| Description: | Summary:
The remote host is missing an update for the 'apache' package(s) announced via the MGASA-2018-0007 advisory.
Vulnerability Insight:
mod_sessioncrypto was encrypting its data/cookie using the configured ciphers
with possibly either CBC or ECB modes of operation (AES256-CBC by default),
hence no selectable or builtin authenticated encryption. This made it
vulnerable to padding oracle attacks, particularly with CBC (CVE-2016-0736).
Malicious input to mod_auth_digest will cause the server to crash, and each
instance continues to crash even for subsequently valid requests
(CVE-2016-2161).
Emmanuel Dreyfus reported that the use of ap_get_basic_auth_pw() by third-party
modules outside of the authentication phase may lead to authentication
requirements being bypassed (CVE-2017-3167).
Vasileios Panopoulos of AdNovum Informatik AG discovered that mod_ssl may
dereference a NULL pointer when third-party modules call
ap_hook_process_connection() during an HTTP request to an HTTPS port leading to
a denial of service (CVE-2017-3169).
Javier Jimenez reported that the HTTP strict parsing contains a flaw leading to
a buffer overread in ap_find_token(). A remote attacker can take advantage of
this flaw by carefully crafting a sequence of request headers to cause a
segmentation fault, or to force ap_find_token() to return an incorrect value
(CVE-2017-7668).
ChenQin and Hanno Boeck reported that mod_mime can read one byte past the end of
a buffer when sending a malicious Content-Type response header (CVE-2017-7679).
Robert Swiecki reported that mod_auth_digest does not properly initialize or
reset the value placeholder in [Proxy-]Authorization headers of type 'Digest'
between successive key=value assignments, leading to information disclosure or
denial of service (CVE-2017-9788).
Hanno Bock discovered that the Apache HTTP Server incorrectly handled Limit
directives in .htaccess files. In certain configurations, a remote attacker
could possibly use this issue to read arbitrary server memory, including
sensitive information. This issue is known as Optionsbleed (CVE-2017-9798).
Affected Software/OS:
'apache' package(s) on Mageia 5.
Solution:
Please install the updated package(s).
CVSS Score:
7.5
CVSS Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P
|
