[RHSA-2015:1249-02] Low: httpd security, bug fix, and enhancement update

bugzilla at redhat.com bugzilla at redhat.com
Wed Jul 22 06:25:03 UTC 2015 

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Low: httpd security, bug fix, and enhancement update
Advisory ID:       RHSA-2015:1249-02
Product:           Red Hat Enterprise Linux
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2015-1249.html
Issue date:        2015-07-22
Updated on:        2014-12-08
CVE Names:         CVE-2013-5704 
=====================================================================

1. Summary:

Updated httpd packages that fix one security issue, several bugs, and add
one enhancement are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Low security
impact. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available from the CVE link in the
References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64
Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, noarch, x86_64
Red Hat Enterprise Linux HPC Node (v. 6) - x86_64
Red Hat Enterprise Linux HPC Node Optional (v. 6) - noarch, x86_64
Red Hat Enterprise Linux Server (v. 6) - i386, noarch, ppc64, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 6) - i386, noarch, x86_64

3. Description:

The httpd packages provide the Apache HTTP Server, a powerful, efficient,
and extensible web server.

A flaw was found in the way httpd handled HTTP Trailer headers when
processing requests using chunked encoding. A malicious client could use
Trailer headers to set additional HTTP headers after header processing was
performed by other modules. This could, for example, lead to a bypass of
header restrictions defined with mod_headers. (CVE-2013-5704)

This update also fixes the following bugs:

* The order of mod_proxy workers was not checked when httpd configuration
was reloaded. When mod_proxy workers were removed, added, or their order
was changed, their parameters and scores could become mixed. The order of
mod_proxy workers has been made internally consistent during configuration
reload. (BZ#1149906)

* The local host certificate created during firstboot contained CA
extensions, which caused the httpd service to return warning messages.
This has been addressed by local host certificates being generated with the
"-extensions v3_req" option. (BZ#906476)

* The default mod_ssl configuration no longer enables support for SSL
cipher suites using the single DES, IDEA, or SEED encryption algorithms.
(BZ#1086771)

* The apachectl script did not take into account the HTTPD_LANG variable
set in the /etc/sysconfig/httpd file during graceful restarts.
Consequently, httpd did not use a changed value of HTTPD_LANG when the
daemon was restarted gracefully. The script has been fixed to handle the
HTTPD_LANG variable correctly. (BZ#963146)

* The mod_deflate module failed to check the original file size while
extracting files larger than 4 GB, making it impossible to extract large
files. Now, mod_deflate checks the original file size properly according to
RFC1952, and it is able to decompress files larger than 4 GB. (BZ#1057695)

* The httpd service did not check configuration before restart. When a
configuration contained an error, an attempt to restart httpd gracefully
failed. Now, httpd checks configuration before restart and if the
configuration is in an inconsistent state, an error message is printed,
httpd is not stopped and a restart is not performed. (BZ#1146194)

* The SSL_CLIENT_VERIFY environment variable was incorrectly handled when
the "SSLVerifyClient optional_no_ca" and "SSLSessionCache" options were
used. When an SSL session was resumed, the SSL_CLIENT_VERIFY value was set
to "SUCCESS" instead of the previously set "GENEROUS". SSL_CLIENT_VERIFY is
now correctly set to GENEROUS in this scenario. (BZ#1149703)

* The ab utility did not correctly handle situations when an SSL connection
was closed after some data had already been read. As a consequence, ab did
not work correctly with SSL servers and printed "SSL read failed" error
messages. With this update, ab works as expected with HTTPS servers.
(BZ#1045477)

* When a client presented a revoked certificate, log entries were created
only at the debug level. The log level of messages regarding a revoked
certificate has been increased to INFO, and administrators are now properly
informed of this situation. (BZ#1161328)

In addition, this update adds the following enhancement:

* A mod_proxy worker can now be set into drain mode (N) using the
balancer-manager web interface or using the httpd configuration file.
A worker in drain mode accepts only existing sticky sessions destined for
itself and ignores all other requests. The worker waits until all clients
currently connected to this worker complete their work before the worker is
stopped. As a result, drain mode enables to perform maintenance on a worker
without affecting clients. (BZ#767130)

Users of httpd are advised to upgrade to these updated packages, which
contain backported patches to correct these issues and add this
enhancement. After installing the updated packages, the httpd service will
be restarted automatically.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

922844 - rotatelogs %Z does not use correct timezone respecting DST
963146 - HTTPD_LANG doesn't effect when httpd starts by graceful.
987590 - Apache startup fails with misleading error if DocumentRoot has context type user_home_t
1045477 - "ab" to https sites broken
1057695 - mod_deflate does not decompress files larger than 4GB
1069625 - httpd.conf uses icon bomb.gif for all files/dirs ending with core
1082903 - CVE-2013-5704 httpd: bypass of mod_headers rules via chunked requests
1125269 - ab fails when domain name resolved to IPv6 adress
1149703 - bad SSL_CLIENT_VERIFY value on resumed session with "SSLVerifyClient optional_no_ca"
1149906 - Mixed up mod_proxy_balancer jvmRoutes causing sticky session breaks
1161328 - [mod_ssl] Revoked Certificates are logged at the DEBUG level
1162268 - Misspelling in patch file causes failure to build against older OpenSSL releases

6. Package List:

Red Hat Enterprise Linux Desktop (v. 6):

Source:
httpd-2.2.15-45.el6.src.rpm

i386:
httpd-2.2.15-45.el6.i686.rpm
httpd-debuginfo-2.2.15-45.el6.i686.rpm
httpd-tools-2.2.15-45.el6.i686.rpm

x86_64:
httpd-2.2.15-45.el6.x86_64.rpm
httpd-debuginfo-2.2.15-45.el6.x86_64.rpm
httpd-tools-2.2.15-45.el6.x86_64.rpm

Red Hat Enterprise Linux Desktop Optional (v. 6):

i386:
httpd-debuginfo-2.2.15-45.el6.i686.rpm
httpd-devel-2.2.15-45.el6.i686.rpm
mod_ssl-2.2.15-45.el6.i686.rpm

noarch:
httpd-manual-2.2.15-45.el6.noarch.rpm

x86_64:
httpd-debuginfo-2.2.15-45.el6.i686.rpm
httpd-debuginfo-2.2.15-45.el6.x86_64.rpm
httpd-devel-2.2.15-45.el6.i686.rpm
httpd-devel-2.2.15-45.el6.x86_64.rpm
mod_ssl-2.2.15-45.el6.x86_64.rpm

Red Hat Enterprise Linux HPC Node (v. 6):

Source:
httpd-2.2.15-45.el6.src.rpm

x86_64:
httpd-2.2.15-45.el6.x86_64.rpm
httpd-debuginfo-2.2.15-45.el6.x86_64.rpm
httpd-tools-2.2.15-45.el6.x86_64.rpm

Red Hat Enterprise Linux HPC Node Optional (v. 6):

noarch:
httpd-manual-2.2.15-45.el6.noarch.rpm

x86_64:
httpd-debuginfo-2.2.15-45.el6.i686.rpm
httpd-debuginfo-2.2.15-45.el6.x86_64.rpm
httpd-devel-2.2.15-45.el6.i686.rpm
httpd-devel-2.2.15-45.el6.x86_64.rpm
mod_ssl-2.2.15-45.el6.x86_64.rpm

Red Hat Enterprise Linux Server (v. 6):

Source:
httpd-2.2.15-45.el6.src.rpm

i386:
httpd-2.2.15-45.el6.i686.rpm
httpd-debuginfo-2.2.15-45.el6.i686.rpm
httpd-devel-2.2.15-45.el6.i686.rpm
httpd-tools-2.2.15-45.el6.i686.rpm
mod_ssl-2.2.15-45.el6.i686.rpm

noarch:
httpd-manual-2.2.15-45.el6.noarch.rpm

ppc64:
httpd-2.2.15-45.el6.ppc64.rpm
httpd-debuginfo-2.2.15-45.el6.ppc.rpm
httpd-debuginfo-2.2.15-45.el6.ppc64.rpm
httpd-devel-2.2.15-45.el6.ppc.rpm
httpd-devel-2.2.15-45.el6.ppc64.rpm
httpd-tools-2.2.15-45.el6.ppc64.rpm
mod_ssl-2.2.15-45.el6.ppc64.rpm

s390x:
httpd-2.2.15-45.el6.s390x.rpm
httpd-debuginfo-2.2.15-45.el6.s390.rpm
httpd-debuginfo-2.2.15-45.el6.s390x.rpm
httpd-devel-2.2.15-45.el6.s390.rpm
httpd-devel-2.2.15-45.el6.s390x.rpm
httpd-tools-2.2.15-45.el6.s390x.rpm
mod_ssl-2.2.15-45.el6.s390x.rpm

x86_64:
httpd-2.2.15-45.el6.x86_64.rpm
httpd-debuginfo-2.2.15-45.el6.i686.rpm
httpd-debuginfo-2.2.15-45.el6.x86_64.rpm
httpd-devel-2.2.15-45.el6.i686.rpm
httpd-devel-2.2.15-45.el6.x86_64.rpm
httpd-tools-2.2.15-45.el6.x86_64.rpm
mod_ssl-2.2.15-45.el6.x86_64.rpm

Red Hat Enterprise Linux Workstation (v. 6):

Source:
httpd-2.2.15-45.el6.src.rpm

i386:
httpd-2.2.15-45.el6.i686.rpm
httpd-debuginfo-2.2.15-45.el6.i686.rpm
httpd-devel-2.2.15-45.el6.i686.rpm
httpd-tools-2.2.15-45.el6.i686.rpm
mod_ssl-2.2.15-45.el6.i686.rpm

noarch:
httpd-manual-2.2.15-45.el6.noarch.rpm

x86_64:
httpd-2.2.15-45.el6.x86_64.rpm
httpd-debuginfo-2.2.15-45.el6.i686.rpm
httpd-debuginfo-2.2.15-45.el6.x86_64.rpm
httpd-devel-2.2.15-45.el6.i686.rpm
httpd-devel-2.2.15-45.el6.x86_64.rpm
httpd-tools-2.2.15-45.el6.x86_64.rpm
mod_ssl-2.2.15-45.el6.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2013-5704
https://access.redhat.com/security/updates/classification/#low

8. Contact:

The Red Hat security contact is <secalert at redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2014 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iD8DBQFVrzQyXlSAg2UNWIIRAqudAKC9mhglS6BG4HofyduoRGIk0AQmYQCfdX7e
ZFaoxBsObcWEFLGgT549OX4=
=WbEF
-----END PGP SIGNATURE-----

More information about the Enterprise-watch-list mailing list