RHSA-2020:4751MediumCVSS 6.6

Red Hat Security Advisory: httpd:2.4 security, bug fix, and enhancement update

Published
November 4, 2020
Last Modified
August 4, 2026

🔗 CVE IDs covered (10)

CVE-2019-10082 →CVE-2019-10098 →CVE-2019-10081 →CVE-2019-10092 →CVE-2019-10097 →CVE-2020-1927 →CVE-2020-1934 →CVE-2018-17189 →CVE-2019-0196 →CVE-2019-0197 →

📋 Description

CVE-2018-17189 — httpd: mod_http2: DoS via slow, unneeded request bodies CVE-2019-0196 — httpd: mod_http2: read-after-free on a string compare CVE-2019-0197 — httpd: mod_http2: possible crash on late upgrade CVE-2019-10081 — httpd: memory corruption on early pushes CVE-2019-10082 — httpd: read-after-free in h2 connection shutdown CVE-2019-10092 — httpd: limited cross-site scripting in mod_proxy error page CVE-2019-10097 — httpd: null-pointer dereference in mod_remoteip CVE-2019-10098 — httpd: mod_rewrite potential open redirect CVE-2020-1927 — httpd: mod_rewrite configurations vulnerable to open redirect CVE-2020-1934 — httpd: mod_proxy_ftp use of uninitialized value

🎯 Affected products86

  • Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.aarch64 (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.ppc64le (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.s390x (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.src (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64 (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-debuginfo-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.aarch64 (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-debuginfo-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.ppc64le (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-debuginfo-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.s390x (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-debuginfo-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64 (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-debugsource-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.aarch64 (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-debugsource-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.ppc64le (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-debugsource-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.s390x (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-debugsource-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64 (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.aarch64 (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.ppc64le (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.s390x (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64 (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-filesystem-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-manual-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.aarch64 (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.ppc64le (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.s390x (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64 (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-tools-debuginfo-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.aarch64 (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-tools-debuginfo-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.ppc64le (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-tools-debuginfo-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.s390x (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • httpd-tools-debuginfo-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64 (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • mod_http2-0:1.15.7-2.module+el8.3.0+7670+8bf57d29.aarch64 (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • mod_http2-0:1.15.7-2.module+el8.3.0+7670+8bf57d29.ppc64le (httpd:2.4) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • +56 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the updated packages, the httpd daemon will be restarted automatically. Workaround: This flaw is only exploitable if Apache httpd is configured to respond to HTTP/2 requests, which is done by including "h2" or "h2c" in the "Protocols" list in a configuration file. The following command can be used to search for possible vulnerable configurations: grep -R '^\s*Protocols\>.*\<h2\>' /etc/httpd/ See https://httpd.apache.org/docs/2.4/mod/mod_http2.html Workaround: This flaw is only exploitable if Proxy* directives are used in Apache httpd configuration. The following command can be used to search for possible vulnerable configurations: grep -R '^\s*Proxy' /etc/httpd/ See https://httpd.apache.org/docs/2.4/mod/mod_proxy.html Workaround: This flaw is only exploitable if RemoteIP* directives are used in Apache httpd configuration. The following command can be used to search for possible vulnerable configurations: grep -R '^\s*RemoteIP' /etc/httpd/ See https://httpd.apache.org/docs/2.4/mod/mod_remoteip.html Workaround: This flaw requires the use of certain Rewrite configuration directives. The following command can be used to search for possible vulnerable configurations: grep -R '^\s*Rewrite' /etc/httpd/ See https://httpd.apache.org/docs/2.4/mod/mod_rewrite.html

🔗 References (18)