Synopsis

Important: httpd:2.4 security update

Type/Severity

Security Advisory: Important

Topic

An update for the httpd:2.4 module is now available for Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

• httpd: Push diary crash on specifically crafted HTTP/2 header (CVE-2020-9490)
  

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon will be restarted automatically.

Affected Products

• Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 8.0 ppc64le
• Red Hat Enterprise Linux Server - Update Services for SAP Solutions 8.0 x86_64

Fixes

• BZ - 1866560 - CVE-2020-9490 httpd: Push diary crash on specifically crafted HTTP/2 header

CVEs

• CVE-2020-9490

References

• https://access.redhat.com/security/updates/classification/#important

Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 8.0

SRPM
httpd-2.4.37-12.module+el8.0.0+4096+eb40e6da.src.rpm	SHA-256: b5bee6c08a36abf29b13c1cf173665e8ca0129ffc26f76c23c6256aca802d071
mod_http2-1.11.3-3.module+el8.0.0+7808+f6c0e84d.1.src.rpm	SHA-256: 0a833075857855562b479602dc8279cceed460e4143a3f586e58b2d88477feab
ppc64le
httpd-filesystem-2.4.37-12.module+el8.0.0+4096+eb40e6da.noarch.rpm	SHA-256: 6be202e6c2337c15310d3b93e46d7f23aaff148e09b2da5ef5f79a8963f323f6
httpd-manual-2.4.37-12.module+el8.0.0+4096+eb40e6da.noarch.rpm	SHA-256: f9ef71f5547db0030d0559ad475b1940501aa860d29ef2327456e69833d72cf8
httpd-2.4.37-12.module+el8.0.0+4096+eb40e6da.ppc64le.rpm	SHA-256: 728485980bb7d2ce2eadbb576aee7d604810c5b9023eb6a447376a9fee0b93a2
httpd-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.ppc64le.rpm	SHA-256: bfbaabb95d8584af88700aad4d2bd5e553eef1f3aab425e7ea3a521609c10016
httpd-debugsource-2.4.37-12.module+el8.0.0+4096+eb40e6da.ppc64le.rpm	SHA-256: 209084da6f1aa8f820401e4b9c713e0ddf89b92ec9afaee6b638c787bed0c137
httpd-devel-2.4.37-12.module+el8.0.0+4096+eb40e6da.ppc64le.rpm	SHA-256: 7e4f5d3ab3792e7a353718b135acb943ced3a3cd6c248dd8b48152619e2cab0b
httpd-tools-2.4.37-12.module+el8.0.0+4096+eb40e6da.ppc64le.rpm	SHA-256: 07f0a20e2b15d1d6ef610cb0c450e066f68ee4fbc970338665471b1b1ec71a93
httpd-tools-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.ppc64le.rpm	SHA-256: 2f1fc145b8ed16b590f40db4e3ebf48f101ed2e7de80c7ef15d5113f3dfc84a0
mod_http2-1.11.3-3.module+el8.0.0+7808+f6c0e84d.1.ppc64le.rpm	SHA-256: 9e307fcf09034b626629b7cbac67c88fc7f55b7b3f8d4a263d3c98f0601962c1
mod_http2-debuginfo-1.11.3-3.module+el8.0.0+7808+f6c0e84d.1.ppc64le.rpm	SHA-256: b56894566c9d972749386d2743cb6f013579919c12a3164622a7234c1102b963
mod_http2-debugsource-1.11.3-3.module+el8.0.0+7808+f6c0e84d.1.ppc64le.rpm	SHA-256: 296d645831491086bc866471b781c6979a4d3d5937d9850c918ca229ac1358e6
mod_ldap-2.4.37-12.module+el8.0.0+4096+eb40e6da.ppc64le.rpm	SHA-256: af82df4902a7f33f9e7725598ae54b9a964cff7880acfa61e0a422380a837494
mod_ldap-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.ppc64le.rpm	SHA-256: d6ff7cce26110fb1a42fd7cdbb035a4c42538f8c2ccdf7d710f4ecaa3d1fd7f4
mod_md-2.4.37-12.module+el8.0.0+4096+eb40e6da.ppc64le.rpm	SHA-256: 91466cd97ebbb10d279c15b843323c5a1df9e584a238e6e62fe914f5e91b62e2
mod_md-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.ppc64le.rpm	SHA-256: 460d92b0a84dc39e3d426646b47cb2c32f06b260875df7e4fd7b06df5bc73dba
mod_proxy_html-2.4.37-12.module+el8.0.0+4096+eb40e6da.ppc64le.rpm	SHA-256: b3bcb8cfbcbc2d4bd813f922a14443fc54f5c36c2a1f188282c552832bd1f32e
mod_proxy_html-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.ppc64le.rpm	SHA-256: ef38e56ab375a3cae3d2bb5afbb40037b6d80ea6c0cf99d7cae44cc675998ca4
mod_session-2.4.37-12.module+el8.0.0+4096+eb40e6da.ppc64le.rpm	SHA-256: a12f42a086fca908791234fbda97008e44cf4a90c5d3a78a58e509ec07b9ff6c
mod_session-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.ppc64le.rpm	SHA-256: 0948833c0f256f0329f3ecafa5aa4486df64c8e42bc82194c6b78241310e4cc5
mod_ssl-2.4.37-12.module+el8.0.0+4096+eb40e6da.ppc64le.rpm	SHA-256: cb6718a8853842cabb2b844539becc9ce742d59039b27ba3eb499925ff349195
mod_ssl-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.ppc64le.rpm	SHA-256: 44f159cead926925219294684b970bab19087c7c21f5018cef74765de0e42760

Red Hat Enterprise Linux Server - Update Services for SAP Solutions 8.0

SRPM
httpd-2.4.37-12.module+el8.0.0+4096+eb40e6da.src.rpm	SHA-256: b5bee6c08a36abf29b13c1cf173665e8ca0129ffc26f76c23c6256aca802d071
mod_http2-1.11.3-3.module+el8.0.0+7808+f6c0e84d.1.src.rpm	SHA-256: 0a833075857855562b479602dc8279cceed460e4143a3f586e58b2d88477feab
x86_64
httpd-2.4.37-12.module+el8.0.0+4096+eb40e6da.x86_64.rpm	SHA-256: c71964aa835ff68d73f5e051f1c57a02892fa8a943093a18b8bda630c6915c44
httpd-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.x86_64.rpm	SHA-256: e5c582a0e343af04fbc4865cff762e08da39de204f1df6b0dd5c7df6c0a4bcb9
httpd-debugsource-2.4.37-12.module+el8.0.0+4096+eb40e6da.x86_64.rpm	SHA-256: 689516dcbdd65ae8ddbbca4b826af5c97f13df2388eadbda1e328a31918cfdb4
httpd-devel-2.4.37-12.module+el8.0.0+4096+eb40e6da.x86_64.rpm	SHA-256: ae68a34c749e02bb9834255404da2b91f2a0ed8673d9fa76f8bd4476103cf975
httpd-filesystem-2.4.37-12.module+el8.0.0+4096+eb40e6da.noarch.rpm	SHA-256: 6be202e6c2337c15310d3b93e46d7f23aaff148e09b2da5ef5f79a8963f323f6
httpd-manual-2.4.37-12.module+el8.0.0+4096+eb40e6da.noarch.rpm	SHA-256: f9ef71f5547db0030d0559ad475b1940501aa860d29ef2327456e69833d72cf8
httpd-tools-2.4.37-12.module+el8.0.0+4096+eb40e6da.x86_64.rpm	SHA-256: 3aa3645beaa60ab6e4bc7def1b09bf69b4cdd0df93f5c96a6b6867299691dcad
httpd-tools-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.x86_64.rpm	SHA-256: 19ddacd72dd01ec4254dae22c46e93ba93bdf882d6a3d52b5c929d4e8dae9a9b
mod_http2-1.11.3-3.module+el8.0.0+7808+f6c0e84d.1.x86_64.rpm	SHA-256: 3e8a915687b57feaf6578a2f8cb633b457a66fcda7466dc1085d2e3236c426aa
mod_http2-debuginfo-1.11.3-3.module+el8.0.0+7808+f6c0e84d.1.x86_64.rpm	SHA-256: af7524ded0cdbf786d54a866f2beb754bd21cf2aed5379ad6930bf8431377330
mod_http2-debugsource-1.11.3-3.module+el8.0.0+7808+f6c0e84d.1.x86_64.rpm	SHA-256: 5a90be366bb1d6440951bf765ba2304e1e6bc1c1dcf0f75824dab000b4b26e61
mod_ldap-2.4.37-12.module+el8.0.0+4096+eb40e6da.x86_64.rpm	SHA-256: 3d65bbe5c8f5e2341a4b93d73414ddb515e43d38cb91a55b846cb18c0d31744c
mod_ldap-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.x86_64.rpm	SHA-256: bb9ffb8e47fb2b6964899814e549cff2cc0d26f5e196405baee53a301b819379
mod_md-2.4.37-12.module+el8.0.0+4096+eb40e6da.x86_64.rpm	SHA-256: 49e2195d02fe300b1cf4d412c77924a7de25714cb5f28dd3c57f410a0fd21313
mod_md-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.x86_64.rpm	SHA-256: 44aa174b3f845cfa801f9baf396b26768d4ecca88f81d6f74b9fbfe97f2651bd
mod_proxy_html-2.4.37-12.module+el8.0.0+4096+eb40e6da.x86_64.rpm	SHA-256: 80d452fd6817b7ebb1827ffca507529a2cb5a88d9a0d102c0ed59c2650b9d160
mod_proxy_html-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.x86_64.rpm	SHA-256: 8d7411dfbcc49443e91d79a54a632c775c4e863e47a9dcc6dda9f3ff1120cf5b
mod_session-2.4.37-12.module+el8.0.0+4096+eb40e6da.x86_64.rpm	SHA-256: db044ef3796809af7cc870be75d7b02ad9a5f9730c0adcfa6ba91845da18535c
mod_session-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.x86_64.rpm	SHA-256: 2dad6c18705b9ea1fa71b4435d85c68ccd325b71ebe4c91cdc48ad547bb7d5f3
mod_ssl-2.4.37-12.module+el8.0.0+4096+eb40e6da.x86_64.rpm	SHA-256: aef4721c76fc55c853f63d4862994c491a9d333b5070d8ab5960356b83938e09
mod_ssl-debuginfo-2.4.37-12.module+el8.0.0+4096+eb40e6da.x86_64.rpm	SHA-256: 09334dc4b39bea1e793e3ec616153c9c2ab355c9999dfe1d407f23decae32638