Red Hat Product Errata RHSA-2024:1872 - Security Advisory
Issued:
2024-04-18
Updated:
2024-04-18

RHSA-2024:1872 - Security Advisory

Synopsis

Important: mod_http2 security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for mod_http2 is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers.

Security Fix(es):

  • httpd: CONTINUATION frames DoS (CVE-2024-27316)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 9 x86_64
  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 x86_64
  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.4 x86_64
  • Red Hat Enterprise Linux Server - AUS 9.6 x86_64
  • Red Hat Enterprise Linux Server - AUS 9.4 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 9 s390x
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6 s390x
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.4 s390x
  • Red Hat Enterprise Linux for Power, little endian 9 ppc64le
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6 ppc64le
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.4 ppc64le
  • Red Hat Enterprise Linux for ARM 64 9 aarch64
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6 aarch64
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.4 aarch64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6 ppc64le
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6 x86_64
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 x86_64
  • Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6 aarch64
  • Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 aarch64
  • Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6 s390x
  • Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 s390x

Fixes

  • BZ - 2268277 - CVE-2024-27316 httpd: CONTINUATION frames DoS

Red Hat Enterprise Linux for x86_64 9

SRPM
mod_http2-1.15.19-5.el9_3.1.src.rpm SHA-256: 9e2e7d021b97177da4b76649ac9f233acdf566a8806f1715ea34d8e2b2448c6f
x86_64
mod_http2-1.15.19-5.el9_3.1.x86_64.rpm SHA-256: 8fb7eeec5a6b862b4f3280b76ef311d2c1e8002c5f5cde3737fbc0c7bd5531eb
mod_http2-debuginfo-1.15.19-5.el9_3.1.x86_64.rpm SHA-256: 436638f0fd6c3f0342b81cc0f666dbc91f261227c864d3b91d7ff4854e0b570c
mod_http2-debugsource-1.15.19-5.el9_3.1.x86_64.rpm SHA-256: e7e090a4cacf4c1dbee10de6c3dabec38694203c062b801451655c1f6c17c37d

Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6

SRPM
mod_http2-1.15.19-5.el9_3.1.src.rpm SHA-256: 9e2e7d021b97177da4b76649ac9f233acdf566a8806f1715ea34d8e2b2448c6f
x86_64
mod_http2-1.15.19-5.el9_3.1.x86_64.rpm SHA-256: 8fb7eeec5a6b862b4f3280b76ef311d2c1e8002c5f5cde3737fbc0c7bd5531eb
mod_http2-debuginfo-1.15.19-5.el9_3.1.x86_64.rpm SHA-256: 436638f0fd6c3f0342b81cc0f666dbc91f261227c864d3b91d7ff4854e0b570c
mod_http2-debugsource-1.15.19-5.el9_3.1.x86_64.rpm SHA-256: e7e090a4cacf4c1dbee10de6c3dabec38694203c062b801451655c1f6c17c37d

Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.4

SRPM
mod_http2-1.15.19-5.el9_3.1.src.rpm SHA-256: 9e2e7d021b97177da4b76649ac9f233acdf566a8806f1715ea34d8e2b2448c6f
x86_64
mod_http2-1.15.19-5.el9_3.1.x86_64.rpm SHA-256: 8fb7eeec5a6b862b4f3280b76ef311d2c1e8002c5f5cde3737fbc0c7bd5531eb
mod_http2-debuginfo-1.15.19-5.el9_3.1.x86_64.rpm SHA-256: 436638f0fd6c3f0342b81cc0f666dbc91f261227c864d3b91d7ff4854e0b570c
mod_http2-debugsource-1.15.19-5.el9_3.1.x86_64.rpm SHA-256: e7e090a4cacf4c1dbee10de6c3dabec38694203c062b801451655c1f6c17c37d

Red Hat Enterprise Linux Server - AUS 9.6

SRPM
mod_http2-1.15.19-5.el9_3.1.src.rpm SHA-256: 9e2e7d021b97177da4b76649ac9f233acdf566a8806f1715ea34d8e2b2448c6f
x86_64
mod_http2-1.15.19-5.el9_3.1.x86_64.rpm SHA-256: 8fb7eeec5a6b862b4f3280b76ef311d2c1e8002c5f5cde3737fbc0c7bd5531eb
mod_http2-debuginfo-1.15.19-5.el9_3.1.x86_64.rpm SHA-256: 436638f0fd6c3f0342b81cc0f666dbc91f261227c864d3b91d7ff4854e0b570c
mod_http2-debugsource-1.15.19-5.el9_3.1.x86_64.rpm SHA-256: e7e090a4cacf4c1dbee10de6c3dabec38694203c062b801451655c1f6c17c37d

Red Hat Enterprise Linux Server - AUS 9.4

SRPM
mod_http2-1.15.19-5.el9_3.1.src.rpm SHA-256: 9e2e7d021b97177da4b76649ac9f233acdf566a8806f1715ea34d8e2b2448c6f
x86_64
mod_http2-1.15.19-5.el9_3.1.x86_64.rpm SHA-256: 8fb7eeec5a6b862b4f3280b76ef311d2c1e8002c5f5cde3737fbc0c7bd5531eb
mod_http2-debuginfo-1.15.19-5.el9_3.1.x86_64.rpm SHA-256: 436638f0fd6c3f0342b81cc0f666dbc91f261227c864d3b91d7ff4854e0b570c
mod_http2-debugsource-1.15.19-5.el9_3.1.x86_64.rpm SHA-256: e7e090a4cacf4c1dbee10de6c3dabec38694203c062b801451655c1f6c17c37d

Red Hat Enterprise Linux for IBM z Systems 9

SRPM
mod_http2-1.15.19-5.el9_3.1.src.rpm SHA-256: 9e2e7d021b97177da4b76649ac9f233acdf566a8806f1715ea34d8e2b2448c6f
s390x
mod_http2-1.15.19-5.el9_3.1.s390x.rpm SHA-256: 960b55eb99fd9db4703d3adf1ed6451b43c03747b4bafd2737ae2112a0f847f6
mod_http2-debuginfo-1.15.19-5.el9_3.1.s390x.rpm SHA-256: fa6ca6b3ddf919b8d38ebd4ee691ea3e5bc4a8d9706d38c79913cbdc91270c32
mod_http2-debugsource-1.15.19-5.el9_3.1.s390x.rpm SHA-256: edfe9463074d412c0fe95e53fe15648cb53c8a7e77997eeee9144752118f7c89

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6

SRPM
mod_http2-1.15.19-5.el9_3.1.src.rpm SHA-256: 9e2e7d021b97177da4b76649ac9f233acdf566a8806f1715ea34d8e2b2448c6f
s390x
mod_http2-1.15.19-5.el9_3.1.s390x.rpm SHA-256: 960b55eb99fd9db4703d3adf1ed6451b43c03747b4bafd2737ae2112a0f847f6
mod_http2-debuginfo-1.15.19-5.el9_3.1.s390x.rpm SHA-256: fa6ca6b3ddf919b8d38ebd4ee691ea3e5bc4a8d9706d38c79913cbdc91270c32
mod_http2-debugsource-1.15.19-5.el9_3.1.s390x.rpm SHA-256: edfe9463074d412c0fe95e53fe15648cb53c8a7e77997eeee9144752118f7c89

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.4

SRPM
mod_http2-1.15.19-5.el9_3.1.src.rpm SHA-256: 9e2e7d021b97177da4b76649ac9f233acdf566a8806f1715ea34d8e2b2448c6f
s390x
mod_http2-1.15.19-5.el9_3.1.s390x.rpm SHA-256: 960b55eb99fd9db4703d3adf1ed6451b43c03747b4bafd2737ae2112a0f847f6
mod_http2-debuginfo-1.15.19-5.el9_3.1.s390x.rpm SHA-256: fa6ca6b3ddf919b8d38ebd4ee691ea3e5bc4a8d9706d38c79913cbdc91270c32
mod_http2-debugsource-1.15.19-5.el9_3.1.s390x.rpm SHA-256: edfe9463074d412c0fe95e53fe15648cb53c8a7e77997eeee9144752118f7c89

Red Hat Enterprise Linux for Power, little endian 9

SRPM
mod_http2-1.15.19-5.el9_3.1.src.rpm SHA-256: 9e2e7d021b97177da4b76649ac9f233acdf566a8806f1715ea34d8e2b2448c6f
ppc64le
mod_http2-1.15.19-5.el9_3.1.ppc64le.rpm SHA-256: c682ff6b59611fb5067ff1f63246b0a86b90cb68633a8088fc9590a940effc51
mod_http2-debuginfo-1.15.19-5.el9_3.1.ppc64le.rpm SHA-256: 23b3f9c48d777ad459aed65bc585bbd04e332300941a1baccf866347713fdc79
mod_http2-debugsource-1.15.19-5.el9_3.1.ppc64le.rpm SHA-256: 36c1bb87fbcee9c6faf9479c408fed3767a099587c953e8fb0e12fa4b0a30c66

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6

SRPM
mod_http2-1.15.19-5.el9_3.1.src.rpm SHA-256: 9e2e7d021b97177da4b76649ac9f233acdf566a8806f1715ea34d8e2b2448c6f
ppc64le
mod_http2-1.15.19-5.el9_3.1.ppc64le.rpm SHA-256: c682ff6b59611fb5067ff1f63246b0a86b90cb68633a8088fc9590a940effc51
mod_http2-debuginfo-1.15.19-5.el9_3.1.ppc64le.rpm SHA-256: 23b3f9c48d777ad459aed65bc585bbd04e332300941a1baccf866347713fdc79
mod_http2-debugsource-1.15.19-5.el9_3.1.ppc64le.rpm SHA-256: 36c1bb87fbcee9c6faf9479c408fed3767a099587c953e8fb0e12fa4b0a30c66

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.4

SRPM
mod_http2-1.15.19-5.el9_3.1.src.rpm SHA-256: 9e2e7d021b97177da4b76649ac9f233acdf566a8806f1715ea34d8e2b2448c6f
ppc64le
mod_http2-1.15.19-5.el9_3.1.ppc64le.rpm SHA-256: c682ff6b59611fb5067ff1f63246b0a86b90cb68633a8088fc9590a940effc51
mod_http2-debuginfo-1.15.19-5.el9_3.1.ppc64le.rpm SHA-256: 23b3f9c48d777ad459aed65bc585bbd04e332300941a1baccf866347713fdc79
mod_http2-debugsource-1.15.19-5.el9_3.1.ppc64le.rpm SHA-256: 36c1bb87fbcee9c6faf9479c408fed3767a099587c953e8fb0e12fa4b0a30c66

Red Hat Enterprise Linux for ARM 64 9

SRPM
mod_http2-1.15.19-5.el9_3.1.src.rpm SHA-256: 9e2e7d021b97177da4b76649ac9f233acdf566a8806f1715ea34d8e2b2448c6f
aarch64
mod_http2-1.15.19-5.el9_3.1.aarch64.rpm SHA-256: 2b549d7375177c82b8defcc55aa0baf64b36c55b3249ebb5ae8cfdc52b7ba0bd
mod_http2-debuginfo-1.15.19-5.el9_3.1.aarch64.rpm SHA-256: f7e4a6ff29c8bd35f24d7035483700e5d090e51de383cbf00f0fc09f0fe43e46
mod_http2-debugsource-1.15.19-5.el9_3.1.aarch64.rpm SHA-256: cfc2c808f380d42bad51906f652959cfe244583df009534bf6442dd2d35562f2

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6

SRPM
mod_http2-1.15.19-5.el9_3.1.src.rpm SHA-256: 9e2e7d021b97177da4b76649ac9f233acdf566a8806f1715ea34d8e2b2448c6f
aarch64
mod_http2-1.15.19-5.el9_3.1.aarch64.rpm SHA-256: 2b549d7375177c82b8defcc55aa0baf64b36c55b3249ebb5ae8cfdc52b7ba0bd
mod_http2-debuginfo-1.15.19-5.el9_3.1.aarch64.rpm SHA-256: f7e4a6ff29c8bd35f24d7035483700e5d090e51de383cbf00f0fc09f0fe43e46
mod_http2-debugsource-1.15.19-5.el9_3.1.aarch64.rpm SHA-256: cfc2c808f380d42bad51906f652959cfe244583df009534bf6442dd2d35562f2

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.4

SRPM
mod_http2-1.15.19-5.el9_3.1.src.rpm SHA-256: 9e2e7d021b97177da4b76649ac9f233acdf566a8806f1715ea34d8e2b2448c6f
aarch64
mod_http2-1.15.19-5.el9_3.1.aarch64.rpm SHA-256: 2b549d7375177c82b8defcc55aa0baf64b36c55b3249ebb5ae8cfdc52b7ba0bd
mod_http2-debuginfo-1.15.19-5.el9_3.1.aarch64.rpm SHA-256: f7e4a6ff29c8bd35f24d7035483700e5d090e51de383cbf00f0fc09f0fe43e46
mod_http2-debugsource-1.15.19-5.el9_3.1.aarch64.rpm SHA-256: cfc2c808f380d42bad51906f652959cfe244583df009534bf6442dd2d35562f2

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6

SRPM
mod_http2-1.15.19-5.el9_3.1.src.rpm SHA-256: 9e2e7d021b97177da4b76649ac9f233acdf566a8806f1715ea34d8e2b2448c6f
ppc64le
mod_http2-1.15.19-5.el9_3.1.ppc64le.rpm SHA-256: c682ff6b59611fb5067ff1f63246b0a86b90cb68633a8088fc9590a940effc51
mod_http2-debuginfo-1.15.19-5.el9_3.1.ppc64le.rpm SHA-256: 23b3f9c48d777ad459aed65bc585bbd04e332300941a1baccf866347713fdc79
mod_http2-debugsource-1.15.19-5.el9_3.1.ppc64le.rpm SHA-256: 36c1bb87fbcee9c6faf9479c408fed3767a099587c953e8fb0e12fa4b0a30c66

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4

SRPM
mod_http2-1.15.19-5.el9_3.1.src.rpm SHA-256: 9e2e7d021b97177da4b76649ac9f233acdf566a8806f1715ea34d8e2b2448c6f
ppc64le
mod_http2-1.15.19-5.el9_3.1.ppc64le.rpm SHA-256: c682ff6b59611fb5067ff1f63246b0a86b90cb68633a8088fc9590a940effc51
mod_http2-debuginfo-1.15.19-5.el9_3.1.ppc64le.rpm SHA-256: 23b3f9c48d777ad459aed65bc585bbd04e332300941a1baccf866347713fdc79
mod_http2-debugsource-1.15.19-5.el9_3.1.ppc64le.rpm SHA-256: 36c1bb87fbcee9c6faf9479c408fed3767a099587c953e8fb0e12fa4b0a30c66

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6

SRPM
mod_http2-1.15.19-5.el9_3.1.src.rpm SHA-256: 9e2e7d021b97177da4b76649ac9f233acdf566a8806f1715ea34d8e2b2448c6f
x86_64
mod_http2-1.15.19-5.el9_3.1.x86_64.rpm SHA-256: 8fb7eeec5a6b862b4f3280b76ef311d2c1e8002c5f5cde3737fbc0c7bd5531eb
mod_http2-debuginfo-1.15.19-5.el9_3.1.x86_64.rpm SHA-256: 436638f0fd6c3f0342b81cc0f666dbc91f261227c864d3b91d7ff4854e0b570c
mod_http2-debugsource-1.15.19-5.el9_3.1.x86_64.rpm SHA-256: e7e090a4cacf4c1dbee10de6c3dabec38694203c062b801451655c1f6c17c37d

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4

SRPM
mod_http2-1.15.19-5.el9_3.1.src.rpm SHA-256: 9e2e7d021b97177da4b76649ac9f233acdf566a8806f1715ea34d8e2b2448c6f
x86_64
mod_http2-1.15.19-5.el9_3.1.x86_64.rpm SHA-256: 8fb7eeec5a6b862b4f3280b76ef311d2c1e8002c5f5cde3737fbc0c7bd5531eb
mod_http2-debuginfo-1.15.19-5.el9_3.1.x86_64.rpm SHA-256: 436638f0fd6c3f0342b81cc0f666dbc91f261227c864d3b91d7ff4854e0b570c
mod_http2-debugsource-1.15.19-5.el9_3.1.x86_64.rpm SHA-256: e7e090a4cacf4c1dbee10de6c3dabec38694203c062b801451655c1f6c17c37d

Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6

SRPM
mod_http2-1.15.19-5.el9_3.1.src.rpm SHA-256: 9e2e7d021b97177da4b76649ac9f233acdf566a8806f1715ea34d8e2b2448c6f
aarch64
mod_http2-1.15.19-5.el9_3.1.aarch64.rpm SHA-256: 2b549d7375177c82b8defcc55aa0baf64b36c55b3249ebb5ae8cfdc52b7ba0bd
mod_http2-debuginfo-1.15.19-5.el9_3.1.aarch64.rpm SHA-256: f7e4a6ff29c8bd35f24d7035483700e5d090e51de383cbf00f0fc09f0fe43e46
mod_http2-debugsource-1.15.19-5.el9_3.1.aarch64.rpm SHA-256: cfc2c808f380d42bad51906f652959cfe244583df009534bf6442dd2d35562f2

Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4

SRPM
mod_http2-1.15.19-5.el9_3.1.src.rpm SHA-256: 9e2e7d021b97177da4b76649ac9f233acdf566a8806f1715ea34d8e2b2448c6f
aarch64
mod_http2-1.15.19-5.el9_3.1.aarch64.rpm SHA-256: 2b549d7375177c82b8defcc55aa0baf64b36c55b3249ebb5ae8cfdc52b7ba0bd
mod_http2-debuginfo-1.15.19-5.el9_3.1.aarch64.rpm SHA-256: f7e4a6ff29c8bd35f24d7035483700e5d090e51de383cbf00f0fc09f0fe43e46
mod_http2-debugsource-1.15.19-5.el9_3.1.aarch64.rpm SHA-256: cfc2c808f380d42bad51906f652959cfe244583df009534bf6442dd2d35562f2

Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6

SRPM
mod_http2-1.15.19-5.el9_3.1.src.rpm SHA-256: 9e2e7d021b97177da4b76649ac9f233acdf566a8806f1715ea34d8e2b2448c6f
s390x
mod_http2-1.15.19-5.el9_3.1.s390x.rpm SHA-256: 960b55eb99fd9db4703d3adf1ed6451b43c03747b4bafd2737ae2112a0f847f6
mod_http2-debuginfo-1.15.19-5.el9_3.1.s390x.rpm SHA-256: fa6ca6b3ddf919b8d38ebd4ee691ea3e5bc4a8d9706d38c79913cbdc91270c32
mod_http2-debugsource-1.15.19-5.el9_3.1.s390x.rpm SHA-256: edfe9463074d412c0fe95e53fe15648cb53c8a7e77997eeee9144752118f7c89

Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4

SRPM
mod_http2-1.15.19-5.el9_3.1.src.rpm SHA-256: 9e2e7d021b97177da4b76649ac9f233acdf566a8806f1715ea34d8e2b2448c6f
s390x
mod_http2-1.15.19-5.el9_3.1.s390x.rpm SHA-256: 960b55eb99fd9db4703d3adf1ed6451b43c03747b4bafd2737ae2112a0f847f6
mod_http2-debuginfo-1.15.19-5.el9_3.1.s390x.rpm SHA-256: fa6ca6b3ddf919b8d38ebd4ee691ea3e5bc4a8d9706d38c79913cbdc91270c32
mod_http2-debugsource-1.15.19-5.el9_3.1.s390x.rpm SHA-256: edfe9463074d412c0fe95e53fe15648cb53c8a7e77997eeee9144752118f7c89

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.