Red Hat Security Advisory: httpd security update

🔗 CVE IDs covered (1)

📋 Description

🎯 Affected products76

• Red Hat Enterprise Linux AppStream (v. 9)
• httpd-0:2.4.57-8.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
• httpd-0:2.4.57-8.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
• httpd-0:2.4.57-8.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
• httpd-0:2.4.57-8.el9.src as a component of Red Hat Enterprise Linux AppStream (v. 9)
• httpd-0:2.4.57-8.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
• httpd-core-0:2.4.57-8.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
• httpd-core-0:2.4.57-8.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
• httpd-core-0:2.4.57-8.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
• httpd-core-0:2.4.57-8.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
• httpd-core-debuginfo-0:2.4.57-8.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
• httpd-core-debuginfo-0:2.4.57-8.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
• httpd-core-debuginfo-0:2.4.57-8.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
• httpd-core-debuginfo-0:2.4.57-8.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
• httpd-debuginfo-0:2.4.57-8.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
• httpd-debuginfo-0:2.4.57-8.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
• httpd-debuginfo-0:2.4.57-8.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
• httpd-debuginfo-0:2.4.57-8.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
• httpd-debugsource-0:2.4.57-8.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
• httpd-debugsource-0:2.4.57-8.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
• httpd-debugsource-0:2.4.57-8.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
• httpd-debugsource-0:2.4.57-8.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
• httpd-devel-0:2.4.57-8.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
• httpd-devel-0:2.4.57-8.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
• httpd-devel-0:2.4.57-8.el9.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
• httpd-devel-0:2.4.57-8.el9.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
• httpd-filesystem-0:2.4.57-8.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)
• httpd-manual-0:2.4.57-8.el9.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9)
• httpd-tools-0:2.4.57-8.el9.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
• httpd-tools-0:2.4.57-8.el9.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
• +46 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the updated packages, the httpd daemon will be restarted automatically. Workaround: Disabling mod_macro and restarting httpd or making sure the macros used are smaller than the required length to trigger this vulnerability will mitigate this flaw. Furthermore, it's unlikely that a very long macro with the length needed to trigger this issue is being used.

🔗 References (7)

• selfhttps://access.redhat.com/errata/RHSA-2024:2278
• externalhttps://access.redhat.com/security/updates/classification/#moderate
• externalhttps://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index
• externalhttps://bugzilla.redhat.com/show_bug.cgi?id=2245332
• externalhttps://issues.redhat.com/browse/RHEL-17686
• externalhttps://issues.redhat.com/browse/RHEL-6600
• selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2278.json