RHSA-2012:0543Medium

Red Hat Security Advisory: httpd security and bug fix update

Published
May 7, 2012
Last Modified
November 7, 2026

🔗 CVE IDs covered (6)

CVE-2011-3348 →CVE-2011-3368 →CVE-2011-3607 →CVE-2012-0021 →CVE-2012-0031 →CVE-2012-0053 →

📋 Description

CVE-2011-3348 — httpd: mod_proxy_ajp remote temporary DoS CVE-2011-3368 — httpd: reverse web proxy vulnerability CVE-2011-3607 — httpd: ap_pregsub Integer overflow to buffer overflow CVE-2012-0021 — httpd: NULL pointer dereference crash in mod_log_config CVE-2012-0031 — httpd: possible crash on shutdown due to flaw in scoreboard handling CVE-2012-0053 — httpd: cookie exposure due to error responses

🎯 Affected products1

  • Red Hat JBoss Web Server 1.0

✅ Remediation

The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing JBoss Enterprise Web Server installation (including all applications and configuration files). The Apache HTTP Server must be restarted for this update to take effect. Workaround: As noted in the original reporter's advisory (see comment #5), this issue can be mitigated by using a custom ErrorDocument setting, such as: ErrorDocument 400 "Bad Request" http://httpd.apache.org/docs/2.2/mod/core.html#errordocument It should be noted that ErrorDocument setting using path or external URL does not mitigate this issue. It should also be noted that this is not an issue by itself. This can only be exploited via some other cross-site scripting (XSS) flaw found in a web application running on the server and may allow injected JavaScript to gain access to HttpOnly cookies, if the application uses this protection for its cookies.

🔗 References (11)