SUSE-SU-2017:2449-1

See a problem?
Please try reporting it to the source first.

Source

https://www.suse.com/support/update/announcement/2017/suse-su-20172449-1/

Import Source

https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2017:2449-1.json

JSON Data

https://api.osv.dev/v1/vulns/SUSE-SU-2017:2449-1

Related

Published

2017-09-13T10:33:25Z

Modified

2017-09-13T10:33:25Z

Summary

Recommended update for apache2

Details

This update for apache2 provides the following fixes:

Security issues fixed:

CVE-2017-9788: The value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by modauthdigest. Providing an initial key with no '=' assignment could reflect the stale value of uninitialized pool memory used by the prior request, leading to leakage of potentially confidential information, and a segfault in other cases resulting in denial of service. (bsc#1048576)
CVE-2017-7679: mod_mime could have read one byte past the end of a buffer when sending a malicious Content-Type response header leading to information leak or crash. (bsc#1045060)
CVE-2017-3169: modssl may have dereferenced a NULL pointer when third-party modules call aphookprocessconnection() during an HTTP request to an HTTPS port leading to crash. (bsc#1045062)
CVE-2017-3167: Use of the apgetbasicauthpw() by third-party modules outside of the authentication phase may have lead to authentication requirements being bypassed. (bsc#1045065)

Non-security issues fixed:

Re-order cipher suites to keep exclusion list at the end. (bsc#1043484, bsc#1043607)
Remove /usr/bin/http2 link only during apache2 package uninstall, not upgrade. (bsc#1041830)
In gensslcert, use hostname when fqdn is too long. (bsc#1035829)

References

Affected packages

SUSE:OpenStack Cloud 6 / apache2

Package

Name: apache2
Purl: purl:rpm/suse/apache2&distro=SUSE%20OpenStack%20Cloud%206

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.16-20.10.1

Ecosystem specific

{
    "binaries": [
        {
            "apache2-example-pages": "2.4.16-20.10.1",
            "apache2-doc": "2.4.16-20.10.1",
            "apache2-worker": "2.4.16-20.10.1",
            "apache2-prefork": "2.4.16-20.10.1",
            "apache2": "2.4.16-20.10.1",
            "apache2-utils": "2.4.16-20.10.1"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 12 SP1 / apache2

Package

Name: apache2
Purl: purl:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.16-20.10.1

Ecosystem specific

{
    "binaries": [
        {
            "apache2-example-pages": "2.4.16-20.10.1",
            "apache2-doc": "2.4.16-20.10.1",
            "apache2-worker": "2.4.16-20.10.1",
            "apache2-prefork": "2.4.16-20.10.1",
            "apache2": "2.4.16-20.10.1",
            "apache2-utils": "2.4.16-20.10.1"
        }
    ]
}

SUSE:Linux Enterprise Server 12 SP1-LTSS / apache2

Package

Name: apache2
Purl: purl:rpm/suse/apache2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.16-20.10.1

Ecosystem specific

{
    "binaries": [
        {
            "apache2-example-pages": "2.4.16-20.10.1",
            "apache2-doc": "2.4.16-20.10.1",
            "apache2-worker": "2.4.16-20.10.1",
            "apache2-prefork": "2.4.16-20.10.1",
            "apache2": "2.4.16-20.10.1",
            "apache2-utils": "2.4.16-20.10.1"
        }
    ]
}