RHSA-2012:0542Medium

Red Hat Security Advisory: httpd security and bug fix update

Published
May 7, 2012
Last Modified
November 7, 2026

🔗 CVE IDs covered (6)

CVE-2011-3348 →CVE-2011-3368 →CVE-2011-3607 →CVE-2012-0021 →CVE-2012-0031 →CVE-2012-0053 →

📋 Description

CVE-2011-3348 — httpd: mod_proxy_ajp remote temporary DoS CVE-2011-3368 — httpd: reverse web proxy vulnerability CVE-2011-3607 — httpd: ap_pregsub Integer overflow to buffer overflow CVE-2012-0021 — httpd: NULL pointer dereference crash in mod_log_config CVE-2012-0031 — httpd: possible crash on shutdown due to flaw in scoreboard handling CVE-2012-0053 — httpd: cookie exposure due to error responses

🎯 Affected products22

  • Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server
  • Red Hat JBoss Enterprise Web Server 1 for RHEL 6 Server
  • httpd-0:2.2.17-15.4.ep5.el5.i386 as a component of Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server
  • httpd-0:2.2.17-15.4.ep5.el5.src as a component of Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server
  • httpd-0:2.2.17-15.4.ep5.el5.x86_64 as a component of Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server
  • httpd-0:2.2.17-15.4.ep5.el6.i386 as a component of Red Hat JBoss Enterprise Web Server 1 for RHEL 6 Server
  • httpd-0:2.2.17-15.4.ep5.el6.src as a component of Red Hat JBoss Enterprise Web Server 1 for RHEL 6 Server
  • httpd-0:2.2.17-15.4.ep5.el6.x86_64 as a component of Red Hat JBoss Enterprise Web Server 1 for RHEL 6 Server
  • httpd-devel-0:2.2.17-15.4.ep5.el5.i386 as a component of Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server
  • httpd-devel-0:2.2.17-15.4.ep5.el5.x86_64 as a component of Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server
  • httpd-devel-0:2.2.17-15.4.ep5.el6.i386 as a component of Red Hat JBoss Enterprise Web Server 1 for RHEL 6 Server
  • httpd-devel-0:2.2.17-15.4.ep5.el6.x86_64 as a component of Red Hat JBoss Enterprise Web Server 1 for RHEL 6 Server
  • httpd-manual-0:2.2.17-15.4.ep5.el5.i386 as a component of Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server
  • httpd-manual-0:2.2.17-15.4.ep5.el5.x86_64 as a component of Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server
  • httpd-manual-0:2.2.17-15.4.ep5.el6.i386 as a component of Red Hat JBoss Enterprise Web Server 1 for RHEL 6 Server
  • httpd-manual-0:2.2.17-15.4.ep5.el6.x86_64 as a component of Red Hat JBoss Enterprise Web Server 1 for RHEL 6 Server
  • httpd-tools-0:2.2.17-15.4.ep5.el6.i386 as a component of Red Hat JBoss Enterprise Web Server 1 for RHEL 6 Server
  • httpd-tools-0:2.2.17-15.4.ep5.el6.x86_64 as a component of Red Hat JBoss Enterprise Web Server 1 for RHEL 6 Server
  • mod_ssl-1:2.2.17-15.4.ep5.el5.i386 as a component of Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server
  • mod_ssl-1:2.2.17-15.4.ep5.el5.x86_64 as a component of Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server
  • mod_ssl-1:2.2.17-15.4.ep5.el6.i386 as a component of Red Hat JBoss Enterprise Web Server 1 for RHEL 6 Server
  • mod_ssl-1:2.2.17-15.4.ep5.el6.x86_64 as a component of Red Hat JBoss Enterprise Web Server 1 for RHEL 6 Server

✅ Remediation

Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 Workaround: As noted in the original reporter's advisory (see comment #5), this issue can be mitigated by using a custom ErrorDocument setting, such as: ErrorDocument 400 "Bad Request" http://httpd.apache.org/docs/2.2/mod/core.html#errordocument It should be noted that ErrorDocument setting using path or external URL does not mitigate this issue. It should also be noted that this is not an issue by itself. This can only be exploited via some other cross-site scripting (XSS) flaw found in a web application running on the server and may allow injected JavaScript to gain access to HttpOnly cookies, if the application uses this protection for its cookies.

🔗 References (11)