SHA-256: d4354b95ddb7317b0136af792024f999b5083b065313b9e2aabe26bae04bb48e |
| mod_http2-debugsource-1.11.3-3.module+el8.0.0+4096+eb40e6da.ppc64le.rpm | SHA-256: 0a442e8614dcf9a548ec19feecc591f2aa38af9638393aa15996de6cfeba5137 |
| mod_ldap-2.4.37-12.module+el8.0.0+4096+eb40e6da.ppc64le.rpm | SHA-256: af82df4902a7f33f9e7725598ae54b9a964cff7880acfa61e0a422380a837494 |
| mod_ldap-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.ppc64le.rpm | SHA-256: d6ff7cce26110fb1a42fd7cdbb035a4c42538f8c2ccdf7d710f4ecaa3d1fd7f4 |
| mod_md-2.4.37-12.module+el8.0.0+4096+eb40e6da.ppc64le.rpm | SHA-256: 91466cd97ebbb10d279c15b843323c5a1df9e584a238e6e62fe914f5e91b62e2 |
| mod_md-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.ppc64le.rpm | SHA-256: 460d92b0a84dc39e3d426646b47cb2c32f06b260875df7e4fd7b06df5bc73dba |
| mod_proxy_html-2.4.37-12.module+el8.0.0+4096+eb40e6da.ppc64le.rpm | SHA-256: b3bcb8cfbcbc2d4bd813f922a14443fc54f5c36c2a1f188282c552832bd1f32e |
| mod_proxy_html-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.ppc64le.rpm | SHA-256: ef38e56ab375a3cae3d2bb5afbb40037b6d80ea6c0cf99d7cae44cc675998ca4 |
| mod_session-2.4.37-12.module+el8.0.0+4096+eb40e6da.ppc64le.rpm | SHA-256: a12f42a086fca908791234fbda97008e44cf4a90c5d3a78a58e509ec07b9ff6c |
| mod_session-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.ppc64le.rpm | SHA-256: 0948833c0f256f0329f3ecafa5aa4486df64c8e42bc82194c6b78241310e4cc5 |
| mod_ssl-2.4.37-12.module+el8.0.0+4096+eb40e6da.ppc64le.rpm | SHA-256: cb6718a8853842cabb2b844539becc9ce742d59039b27ba3eb499925ff349195 |
| mod_ssl-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.ppc64le.rpm | SHA-256: 44f159cead926925219294684b970bab19087c7c21f5018cef74765de0e42760 |
Red Hat Enterprise Linux for ARM 64 8
| SRPM | |
|---|---|
| httpd-2.4.37-12.module+el8.0.0+4096+eb40e6da.src.rpm | SHA-256: b5bee6c08a36abf29b13c1cf173665e8ca0129ffc26f76c23c6256aca802d071 |
| mod_http2-1.11.3-3.module+el8.0.0+4096+eb40e6da.src.rpm | SHA-256: 927b29a7221a892f069f0d7aa3f2022566159cb34b58d3163ccc6e04d8f2275d |
| aarch64 | |
| httpd-filesystem-2.4.37-12.module+el8.0.0+4096+eb40e6da.noarch.rpm | SHA-256: 6be202e6c2337c15310d3b93e46d7f23aaff148e09b2da5ef5f79a8963f323f6 |
| httpd-manual-2.4.37-12.module+el8.0.0+4096+eb40e6da.noarch.rpm | SHA-256: f9ef71f5547db0030d0559ad475b1940501aa860d29ef2327456e69833d72cf8 |
| httpd-2.4.37-12.module+el8.0.0+4096+eb40e6da.aarch64.rpm | SHA-256: 1b2d81cc4bfac8a301a77cf2084506a3613d14eb9dc3f67042e654e4f8278e55 |
| httpd-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.aarch64.rpm | SHA-256: cc77649cde1646bbda7efc65ac69099a97ebaafa8eb84bbebaadc70aec74e6b4 |
| httpd-debugsource-2.4.37-12.module+el8.0.0+4096+eb40e6da.aarch64.rpm | SHA-256: 9df9e97ff7c7387c1bd5f3b1a3e26d0c29333fd090d2b8fbe0440a7fdcb43488 |
| httpd-devel-2.4.37-12.module+el8.0.0+4096+eb40e6da.aarch64.rpm | SHA-256: 2bff6020b91caa2cb2c28f5f03f6d7c9de5e9810c6d1e8af3a038e4d83822478 |
| httpd-tools-2.4.37-12.module+el8.0.0+4096+eb40e6da.aarch64.rpm | SHA-256: 7e4de6871ad678846a72e9ffbf36afe141274463849af77711685a7a8fa71c86 |
| httpd-tools-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.aarch64.rpm | SHA-256: 7e8e3a671f5a18e14d05f949cdf7fab99ffe581e2c542320efe4277bbf9dac35 |
| mod_http2-1.11.3-3.module+el8.0.0+4096+eb40e6da.aarch64.rpm | SHA-256: 98f283ffa6ca9d6849922637f29ada45730b2fff697444fd4e141d41d3175ce2 |
| mod_http2-debuginfo-1.11.3-3.module+el8.0.0+4096+eb40e6da.aarch64.rpm | SHA-256: 5d5dd46892ebcce8e3149f530175f9ecbeeec4fe1fdb1fae66fa91d834917e54 |
| mod_http2-debugsource-1.11.3-3.module+el8.0.0+4096+eb40e6da.aarch64.rpm | SHA-256: fba081a541fbd304367bac0676ab5197e3247c53a9e471539a77c144b0b80d94 |
| mod_ldap-2.4.37-12.module+el8.0.0+4096+eb40e6da.aarch64.rpm | SHA-256: 3d690d5d0236b26e97b3e85c5d5c8036ca6b77ff1ffb0dd86fa899969c2c1beb |
| mod_ldap-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.aarch64.rpm | SHA-256: fdb8fda5ab8297e2fc60f65e6d5e4aadbc5b61fdcbf013fa5dd23e2a78d0e9ac |
| mod_md-2.4.37-12.module+el8.0.0+4096+eb40e6da.aarch64.rpm | SHA-256: 039abae6b5078effb90a126c379707dcd8eea0810126e1c66aefcbabdea09142 |
| mod_md-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.aarch64.rpm | SHA-256: 5a723b2d4b38c858db450606717a38f98d5a4efda6d05e194bcb513d7860f193 |
| mod_proxy_html-2.4.37-12.module+el8.0.0+4096+eb40e6da.aarch64.rpm | SHA-256: 01cc855801222b012c79d8b6937dce42f3335c3eb1e59b58cda6d69e1a1f39bf |
| mod_proxy_html-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.aarch64.rpm | SHA-256: 8952935fa0802b884855df547f15770876bc7feeac3fb878ee83dacbd3a4a0a5 |
| mod_session-2.4.37-12.module+el8.0.0+4096+eb40e6da.aarch64.rpm | SHA-256: 6f0a2f36f9c9d0f15e6eaa6e8d2eec153a7c349877106b3e86aeb3f0d2a4b18c |
| mod_session-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.aarch64.rpm | SHA-256: 3bb0608a853cc032102a148fdad12f0927a7f9ab66a4d8724b4d48249c15fca6 |
| mod_ssl-2.4.37-12.module+el8.0.0+4096+eb40e6da.aarch64.rpm | SHA-256: a6d76355a3ea65275287422d815771158f47211a574c55919251463da27bf27c |
| mod_ssl-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.aarch64.rpm | SHA-256: c84282f2195d4ad2b2b3548cd9f9e5a730b3d0772bfc56b399ad8d21ac919c0e |
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.