RHSA-2020:2263MediumCVSS 6.1

Red Hat Security Advisory: httpd24-httpd and httpd24-mod_md security and enhancement update

Published
May 26, 2020
Last Modified
August 4, 2026

🔗 CVE IDs covered (2)

CVE-2019-10098 →CVE-2020-1927 →

📋 Description

CVE-2019-10098 — httpd: mod_rewrite potential open redirect CVE-2020-1927 — httpd: mod_rewrite configurations vulnerable to open redirect

🎯 Affected products148

  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)
  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)
  • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • httpd24-httpd-0:2.4.34-18.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)
  • httpd24-httpd-0:2.4.34-18.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)
  • httpd24-httpd-0:2.4.34-18.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)
  • httpd24-httpd-0:2.4.34-18.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)
  • httpd24-httpd-0:2.4.34-18.el7.aarch64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • httpd24-httpd-0:2.4.34-18.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • httpd24-httpd-0:2.4.34-18.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • httpd24-httpd-0:2.4.34-18.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • httpd24-httpd-0:2.4.34-18.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • httpd24-httpd-0:2.4.34-18.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • httpd24-httpd-0:2.4.34-18.el7.s390x as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • httpd24-httpd-0:2.4.34-18.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • httpd24-httpd-0:2.4.34-18.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • httpd24-httpd-0:2.4.34-18.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • httpd24-httpd-0:2.4.34-18.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • httpd24-httpd-0:2.4.34-18.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • httpd24-httpd-0:2.4.34-18.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • httpd24-httpd-0:2.4.34-18.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)
  • httpd24-httpd-0:2.4.34-18.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • httpd24-httpd-debuginfo-0:2.4.34-18.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)
  • httpd24-httpd-debuginfo-0:2.4.34-18.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)
  • httpd24-httpd-debuginfo-0:2.4.34-18.el7.aarch64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • httpd24-httpd-debuginfo-0:2.4.34-18.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • httpd24-httpd-debuginfo-0:2.4.34-18.el7.ppc64le as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)
  • +118 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the updated packages, the httpd daemon will be restarted automatically. Workaround: This flaw requires the use of certain Rewrite configuration directives. The following command can be used to search for possible vulnerable configurations: grep -R '^\s*Rewrite' /etc/httpd/ See https://httpd.apache.org/docs/2.4/mod/mod_rewrite.html

🔗 References (6)