Advisories » MGASA-2018-0007

Updated apache packages fix security vulnerability

Publication date: 01 Jan 2018
Modification date: 01 Jan 2018
Type: security
Affected Mageia releases : 5
CVE: CVE-2016-0736 , CVE-2016-2161 , CVE-2016-8743 , CVE-2017-3167 , CVE-2017-3169 , CVE-2017-7668 , CVE-2017-7679 , CVE-2017-9788 , CVE-2017-9798

Description

mod_sessioncrypto was encrypting its data/cookie using the configured ciphers
with possibly either CBC or ECB modes of operation (AES256-CBC by default),
hence no selectable or builtin authenticated encryption. This made it
vulnerable to padding oracle attacks, particularly with CBC (CVE-2016-0736).

Malicious input to mod_auth_digest will cause the server to crash, and each
instance continues to crash even for subsequently valid requests
(CVE-2016-2161).

Emmanuel Dreyfus reported that the use of ap_get_basic_auth_pw() by third-party
modules outside of the authentication phase may lead to authentication
requirements being bypassed (CVE-2017-3167).

Vasileios Panopoulos of AdNovum Informatik AG discovered that mod_ssl may
dereference a NULL pointer when third-party modules call
ap_hook_process_connection() during an HTTP request to an HTTPS port leading to
a denial of service (CVE-2017-3169).

Javier Jimenez reported that the HTTP strict parsing contains a flaw leading to
a buffer overread in ap_find_token(). A remote attacker can take advantage of
this flaw by carefully crafting a sequence of request headers to cause a
segmentation fault, or to force ap_find_token() to return an incorrect value
(CVE-2017-7668).

ChenQin and Hanno Boeck reported that mod_mime can read one byte past the end of
a buffer when sending a malicious Content-Type response header (CVE-2017-7679).

Robert Swiecki reported that mod_auth_digest does not properly initialize or
reset the value placeholder in [Proxy-]Authorization headers of type "Digest"
between successive key=value assignments, leading to information disclosure or
denial of service (CVE-2017-9788).

Hanno Böck discovered that the Apache HTTP Server incorrectly handled Limit
directives in .htaccess files. In certain configurations, a remote attacker
could possibly use this issue to read arbitrary server memory, including
sensitive information. This issue is known as Optionsbleed (CVE-2017-9798).

References

SRPMS

5/core