Issued:
2019-11-05
Updated:
2019-11-05

RHSA-2019:3436 - Security Advisory

Synopsis

Moderate: httpd:2.4 security and bug fix update

Type/Severity

Security Advisory: Moderate

Topic

An update for the httpd:2.4 module is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

  • httpd: mod_auth_digest: access control bypass due to race condition (CVE-2019-0217)
  • httpd: URL normalization inconsistency (CVE-2019-0220)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon will be restarted automatically.

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for ARM 64 8 aarch64

Fixes

  • BZ - 1669221 - `ExtendedStatus Off` directive when using mod_systemd causes systemctl to hang
  • BZ - 1673022 - httpd can not be started with mod_md enabled
  • BZ - 1695020 - CVE-2019-0217 httpd: mod_auth_digest: access control bypass due to race condition
  • BZ - 1695036 - CVE-2019-0220 httpd: URL normalization inconsistency
  • BZ - 1724549 - httpd response contains garbage in Content-Type header
  • BZ - 1730721 - absolute path used for default state and runtime dir by default

Red Hat Enterprise Linux for x86_64 8

SRPM
httpd-2.4.37-16.module+el8.1.0+4134+e6bad0ed.src.rpm SHA-256: 6e1b7fdbbe1ed4b3fb5175fddea41dce462fcc13f828f77049b544cdeb1386dc
mod_http2-1.11.3-3.module+el8.1.0+4134+e6bad0ed.src.rpm SHA-256: cac9a1c1638bf2bc58c78f72bcb203fe042e5c82bbabf6fa96f0020ffd938af5
x86_64
httpd-filesystem-2.4.37-16.module+el8.1.0+4134+e6bad0ed.noarch.rpm SHA-256: c555d6582b8db6cfaeaa6c8b3584d82af6ce749b3a090bcce44d0326135cf40e
httpd-manual-2.4.37-16.module+el8.1.0+4134+e6bad0ed.noarch.rpm SHA-256: 7ceebe6e146b9fbb845df0df32d4d8fcc5b938ea661e7170f851fc816a2df872
httpd-2.4.37-16.module+el8.1.0+4134+e6bad0ed.x86_64.rpm SHA-256: f8c8d7e4909d56d61afddb274fb39892fdb6cc497cc3fdfb9b0a733befb38bbb
httpd-debuginfo-2.4.37-16.module+el8.1.0+4134+e6bad0ed.x86_64.rpm SHA-256: a5113550bb9f8002d0a87581108311fcab26b61641e8c896d4d3f5aa53bc7787
httpd-debugsource-2.4.37-16.module+el8.1.0+4134+e6bad0ed.x86_64.rpm SHA-256: 7e822d3ca2cfd79fc82169638c9882ae8d675f8ae51ddb0d9bcdee8e147ff5c5
httpd-devel-2.4.37-16.module+el8.1.0+4134+e6bad0ed.x86_64.rpm SHA-256: 76a1de3d86b405f11028663dd40f55745de0765461c240273ca04c34bb800e3f
httpd-tools-2.4.37-16.module+el8.1.0+4134+e6bad0ed.x86_64.rpm SHA-256: 6904261fef41f0cd23a5e2a72beebb6ffe93c039bbca067c5224bf4b89c45bd8
httpd-tools-debuginfo-2.4.37-16.module+el8.1.0+4134+e6bad0ed.x86_64.rpm SHA-256: 496d91b0de26ba9462509222cfbca68b58038591a1d4f054c4d379279d6195d2
mod_http2-1.11.3-3.module+el8.1.0+4134+e6bad0ed.x86_64.rpm SHA-256: c294c98597e5b1df5fb1c261dc8271b41e846a6d4d6c6a65076c45011f58e55e
mod_http2-debuginfo-1.11.3-3.module+el8.1.0+4134+e6bad0ed.x86_64.rpm SHA-256: 607ad16a6090c773e93c3e67cb65825f8e99fb600482fcc7149eed2572eabedb
mod_http2-debugsource-1.11.3-3.module+el8.1.0+4134+e6bad0ed.x86_64.rpm SHA-256: 1f9b84f9d14dd6cee62fb1442d69819adf426dd9754b8a31754011cfdd575318
mod_ldap-2.4.37-16.module+el8.1.0+4134+e6bad0ed.x86_64.rpm SHA-256: 5904d5c1054d6b7dcb87c8c8e7a6dac418e07dec0052728343fdd5b41fe395f1
mod_ldap-debuginfo-2.4.37-16.module+el8.1.0+4134+e6bad0ed.x86_64.rpm SHA-256: 759313e586a6759ce464e61f0a87c658da363c970e46bed2e2ad11a82f9aebad
mod_md-2.4.37-16.module+el8.1.0+4134+e6bad0ed.x86_64.rpm SHA-256: 6f61889955e5ee1ef0d02592002b928bd1dd873b79cd15bc15840a0fc233b4c9
mod_md-debuginfo-2.4.37-16.module+el8.1.0+4134+e6bad0ed.x86_64.rpm SHA-256: 5de575efd6ebb6f11f83d98a377b7767927e6abb43d7ff01c05c619da262a45c
mod_proxy_html-2.4.37-16.module+el8.1.0+4134+e6bad0ed.x86_64.rpm SHA-256: 7f1cb5b65719d321a32e73d1024d36d517251203eb7674eb72ab48c52edff9bc
mod_proxy_html-debuginfo-2.4.37-16.module+el8.1.0+4134+e6bad0ed.x86_64.rpm SHA-256: db88aa3edcc47ef85e0cf3b960d2453a7912d2513a9f31bcaa9bf535b68ff8e7
mod_session-2.4.37-16.module+el8.1.0+4134+e6bad0ed.x86_64.rpm SHA-256: 450844d1243c5618a2629f5c20e88593d43466016bd5aea5f11e5450768fdcb3
mod_session-debuginfo-2.4.37-16.module+el8.1.0+4134+e6bad0ed.x86_64.rpm SHA-256: 8f2bbb98ce30db43f2d0dd3d83d3173c8a29d310551c502b3362532ee1ee78c8
mod_ssl-2.4.37-16.module+el8.1.0+4134+e6bad0ed.x86_64.rpm SHA-256: 4b3133fa90348dc061d24ceb2657de309a9adcecd48312d6cb0d3ea078f6bc5c
mod_ssl-debuginfo-2.4.37-16.module+el8.1.0+4134+e6bad0ed.x86_64.rpm SHA-256: 66c36659c5da80380193889773eb938e6fc6d65ae6ae6972949d397ad89e25f8

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
httpd-2.4.37-16.module+el8.1.0+4134+e6bad0ed.src.rpm SHA-256: 6e1b7fdbbe1ed4b3fb5175fddea41dce462fcc13f828f77049b544cdeb1386dc
mod_http2-1.11.3-3.module+el8.1.0+4134+e6bad0ed.src.rpm SHA-256: cac9a1c1638bf2bc58c78f72bcb203fe042e5c82bbabf6fa96f0020ffd938af5
s390x
httpd-2.4.37-16.module+el8.1.0+4134+e6bad0ed.s390x.rpm SHA-256: 179f2dc81c6f6db75c9189d30b2f3be87ed3451422b7892e6cd42925680c22c9
httpd-debuginfo-2.4.37-16.module+el8.1.0+4134+e6bad0ed.s390x.rpm SHA-256: 8b4e1d5ba01d9f799603a5cfa9957a97e1ef92dffbdd6e2a10f10f19cf36a8f5
httpd-debugsource-2.4.37-16.module+el8.1.0+4134+e6bad0ed.s390x.rpm SHA-256: c97eb46e0d51bddcef843ca1145fb4628394dad2cdbc33c001ea3d6f4cc7299c
httpd-devel-2.4.37-16.module+el8.1.0+4134+e6bad0ed.s390x.rpm SHA-256: 4dce7efa6286be9246003f23fbe8708d7987265552317fc6eef53f5bc0c884a6
httpd-filesystem-2.4.37-16.module+el8.1.0+4134+e6bad0ed.noarch.rpm SHA-256: c555d6582b8db6cfaeaa6c8b3584d82af6ce749b3a090bcce44d0326135cf40e
httpd-manual-2.4.37-16.module+el8.1.0+4134+e6bad0ed.noarch.rpm SHA-256: 7ceebe6e146b9fbb845df0df32d4d8fcc5b938ea661e7170f851fc816a2df872
httpd-tools-2.4.37-16.module+el8.1.0+4134+e6bad0ed.s390x.rpm SHA-256: 510e7e3511dda5653b24c26ea90887a43d18159e7db230654f97748741c98d30
httpd-tools-debuginfo-2.4.37-16.module+el8.1.0+4134+e6bad0ed.s390x.rpm SHA-256: 238905357a7c755cf773741193316002fa19f14b87e9b562550d4473e9588889
mod_http2-1.11.3-3.module+el8.1.0+4134+e6bad0ed.s390x.rpm SHA-256: a65e7d90c6cb4b2d3e989578b51ffeff1f8368652355d7c50347c82c2d7f55ae
mod_http2-debuginfo-1.11.3-3.module+el8.1.0+4134+e6bad0ed.s390x.rpm SHA-256: 08d5e90a7ff146f9c8f1fa54e3c69b74e427882b50fa4a497cdc9cdccd46f423
mod_http2-debugsource-1.11.3-3.module+el8.1.0+4134+e6bad0ed.s390x.rpm SHA-256: c7266098e2da5e2d7507d33dc9309c54b224aa7d50ad11fe313108eec3e6bff3
mod_ldap-2.4.37-16.module+el8.1.0+4134+e6bad0ed.s390x.rpm SHA-256: 2becdf9926e0e33394f91c6d6fd0f3fbe45e98c48c4e2097204c068e872b6247
mod_ldap-debuginfo-2.4.37-16.module+el8.1.0+4134+e6bad0ed.s390x.rpm SHA-256: 220e8bde9b5f123ba70ae705f204d3964deca88b09bad799ca192617e64ee9c7
mod_md-2.4.37-16.module+el8.1.0+4134+e6bad0ed.s390x.rpm SHA-256: 0fd32f77e403bff87b64f4769a93fa2418d3b437e61e97aef0567cbe61cc2386
mod_md-debuginfo-2.4.37-16.module+el8.1.0+4134+e6bad0ed.s390x.rpm SHA-256: 99b0a4d4de4c9ec623addf08343b71248206315e03279b8999ec38467441b176
mod_proxy_html-2.4.37-16.module+el8.1.0+4134+e6bad0ed.s390x.rpm SHA-256: 53c0f088045a7d5570afb1389f9ff41e603fe50080c25a72de7a5f73534ce28f
mod_proxy_html-debuginfo-2.4.37-16.module+el8.1.0+4134+e6bad0ed.s390x.rpm SHA-256: 8d93b0c347f26493936857bfa53a18eee6f0405d99a95f17358325c5068b4573
mod_session-2.4.37-16.module+el8.1.0+4134+e6bad0ed.s390x.rpm SHA-256: d0ab8a3610ecfa39270a49500aaf42884eb7283ed8f86c075319fa535410638c
mod_session-debuginfo-2.4.37-16.module+el8.1.0+4134+e6bad0ed.s390x.rpm SHA-256: e242efcbb4074959284b2e66599b0b30378102a4acb53630c652559be17a906e
mod_ssl-2.4.37-16.module+el8.1.0+4134+e6bad0ed.s390x.rpm SHA-256: d30464c5eb10852433202009515043da90b9034fb4bf1f88b28e9aefbbb05512
mod_ssl-debuginfo-2.4.37-16.module+el8.1.0+4134+e6bad0ed.s390x.rpm SHA-256: f4a005ff7f5ddb2ea4665a24dff23e923e0870b3cb7b634784c454cf6316318d

Red Hat Enterprise Linux for Power, little endian 8

SRPM
httpd-2.4.37-16.module+el8.1.0+4134+e6bad0ed.src.rpm SHA-256: 6e1b7fdbbe1ed4b3fb5175fddea41dce462fcc13f828f77049b544cdeb1386dc
mod_http2-1.11.3-3.module+el8.1.0+4134+e6bad0ed.src.rpm SHA-256: cac9a1c1638bf2bc58c78f72bcb203fe042e5c82bbabf6fa96f0020ffd938af5
ppc64le
httpd-filesystem-2.4.37-16.module+el8.1.0+4134+e6bad0ed.noarch.rpm SHA-256: c555d6582b8db6cfaeaa6c8b3584d82af6ce749b3a090bcce44d0326135cf40e
httpd-manual-2.4.37-16.module+el8.1.0+4134+e6bad0ed.noarch.rpm SHA-256: 7ceebe6e146b9fbb845df0df32d4d8fcc5b938ea661e7170f851fc816a2df872
httpd-2.4.37-16.module+el8.1.0+4134+e6bad0ed.ppc64le.rpm SHA-256: 118cdcbab4382136267bac8baf1fd79132fd36f7b07f27c7192679f77fc45d95
httpd-debuginfo-2.4.37-16.module+el8.1.0+4134+e6bad0ed.ppc64le.rpm SHA-256: bd5922efd121e84b8929bb647349f1bd94a8292ddbe2b72e305e5f32ab6d8278
httpd-debugsource-2.4.37-16.module+el8.1.0+4134+e6bad0ed.ppc64le.rpm SHA-256: 4dacd4c3b53e47d2e922afd72d49e6a702231c3e02ee7eb5c8309fb7cfb16206
httpd-devel-2.4.37-16.module+el8.1.0+4134+e6bad0ed.ppc64le.rpm SHA-256: d1e55d4ea0d045058a4816a1ce0a7b28b64a07da61188bec152ae90c7b6d17e6
httpd-tools-2.4.37-16.module+el8.1.0+4134+e6bad0ed.ppc64le.rpm SHA-256: d9b4cf591891935f21f825886ebadf7017893a2e0db3b4e7d6c137c870e7e6cb
httpd-tools-debuginfo-2.4.37-16.module+el8.1.0+4134+e6bad0ed.ppc64le.rpm SHA-256: 31b28d9117e5f729b4c0b8401a8831061fb5059cd3dfd257b93721274e5856a8
mod_http2-1.11.3-3.module+el8.1.0+4134+e6bad0ed.ppc64le.rpm SHA-256: 69dc59a6a90174a1cb87ff303eddeb46a88e4cf1200a70dbffdcd0efe9dd28d5
mod_http2-debuginfo-1.11.3-3.module+el8.1.0+4134+e6bad0ed.ppc64le.rpm SHA-256: 09fce36cd3d124256dd1f7e040d8c6b9628ac103a8335f472d3a310a4a3c8c9b
mod_http2-debugsource-1.11.3-3.module+el8.1.0+4134+e6bad0ed.ppc64le.rpm SHA-256: d5196f7c3b9b1ce72bad511cc4cd0b745f443ccf0b53251455d976fb5f6fd75b
mod_ldap-2.4.37-16.module+el8.1.0+4134+e6bad0ed.ppc64le.rpm SHA-256: 789aa4c597f9c38b4958b4ecd9d3dabad19083b0ff5a4f5a2d6357a334378d85
mod_ldap-debuginfo-2.4.37-16.module+el8.1.0+4134+e6bad0ed.ppc64le.rpm SHA-256: d875219d24c21be4c1839f9edabbb29f889b48d9f7bc3139a1a99d7e35ce68be
mod_md-2.4.37-16.module+el8.1.0+4134+e6bad0ed.ppc64le.rpm SHA-256: d0d9257291c46d8e6923e0e333527248faa1ada437892a548f10749160a40035
mod_md-debuginfo-2.4.37-16.module+el8.1.0+4134+e6bad0ed.ppc64le.rpm SHA-256: b9598b1ae8c68f2892974b1c34b990b9ca5c0e9c77712fab2491f94f8d8f5364
mod_proxy_html-2.4.37-16.module+el8.1.0+4134+e6bad0ed.ppc64le.rpm SHA-256: 276373cf17221b55361e7c5537e2c03b96f68bbfe8c3aa54752cdf17fb010036
mod_proxy_html-debuginfo-2.4.37-16.module+el8.1.0+4134+e6bad0ed.ppc64le.rpm SHA-256: d3b31b13c437c9b27a15bf2cbad99f4287a979a773f5ea1ff374a58c2feb343e
mod_session-2.4.37-16.module+el8.1.0+4134+e6bad0ed.ppc64le.rpm SHA-256: be22c74c8ca3c499777a01312d754193a55a79f0aa08dc00b44fa49a00ce8d8c
mod_session-debuginfo-2.4.37-16.module+el8.1.0+4134+e6bad0ed.ppc64le.rpm SHA-256: d3f8b4722527f939244a54d7eb848bcbd88a490d2579ac7776386c98a2a706c5
mod_ssl-2.4.37-16.module+el8.1.0+4134+e6bad0ed.ppc64le.rpm SHA-256: ddc3ac472b256acdc4f11d4db015d1ce231990d2500ee03aedebc4c400a6ddf0
mod_ssl-debuginfo-2.4.37-16.module+el8.1.0+4134+e6bad0ed.ppc64le.rpm SHA-256: a4ca0001e92fb0cc51178c2726dc121f73ff40ad8091488d176883b566d97209

Red Hat Enterprise Linux for ARM 64 8

SRPM
httpd-2.4.37-16.module+el8.1.0+4134+e6bad0ed.src.rpm SHA-256: 6e1b7fdbbe1ed4b3fb5175fddea41dce462fcc13f828f77049b544cdeb1386dc
mod_http2-1.11.3-3.module+el8.1.0+4134+e6bad0ed.src.rpm SHA-256: cac9a1c1638bf2bc58c78f72bcb203fe042e5c82bbabf6fa96f0020ffd938af5
aarch64
httpd-filesystem-2.4.37-16.module+el8.1.0+4134+e6bad0ed.noarch.rpm SHA-256: c555d6582b8db6cfaeaa6c8b3584d82af6ce749b3a090bcce44d0326135cf40e
httpd-manual-2.4.37-16.module+el8.1.0+4134+e6bad0ed.noarch.rpm SHA-256: 7ceebe6e146b9fbb845df0df32d4d8fcc5b938ea661e7170f851fc816a2df872
httpd-2.4.37-16.module+el8.1.0+4134+e6bad0ed.aarch64.rpm SHA-256: c6a0d526d255cb5f820c021957adbb7448f8261b69b0c191808637c99ff5996e
httpd-debuginfo-2.4.37-16.module+el8.1.0+4134+e6bad0ed.aarch64.rpm SHA-256: c373cf34711786b521132a63b79984e7477c51dc9b99d7cf767cebbbff5d6191
httpd-debugsource-2.4.37-16.module+el8.1.0+4134+e6bad0ed.aarch64.rpm SHA-256: bbedc6c1944e3ecdd0fe20d2fcaff1b98f8c9f4b18073aba6f67cb37a1f3d8e3
httpd-devel-2.4.37-16.module+el8.1.0+4134+e6bad0ed.aarch64.rpm SHA-256: 72d7b934ee348239a922efe32d64b224aad0f4f163a0b73d797b2ce9e288c31b
httpd-tools-2.4.37-16.module+el8.1.0+4134+e6bad0ed.aarch64.rpm SHA-256: c4e30f8854db8cbc94e1911c64c0478ea9d83777f8ca3da30671b4ddc07c6c46
httpd-tools-debuginfo-2.4.37-16.module+el8.1.0+4134+e6bad0ed.aarch64.rpm SHA-256: cdc90868bda222cc8f18c5e238d944e5946269f400a4f739a5af2ac6699d9dc7
mod_http2-1.11.3-3.module+el8.1.0+4134+e6bad0ed.aarch64.rpm SHA-256: 4df6b4ce4b29caa696b4fd5b86b4d52f82e178bb2360e19606a4ac592d01f482
mod_http2-debuginfo-1.11.3-3.module+el8.1.0+4134+e6bad0ed.aarch64.rpm SHA-256: f7ed3445cf83d4964daae21d79e6536768a1c1035aa942e47e2365250a7eaf4d
mod_http2-debugsource-1.11.3-3.module+el8.1.0+4134+e6bad0ed.aarch64.rpm SHA-256: 14759a32ab33199910e348b3fd0696e1e0abf881846080ed0d74b47d501b4e81
mod_ldap-2.4.37-16.module+el8.1.0+4134+e6bad0ed.aarch64.rpm SHA-256: 92e55d009edec45a2f496aafbd61e75afacb1b4cc65c55d858404b699264d3f3
mod_ldap-debuginfo-2.4.37-16.module+el8.1.0+4134+e6bad0ed.aarch64.rpm SHA-256: 51ac18e6bb62db4f4c77c7ef7aaba33d995ce3c80f6db622da6b69b80114abb9
mod_md-2.4.37-16.module+el8.1.0+4134+e6bad0ed.aarch64.rpm SHA-256: bbb6dc37ad4db470c1d06bf9681894ca63d8d3147f1e0951455568e18fe4c800
mod_md-debuginfo-2.4.37-16.module+el8.1.0+4134+e6bad0ed.aarch64.rpm SHA-256: 5e04eb4b937cf149f7f7ad020181a6fdc282a79dc9f14db9e5da03ca09a82186
mod_proxy_html-2.4.37-16.module+el8.1.0+4134+e6bad0ed.aarch64.rpm SHA-256: ea254651665f5feb55f67e9c87a18d17f731b35a7363b271f9e9b07577ddf0f4
mod_proxy_html-debuginfo-2.4.37-16.module+el8.1.0+4134+e6bad0ed.aarch64.rpm SHA-256: d86086a87c1eca2c045c4250ab7aa235052a615900ce48c4cc15fa8273d7b025
mod_session-2.4.37-16.module+el8.1.0+4134+e6bad0ed.aarch64.rpm SHA-256: e3eb04a38062b5039627de2f3e774edcde6454fd93e0f062753f3e19b5e8e6ce
mod_session-debuginfo-2.4.37-16.module+el8.1.0+4134+e6bad0ed.aarch64.rpm SHA-256: f7bc15d7dff7fd292336bbeb08f87d760a44e4558b378aa4e36e9d6fb59baafa
mod_ssl-2.4.37-16.module+el8.1.0+4134+e6bad0ed.aarch64.rpm SHA-256: 6a14e5a9c3f557fe14b84475d57311be6b0b0c3461aca8cb45b2c5b4b201ed6a
mod_ssl-debuginfo-2.4.37-16.module+el8.1.0+4134+e6bad0ed.aarch64.rpm SHA-256: 3530a77470eaadf26992f3c520b37126e319d1c54e3b0988eab2a2b4285a3171

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.