Oval Definition:oval:com.redhat.rhsa:def:20172972
Revision Date:2017-10-19Version:638
Title:RHSA-2017:2972: httpd security update (Moderate)
Description:The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

  • A use-after-free flaw was found in the way httpd handled invalid and previously unregistered HTTP methods specified in the Limit directive used in an .htaccess file. A remote attacker could possibly use this flaw to disclose portions of the server memory, or cause httpd child process to crash. (CVE-2017-9798)

  • A regression was found in the Red Hat Enterprise Linux 6.9 version of httpd, causing comments in the "Allow" and "Deny" configuration lines to be parsed incorrectly. A web administrator could unintentionally allow any client to access a restricted HTTP resource. (CVE-2017-12171)

    Red Hat would like to thank Hanno Böck for reporting CVE-2017-9798 and KAWAHARA Masashi for reporting CVE-2017-12171.
  • Family:unixClass:patch
    Status:Reference(s):CVE-2017-12171
    CVE-2017-9798
    RHSA-2017:2972
    RHSA-2017:2972-00
    RHSA-2017:2972-01
    Platform(s):Red Hat Enterprise Linux 6
    Product(s):
    Definition Synopsis
  • Red Hat Enterprise Linux must be installed
  • OR Package Information
  • Red Hat Enterprise Linux 6 is installed
  • AND
  • httpd is earlier than 0:2.2.15-60.el6_9.6
  • AND httpd is signed with Red Hat redhatrelease2 key
  • httpd-devel is earlier than 0:2.2.15-60.el6_9.6
  • AND httpd-devel is signed with Red Hat redhatrelease2 key
  • httpd-manual is earlier than 0:2.2.15-60.el6_9.6
  • AND httpd-manual is signed with Red Hat redhatrelease2 key
  • httpd-tools is earlier than 0:2.2.15-60.el6_9.6
  • AND httpd-tools is signed with Red Hat redhatrelease2 key
  • mod_ssl is earlier than 1:2.2.15-60.el6_9.6
  • AND mod_ssl is signed with Red Hat redhatrelease2 key
  • BACK