You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Paul Reilly <pa...@tcd.ie> on 2011/08/31 12:22:04 UTC
[users@httpd] Apache Security Page and CVE-2011-3192
Why is there no information about the recent header Rang DoS vulnerability
in Apache on the Apache security page?
http://httpd.apache.org/security/
I would have expected at least to see some mention of it, and possible
work-arounds.
Paul
Re: [users@httpd] Apache Security Page and CVE-2011-3192
Posted by "William A. Rowe Jr." <wr...@rowe-clan.net>.
On 8/31/2011 8:17 AM, Jeff Trawick wrote:
> On Wed, Aug 31, 2011 at 6:22 AM, Paul Reilly <pa...@tcd.ie> wrote:
>> Why is there no information about the recent header Rang DoS vulnerability
>> in Apache on the Apache security page?
>>
>> http://httpd.apache.org/security/
>>
>> I would have expected at least to see some mention of it, and possible
>> work-arounds.
>
> Only vulnerabilities which are fixed in a release are listed there.
> As 2.2.20 is now released, the corresponding 2.2 security page has
> been updated.
Actually, all published vulnerabilities are supposed to be listed.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Apache Security Page and CVE-2011-3192
Posted by Jeff Trawick <tr...@gmail.com>.
On Wed, Aug 31, 2011 at 6:22 AM, Paul Reilly <pa...@tcd.ie> wrote:
> Why is there no information about the recent header Rang DoS vulnerability
> in Apache on the Apache security page?
>
> http://httpd.apache.org/security/
>
> I would have expected at least to see some mention of it, and possible
> work-arounds.
Only vulnerabilities which are fixed in a release are listed there.
As 2.2.20 is now released, the corresponding 2.2 security page has
been updated.
An advisory is available with more detailed information about the
vulnerability, including workarounds. The most recent version is at
http://mail-archives.apache.org/mod_mbox/httpd-announce/201108.mbox/%3C20110826103531.998348F82@minotaur.apache.org%3E
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org