You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by bu...@apache.org on 2018/04/10 13:48:42 UTC
svn commit: r1028189 [2/3] - in /websites/staging/httpd/trunk/content: ./
security/vulnerabilities-httpd.page/securitydb.xsl
security/vulnerabilities-httpd.xml security/vulnerabilities_22.html
security/vulnerabilities_24.html
Modified: websites/staging/httpd/trunk/content/security/vulnerabilities-httpd.xml
==============================================================================
--- websites/staging/httpd/trunk/content/security/vulnerabilities-httpd.xml (original)
+++ websites/staging/httpd/trunk/content/security/vulnerabilities-httpd.xml Tue Apr 10 13:48:41 2018
@@ -1,6 +1,6 @@
<security updated="20180325">
-<issue fixed="2.4.30" reported="20171114" public="20180321" released="20180321">
+<issue reported="20171114" public="20180321">
<cve name="CVE-2018-1283"/>
<severity level="3">moderate</severity>
<title>Tampering of mod_session data for CGI applications</title>
@@ -19,6 +19,7 @@ though, because of the possible remote e
<acknowledgements>
The issue was discovered internally by the Apache HTTP Server team.
</acknowledgements>
+<fixed base="2.4" version="2.4.30" date="20180321"/>
<affects prod="httpd" version="2.4.29"/>
<affects prod="httpd" version="2.4.28"/>
<affects prod="httpd" version="2.4.27"/>
@@ -40,7 +41,7 @@ The issue was discovered internally by t
<affects prod="httpd" version="2.4.1"/>
</issue>
-<issue fixed="2.4.30" reported="20180123" public="20180321" released="20180321">
+<issue reported="20180123" public="20180321">
<cve name="CVE-2018-1303"/>
<severity level="4">low</severity>
<title>Possible out of bound read in mod_cache_socache</title>
@@ -53,6 +54,7 @@ against users of mod_cache_socache.</p>
<acknowledgements>
The issue was discovered by Robert Swiecki, bug found by honggfuzz.
</acknowledgements>
+<fixed base="2.4" version="2.4.30" date="20180321"/>
<affects prod="httpd" version="2.4.29"/>
<affects prod="httpd" version="2.4.28"/>
<affects prod="httpd" version="2.4.27"/>
@@ -70,7 +72,7 @@ The issue was discovered by Robert Swiec
<affects prod="httpd" version="2.4.6"/>
</issue>
-<issue fixed="2.4.30" reported="20180123" public="20180321" released="20180321">
+<issue reported="20180123" public="20180321">
<cve name="CVE-2018-1302"/>
<severity level="4">low</severity>
<title>Possible write of after free on HTTP/2 stream shutdown</title>
@@ -85,6 +87,7 @@ could not reproduce it outside debug bui
<acknowledgements>
The issue was discovered by Robert Swiecki, bug found by honggfuzz.
</acknowledgements>
+<fixed base="2.4" version="2.4.30" date="20180321"/>
<affects prod="httpd" version="2.4.29"/>
<affects prod="httpd" version="2.4.28"/>
<affects prod="httpd" version="2.4.27"/>
@@ -96,7 +99,7 @@ The issue was discovered by Robert Swiec
<affects prod="httpd" version="2.4.17"/>
</issue>
-<issue fixed="2.4.30" reported="20180123" public="20180321" released="20180321">
+<issue reported="20180123" public="20180321">
<cve name="CVE-2018-1301"/>
<severity level="4">low</severity>
<title>Possible out of bound access after failure in reading the HTTP request</title>
@@ -107,6 +110,7 @@ reading the HTTP header. This vulnerabil
impossible to trigger in non-debug mode (both log and build level), so it is
classified as low risk for common server usage.</p>
</description>
+<fixed base="2.4" version="2.4.30" date="20180321"/>
<acknowledgements>
The issue was discovered by Robert Swiecki, bug found by honggfuzz.
</acknowledgements>
@@ -131,7 +135,8 @@ The issue was discovered by Robert Swiec
<affects prod="httpd" version="2.4.1"/>
</issue>
-<issue fixed="2.4.30" reported="20130305" public="20180321" released="20180321">
+<issue reported="20130305" public="20180321">
+<fixed base="2.4" version="2.4.30" date="20180321"/>
<cve name="CVE-2018-1312"/>
<severity level="4">low</severity>
<title>Weak Digest auth nonce generation in mod_auth_digest</title>
@@ -167,7 +172,8 @@ The issue was discovered by Nicolas Dani
<affects prod="httpd" version="2.4.1"/>
</issue>
-<issue fixed="2.4.30" reported="20171124" public="20180321" released="20180321">
+<issue reported="20171124" public="20180321">
+<fixed base="2.4" version="2.4.30" date="20180321"/>
<cve name="CVE-2017-15715"/>
<severity level="4">low</severity>
<title><FilesMatch> bypass with a trailing newline in the file name</title>
@@ -201,7 +207,8 @@ The issue was discovered by Elar Lang -
<affects prod="httpd" version="2.4.1"/>
</issue>
-<issue fixed="2.4.30" reported="20171207" public="20180321" released="20180321">
+<issue reported="20171207" public="20180321">
+<fixed base="2.4" version="2.4.30" date="20180321"/>
<cve name="CVE-2017-15710"/>
<severity level="4">low</severity>
<title>Out of bound write in mod_authnz_ldap when using too small Accept-Language values</title>
@@ -243,7 +250,9 @@ and Jakob Hirsch for reporting this issu
<affects prod="httpd" version="2.4.1"/>
</issue>
-<issue fixed="2.4.28" reported="20170712" public="20170918" released="20171005">
+<issue reported="20170712" public="20170918">
+<fixed base="2.4" version="2.4.28" date="20171005"/>
+<fixed base="2.2" version="2.2.35-never" date=""/>
<cve name="CVE-2017-9798"/>
<severity level="4">low</severity>
<title>Use-after-free when using <Limit > with an unrecognized method in .htaccess ("OptionsBleed")</title>
@@ -255,11 +264,18 @@ worker process, resulting in erratic beh
<p>This behavior may be avoided by listing all unusual HTTP Methods in a global
httpd.conf RegisterHttpMethod directive in httpd release 2.4.25 and later.</p>
<p>To permit other .htaccess directives while denying the <Limit > directive, see the AllowOverrideList directive.</p>
-<p>Source code patch is at;</p>
+<p>Source code patch (2.4) is at;</p>
<ul>
-<li><a href="http://www.apache.org/dist/httpd/patches/apply_to_2.4.27/CVE-2017-9798-patch-2.4.patch"
->http://www.apache.org/dist/httpd/patches/apply_to_2.4.27/CVE-2017-9798-patch-2.4.patch</a></li>
+<li><a href="https://www.apache.org/dist/httpd/patches/apply_to_2.4.27/CVE-2017-9798-patch-2.4.patch"
+>CVE-2017-9798-patch-2.4.patch</a></li>
</ul>
+<p>Source code patch (2.2) is at;</p>
+<ul>
+<li><a href="https://archive.apache.org/dist/httpd/patches/apply_to_2.2.34/CVE-2017-9798-patch-2.2.patch"
+>CVE-2017-9798-patch-2.2.patch</a></li>
+</ul>
+<p>Note 2.2 is end-of-life, no further release with this fix is planned. Users
+are encouraged to migrate to 2.4.28 or later for this and other fixes.</p>
</description>
<acknowledgements>
We would like to thank Hanno Böck for reporting this issue.
@@ -281,31 +297,6 @@ We would like to thank Hanno Böck for
<affects prod="httpd" version="2.4.3"/>
<affects prod="httpd" version="2.4.2"/>
<affects prod="httpd" version="2.4.1"/>
-</issue>
-
-<issue fixed="2.2.35-dev" reported="20170712" public="20170918" released="">
-<cve name="CVE-2017-9798"/>
-<severity level="4">low</severity>
-<title>Use-after-free when using <Limit > with an unrecognized method in .htaccess ("OptionsBleed")</title>
-<description>
-<p>When an unrecognized HTTP Method is given in an <Limit {method}>
-directive in an .htaccess file, and that .htaccess file is processed by the
-corresponding request, the global methods table is corrupted in the current
-worker process, resulting in erratic behaviour.</p>
-<p>This behavior may be avoided by listing all unusual HTTP Methods in a global
-httpd.conf RegisterHttpMethod directive in httpd release 2.2.32 and later.</p>
-<p>To permit other .htaccess directives while denying the <Limit > directive, see the AllowOverrideList directive.</p>
-<p>Source code patch is at;</p>
-<ul>
-<li><a href="http://www.apache.org/dist/httpd/patches/apply_to_2.2.34/CVE-2017-9798-patch-2.2.patch"
->http://www.apache.org/dist/httpd/patches/apply_to_2.2.34/CVE-2017-9798-patch-2.2.patch</a></li>
-</ul>
-<p>Note 2.2 is end-of-life, no further release with this fix is planned. Users
-are encouraged to migrate to 2.4.28 or later for this and other fixes.</p>
-</description>
-<acknowledgements>
-We would like to thank Hanno Böck for reporting this issue.
-</acknowledgements>
<affects prod="httpd" version="2.2.34"/>
<affects prod="httpd" version="2.2.32"/>
<affects prod="httpd" version="2.2.31"/>
@@ -338,7 +329,8 @@ We would like to thank Hanno Böck for
<affects prod="httpd" version="2.2.0"/>
</issue>
-<issue fixed="2.4.27" reported="20170630" public="20170711" released="20170711">
+<issue reported="20170630" public="20170711">
+<fixed base="2.4" version="2.4.27" date="20170711"/>
<cve name="CVE-2017-9789"/>
<severity level="2">important</severity>
<title>Read after free in mod_http2</title>
@@ -353,7 +345,9 @@ We would like to thank Robert ÅwiÄ
<affects prod="httpd" version="2.4.26"/>
</issue>
-<issue fixed="2.4.27" reported="20170628" public="20170711" released="20170711">
+<issue reported="20170628" public="20170711">
+<fixed base="2.4" version="2.4.27" date="20170711"/>
+<fixed base="2.2" version="2.2.34" date="20170711"/>
<cve name="CVE-2017-9788"/>
<severity level="2">important</severity>
<title>Uninitialized memory reflection in mod_auth_digest</title>
@@ -387,26 +381,6 @@ We would like to thank Robert ÅwiÄ
<affects prod="httpd" version="2.4.3"/>
<affects prod="httpd" version="2.4.2"/>
<affects prod="httpd" version="2.4.1"/>
-</issue>
-
-<issue fixed="2.2.34" reported="20170628" public="20170711" released="20170711">
-<cve name="CVE-2017-9788"/>
-<severity level="2">important</severity>
-<title>Uninitialized memory reflection in mod_auth_digest</title>
-<description><p>
-The value placeholder in [Proxy-]Authorization headers
-of type 'Digest' was not initialized or reset
-before or between successive key=value assignments.
-by mod_auth_digest.
-</p><p>
-Providing an initial key with no '=' assignment
-could reflect the stale value of uninitialized pool
-memory used by the prior request, leading to leakage
-of potentially confidential information, and a segfault.
-</p></description>
-<acknowledgements>
-We would like to thank Robert ÅwiÄcki for reporting this issue.
-</acknowledgements>
<affects prod="httpd" version="2.2.32"/>
<affects prod="httpd" version="2.2.31"/>
<affects prod="httpd" version="2.2.29"/>
@@ -438,7 +412,9 @@ We would like to thank Robert ÅwiÄ
<affects prod="httpd" version="2.2.0"/>
</issue>
-<issue fixed="2.4.26" reported="20170206" public="20170619" released="20170619">
+<issue reported="20170206" public="20170619">
+<fixed base="2.4" version="2.4.26" date="20170619"/>
+<fixed base="2.2" version="2.2.34" date="20170711"/>
<cve name="CVE-2017-3167"/>
<severity level="2">important</severity>
<title>ap_get_basic_auth_pw() Authentication Bypass</title>
@@ -471,26 +447,6 @@ We would like to thank Emmanuel Dreyfus
<affects prod="httpd" version="2.4.3"/>
<affects prod="httpd" version="2.4.2"/>
<affects prod="httpd" version="2.4.1"/>
-</issue>
-
-<issue fixed="2.2.34" reported="20170206" public="20170619" released="20170711">
-<cve name="CVE-2017-3167"/>
-<severity level="2">important</severity>
-<title>ap_get_basic_auth_pw() Authentication Bypass</title>
-<description><p>
-Use of the ap_get_basic_auth_pw() by third-party modules outside of the
-authentication phase may lead to authentication requirements being bypassed.
-</p><p>
-Third-party module writers SHOULD use ap_get_basic_auth_components(), available
-in 2.2.34 and 2.4.26, instead of ap_get_basic_auth_pw(). Modules which call the
-legacy ap_get_basic_auth_pw() during the authentication phase MUST either
-immediately authenticate the user after the call, or else stop the request
-immediately with an error response, to avoid incorrectly authenticating the
-current request.
-</p></description>
-<acknowledgements>
-We would like to thank Emmanuel Dreyfus for reporting this issue.
-</acknowledgements>
<affects prod="httpd" version="2.2.32"/>
<affects prod="httpd" version="2.2.31"/>
<affects prod="httpd" version="2.2.29"/>
@@ -522,7 +478,9 @@ We would like to thank Emmanuel Dreyfus
<affects prod="httpd" version="2.2.0"/>
</issue>
-<issue fixed="2.4.26" reported="20161205" public="20170619" released="20170619">
+<issue reported="20161205" public="20170619">
+<fixed base="2.4" version="2.4.26" date="20170619"/>
+<fixed base="2.2" version="2.2.34" date="20170711"/>
<cve name="CVE-2017-3169"/>
<severity level="2">important</severity>
<title>mod_ssl Null Pointer Dereference</title>
@@ -549,20 +507,6 @@ reporting this issue.
<affects prod="httpd" version="2.4.3"/>
<affects prod="httpd" version="2.4.2"/>
<affects prod="httpd" version="2.4.1"/>
-</issue>
-
-<issue fixed="2.2.34" reported="20161205" public="20170619" released="20170711">
-<cve name="CVE-2017-3169"/>
-<severity level="2">important</severity>
-<title>mod_ssl Null Pointer Dereference</title>
-<description><p>
-mod_ssl may dereference a NULL pointer when third-party modules call
-ap_hook_process_connection() during an HTTP request to an HTTPS port.
-</p></description>
-<acknowledgements>
-We would like to thank Vasileios Panopoulos and AdNovum Informatik AG for
-reporting this issue.
-</acknowledgements>
<affects prod="httpd" version="2.2.32"/>
<affects prod="httpd" version="2.2.31"/>
<affects prod="httpd" version="2.2.29"/>
@@ -594,7 +538,9 @@ reporting this issue.
<affects prod="httpd" version="2.2.0"/>
</issue>
-<issue fixed="2.4.26" reported="20161118" public="20170619" released="20170619">
+<issue reported="20161118" public="20170619">
+<fixed base="2.4" version="2.4.26" date="20170619"/>
+
<cve name="CVE-2017-7659"/>
<severity level="2">important</severity>
<title>mod_http2 Null Pointer Dereference</title>
@@ -608,7 +554,9 @@ We would like to thank Robert ÅwiÄ
<affects prod="httpd" version="2.4.25"/>
</issue>
-<issue fixed="2.4.26" reported="20170506" public="20170619" released="20170619">
+<issue reported="20170506" public="20170619">
+<fixed base="2.4" version="2.4.26" date="20170619"/>
+<fixed base="2.2" version="2.2.34" date="20170711"/>
<cve name="CVE-2017-7668"/>
<severity level="2">important</severity>
<title>ap_find_token() Buffer Overread</title>
@@ -624,27 +572,12 @@ We would like to thank Javier Jiménez
issue.
</acknowledgements>
<affects prod="httpd" version="2.4.25"/>
-</issue>
-
-<issue fixed="2.2.34" reported="20170506" public="20170619" released="20170711">
-<cve name="CVE-2017-7668"/>
-<severity level="2">important</severity>
-<title>ap_find_token() Buffer Overread</title>
-<description><p>
-The HTTP strict parsing changes added in 2.2.32 and 2.4.24 introduced a bug in
-token list parsing, which allows ap_find_token() to search past the end of its
-input string. By maliciously crafting a sequence of request headers, an attacker
-may be able to cause a segmentation fault, or to force ap_find_token() to return
-an incorrect value.
-</p></description>
-<acknowledgements>
-We would like to thank Javier Jiménez (javijmor@gmail.com) for reporting this
-issue.
-</acknowledgements>
<affects prod="httpd" version="2.2.32"/>
</issue>
-<issue fixed="2.4.26" reported="20151115" public="20170619" released="20170619">
+<issue reported="20151115" public="20170619">
+<fixed base="2.4" version="2.4.26" date="20170619"/>
+<fixed base="2.2" version="2.2.34" date="20170711"/>
<cve name="CVE-2017-7679"/>
<severity level="2">important</severity>
<title>mod_mime Buffer Overread</title>
@@ -670,19 +603,6 @@ We would like to thank ChenQin and Hanno
<affects prod="httpd" version="2.4.3"/>
<affects prod="httpd" version="2.4.2"/>
<affects prod="httpd" version="2.4.1"/>
-</issue>
-
-<issue fixed="2.2.34" reported="20151115" public="20170619" released="20170711">
-<cve name="CVE-2017-7679"/>
-<severity level="2">important</severity>
-<title>mod_mime Buffer Overread</title>
-<description><p>
-mod_mime can read one byte past the end of a buffer when sending a malicious
-Content-Type response header.
-</p></description>
-<acknowledgements>
-We would like to thank ChenQin and Hanno Böck for reporting this issue.
-</acknowledgements>
<affects prod="httpd" version="2.2.32"/>
<affects prod="httpd" version="2.2.31"/>
<affects prod="httpd" version="2.2.29"/>
@@ -714,7 +634,9 @@ We would like to thank ChenQin and Hanno
<affects prod="httpd" version="2.2.0"/>
</issue>
-<issue fixed="2.4.25" reported="20160210" public="20161220" released="20161220">
+<issue reported="20160210" public="20161220">
+<fixed base="2.4" version="2.4.25" date="20161220"/>
+<fixed base="2.2" version="2.2.32" date="20170113"/>
<cve name="CVE-2016-8743"/>
<severity level="2">important</severity>
<title>Apache HTTP Request Parsing Whitespace Defects</title>
@@ -784,64 +706,6 @@ as well as Régis Leroy for each repor
<affects prod="httpd" version="2.4.3"/>
<affects prod="httpd" version="2.4.2"/>
<affects prod="httpd" version="2.4.1"/>
-</issue>
-
-<issue fixed="2.2.32" reported="20160210" public="20161220" released="20170113">
-<cve name="CVE-2016-8743"/>
-<severity level="2">important</severity>
-<title>Apache HTTP Request Parsing Whitespace Defects</title>
-<description><p>
-Apache HTTP Server, prior to release 2.4.25 (2.2.32), accepted a broad pattern
-of unusual whitespace patterns from the user-agent, including bare CR, FF, VTAB
-in parsing the request line and request header lines, as well as HTAB in
-parsing the request line. Any bare CR present in request lines was treated
-as whitespace and remained in the request field member "the_request", while
-a bare CR in the request header field name would be honored as whitespace,
-and a bare CR in the request header field value was retained the input headers
-array. Implied additional whitespace was accepted in the request line and prior
-to the ':' delimiter of any request header lines.
-</p><p>
-RFC7230 Section 3.5 calls out some of these whitespace exceptions, and section
-3.2.3 eliminated and clarified the role of implied whitespace in the grammer
-of this specification. Section 3.1.1 requires exactly one single SP between the
-method and request-target, and between the request-target and HTTP-version,
-followed immediately by a CRLF sequence. None of these fields permit any
-(unencoded) CTL character whatsoever. Section 3.2.4 explicitly disallowed
-any whitespace from the request header field prior to the ':' character, while
-Section 3.2 disallows all CTL characters in the request header line other than
-the HTAB character as whitespace.
-</p><p>
-These defects represent a security concern when httpd is participating in any
-chain of proxies or interacting with back-end application servers, either
-through mod_proxy or using conventional CGI mechanisms. In each case where one
-agent accepts such CTL characters and does not treat them as whitespace, there
-is the possiblity in a proxy chain of generating two responses from a server
-behind the uncautious proxy agent. In a sequence of two requests, this results
-in request A to the first proxy being interpreted as requests A + A' by the
-backend server, and if requests A and B were submitted to the first proxy in
-a keepalive connection, the proxy may interpret response A' as the response
-to request B, polluting the cache or potentially serving the A' content to
-a different downstream user-agent.
-</p><p>
-These defects are addressed with the release of Apache HTTP Server 2.4.25
-and coordinated by a new directive;
-</p>
-<ul><li>
-<a href="http://httpd.apache.org/docs/2.4/mod/core.html#httpprotocoloptions"
- >HttpProtocolOptions Strict</a></li></ul>
-<p>
-which is the default behavior of 2.4.25 and later. By toggling from 'Strict'
-behavior to 'Unsafe' behavior, some of the restrictions may be relaxed to allow
-some invalid HTTP/1.1 clients to communicate with the server, but this will
-reintroduce the possibility of the problems described in this assessment.
-Note that relaxing the behavior to 'Unsafe' will still not permit raw CTLs
-other than HTAB (where permitted), but will allow other RFC requirements to
-not be enforced, such as exactly two SP characters in the request line.
-</p></description>
-<acknowledgements>
-We would like to thank David Dennerline at IBM Security's X-Force Researchers
-as well as Régis Leroy for each reporting this issue.
-</acknowledgements>
<affects prod="httpd" version="2.2.31"/>
<affects prod="httpd" version="2.2.29"/>
<affects prod="httpd" version="2.2.27"/>
@@ -872,7 +736,8 @@ as well as Régis Leroy for each repor
<affects prod="httpd" version="2.2.0"/>
</issue>
-<issue fixed="2.4.25" reported="20161122" public="20161204" released="20161220">
+<issue reported="20161122" public="20161204">
+<fixed base="2.4" version="2.4.25" date="20161220"/>
<cve name="CVE-2016-8740"/>
<severity level="4">low</severity>
<title>HTTP/2 CONTINUATION denial of service</title>
@@ -885,7 +750,7 @@ as well as Régis Leroy for each repor
the server, leading to eventual memory exhaustion.
</p></description>
<acknowledgements>
-We would like to thank <a href="naveen.tiwari@asu.edu">Naveen Tiwari</a>
+We would like to thank Naveen Tiwari
and CDF/SEFCOM at Arizona State University to reporting this issue.
</acknowledgements>
<affects prod="httpd" version="2.4.23"/>
@@ -894,7 +759,9 @@ and CDF/SEFCOM at Arizona State Universi
<affects prod="httpd" version="2.4.17"/>
</issue>
-<issue fixed="2.4.25" reported="20160702" public="20160718" released="20161220">
+<issue reported="20160702" public="20160718">
+<fixed base="2.4" version="2.4.25" date="20161220"/>
+<fixed base="2.2" version="2.2.32" date="20160718"/>
<cve name="CVE-2016-5387"/>
<severity level="0">n/a</severity>
<title>HTTP_PROXY environment variable "httpoxy" mitigation</title>
@@ -908,8 +775,8 @@ and CDF/SEFCOM at Arizona State Universi
<p>
This workaround and patch are documented in the ASF Advisory at
<a href="https://www.apache.org/security/asf-httpoxy-response.txt"
- >https://www.apache.org/security/asf-httpoxy-response.txt</a>
- and incorporated in the 2.4.25 release.
+ >asf-httpoxy-response.txt</a>
+ and incorporated in the 2.4.25 and 2.2.32 releases.
</p><p>
Note: This is not assigned an httpd severity, as it is a defect in
other software which overloaded well-established CGI environment
@@ -933,9 +800,38 @@ for reporting and proposing a fix for th
<affects prod="httpd" version="2.4.3"/>
<affects prod="httpd" version="2.4.2"/>
<affects prod="httpd" version="2.4.1"/>
+<affects prod="httpd" version="2.2.31"/>
+<affects prod="httpd" version="2.2.29"/>
+<affects prod="httpd" version="2.2.27"/>
+<affects prod="httpd" version="2.2.26"/>
+<affects prod="httpd" version="2.2.25"/>
+<affects prod="httpd" version="2.2.24"/>
+<affects prod="httpd" version="2.2.23"/>
+<affects prod="httpd" version="2.2.22"/>
+<affects prod="httpd" version="2.2.21"/>
+<affects prod="httpd" version="2.2.20"/>
+<affects prod="httpd" version="2.2.19"/>
+<affects prod="httpd" version="2.2.18"/>
+<affects prod="httpd" version="2.2.17"/>
+<affects prod="httpd" version="2.2.16"/>
+<affects prod="httpd" version="2.2.15"/>
+<affects prod="httpd" version="2.2.14"/>
+<affects prod="httpd" version="2.2.13"/>
+<affects prod="httpd" version="2.2.12"/>
+<affects prod="httpd" version="2.2.11"/>
+<affects prod="httpd" version="2.2.10"/>
+<affects prod="httpd" version="2.2.9"/>
+<affects prod="httpd" version="2.2.8"/>
+<affects prod="httpd" version="2.2.6"/>
+<affects prod="httpd" version="2.2.5"/>
+<affects prod="httpd" version="2.2.4"/>
+<affects prod="httpd" version="2.2.3"/>
+<affects prod="httpd" version="2.2.2"/>
+<affects prod="httpd" version="2.2.0"/>
</issue>
-<issue fixed="2.4.25" reported="20160711" public="20161220" released="20161220">
+<issue reported="20160711" public="20161220">
+<fixed base="2.4" version="2.4.25" date="20161220"/>
<cve name="CVE-2016-2161"/>
<severity level="4">low</severity>
<title>DoS vulnerability in mod_auth_digest</title>
@@ -962,7 +858,8 @@ We would like to thank Maksim Malyutin f
<affects prod="httpd" version="2.4.1"/>
</issue>
-<issue fixed="2.4.25" reported="20160120" public="20161220" released="20161220">
+<issue reported="20160120" public="20161220">
+<fixed base="2.4" version="2.4.25" date="20161220"/>
<cve name="CVE-2016-0736"/>
<severity level="4">low</severity>
<title>Padding Oracle in Apache mod_session_crypto</title>
@@ -994,57 +891,8 @@ this issue.
<affects prod="httpd" version="2.4.1"/>
</issue>
-<issue fixed="2.2.32" reported="20160702" public="20160718" released="20160718">
-<cve name="CVE-2016-5387"/>
-<severity level="0">n/a</severity>
-<title>HTTP_PROXY environment variable "httpoxy" mitigation</title>
-<description><p>
- HTTP_PROXY is a well-defined environment variable in a CGI process,
- which collided with a number of libraries which failed to avoid
- colliding with this CGI namespace. A mitigation is provided for the
- httpd CGI environment to avoid populating the "HTTP_PROXY" variable
- from a "Proxy:" header, which has never been registered by IANA.
-</p>
-<p>
- This workaround and patch are documented in the ASF Advisory at
- <a href="https://www.apache.org/security/asf-httpoxy-response.txt"
- >https://www.apache.org/security/asf-httpoxy-response.txt</a>
-</p></description>
-<acknowledgements>
-We would like to thank Dominic Scheirlinck and Scott Geary of Vend
-for reporting and proposing a fix for this issue.
-</acknowledgements>
-<affects prod="httpd" version="2.2.31"/>
-<affects prod="httpd" version="2.2.29"/>
-<affects prod="httpd" version="2.2.27"/>
-<affects prod="httpd" version="2.2.26"/>
-<affects prod="httpd" version="2.2.25"/>
-<affects prod="httpd" version="2.2.24"/>
-<affects prod="httpd" version="2.2.23"/>
-<affects prod="httpd" version="2.2.22"/>
-<affects prod="httpd" version="2.2.21"/>
-<affects prod="httpd" version="2.2.20"/>
-<affects prod="httpd" version="2.2.19"/>
-<affects prod="httpd" version="2.2.18"/>
-<affects prod="httpd" version="2.2.17"/>
-<affects prod="httpd" version="2.2.16"/>
-<affects prod="httpd" version="2.2.15"/>
-<affects prod="httpd" version="2.2.14"/>
-<affects prod="httpd" version="2.2.13"/>
-<affects prod="httpd" version="2.2.12"/>
-<affects prod="httpd" version="2.2.11"/>
-<affects prod="httpd" version="2.2.10"/>
-<affects prod="httpd" version="2.2.9"/>
-<affects prod="httpd" version="2.2.8"/>
-<affects prod="httpd" version="2.2.6"/>
-<affects prod="httpd" version="2.2.5"/>
-<affects prod="httpd" version="2.2.4"/>
-<affects prod="httpd" version="2.2.3"/>
-<affects prod="httpd" version="2.2.2"/>
-<affects prod="httpd" version="2.2.0"/>
-</issue>
-
-<issue fixed="2.4.23" reported="20160630" public="20160705" released="20160705">
+<issue reported="20160630" public="20160705">
+<fixed base="2.4" version="2.4.23" date="20160705"/>
<cve name="CVE-2016-4979"/>
<severity level="2">important</severity>
<title>TLS/SSL X.509 client certificate auth bypass with HTTP/2</title>
@@ -1062,7 +910,8 @@ This issue was reported by Erki Aring.
</acknowledgements>
</issue>
-<issue fixed="2.4.20" reported="20160202" public="20160411" released="20160411">
+<issue reported="20160202" public="20160411">
+<fixed base="2.4" version="2.4.20" date="20160411"/>
<cve name="CVE-2016-1546"/>
<severity level="4">low</severity>
<title>mod_http2: denial of service by thread starvation</title>
@@ -1081,18 +930,16 @@ This issue was reported by Noam Mazor.
</acknowledgements>
</issue>
-
-<issue fixed="2.4.16" reported="20150128" public="20150204" released="20150715">
+<issue reported="20150128" public="20150204">
+<fixed base="2.4" version="2.4.16" date="20150715"/>
<cve name="CVE-2015-0228"/>
<severity level="4">low</severity>
<title>mod_lua: Crash in websockets PING handling</title>
<description><p>
-
A stack recursion crash in the mod_lua module was found. A Lua
script executing the r:wsupgrade() function could crash the process
if a malicious client sent a carefully crafted PING request. This
issue affected releases 2.4.7 through 2.4.12 inclusive.
-
</p></description>
<affects prod="httpd" version="2.4.12"/>
<affects prod="httpd" version="2.4.10"/>
@@ -1102,36 +949,33 @@ This issue was reported by Noam Mazor.
This issue was reported by Guido Vranken.
</acknowledgements>
</issue>
-
-<issue fixed="2.4.16" reported="20150203" public="20150305" released="20150715">
+<issue reported="20150203" public="20150305">
+<fixed base="2.4" version="2.4.16" date="20150715"/>
<cve name="CVE-2015-0253"/>
<severity level="4">low</severity>
<title>Crash in ErrorDocument 400 handling</title>
<description><p>
-
A crash in ErrorDocument handling was found. If ErrorDocument 400
was configured pointing to a local URL-path with the INCLUDES filter
active, a NULL dereference would occur when handling the error,
causing the child process to crash. This issue affected the 2.4.12
release only.
-
</p></description>
<affects prod="httpd" version="2.4.12"/>
</issue>
-
-<issue fixed="2.4.16" reported="20150404" public="20150609" released="20150715">
+<issue reported="20150404" public="20150609">
+<fixed base="2.4" version="2.4.16" date="20150715"/>
+<fixed base="2.2" version="2.2.31" date="20150716"/>
<cve name="CVE-2015-3183"/>
<severity level="4">low</severity>
<title>HTTP request smuggling attack against chunked request parser</title>
<description><p>
-
An HTTP request smuggling attack was possible due to a bug in parsing of
chunked requests. A malicious client could force the server to
misinterpret the request length, allowing cache poisoning or
- credential hijacking if an intermediary proxy is in use.
-
+ credential hijacking if an intermediary proxy is in use.
</p></description>
<affects prod="httpd" version="2.4.12"/>
<affects prod="httpd" version="2.4.10"/>
@@ -1142,23 +986,6 @@ This issue was reported by Guido Vranken
<affects prod="httpd" version="2.4.3"/>
<affects prod="httpd" version="2.4.2"/>
<affects prod="httpd" version="2.4.1"/>
-<acknowledgements>
-This issue was reported by Régis Leroy.
-</acknowledgements>
-</issue>
-
-<issue fixed="2.2.31" reported="20150404" public="20150609" released="20150716">
-<cve name="CVE-2015-3183"/>
-<severity level="4">low</severity>
-<title>HTTP request smuggling attack against chunked request parser</title>
-<description><p>
-
- An HTTP request smuggling attack was possible due to a bug in parsing of
- chunked requests. A malicious client could force the server to
- misinterpret the request length, allowing cache poisoning or
- credential hijacking if an intermediary proxy is in use.
-
-</p></description>
<affects prod="httpd" version="2.2.29"/>
<affects prod="httpd" version="2.2.27"/>
<affects prod="httpd" version="2.2.26"/>
@@ -1191,12 +1018,12 @@ This issue was reported by Régis Lero
</acknowledgements>
</issue>
-<issue fixed="2.4.16" reported="20130805" public="20150609" released="20150715">
+<issue reported="20130805" public="20150609">
<cve name="CVE-2015-3185"/>
+<fixed base="2.4" version="2.4.16" date="20150715"/>
<severity level="4">low</severity>
<title>ap_some_auth_required API unusable</title>
<description><p>
-
A design error in the "ap_some_auth_required" function renders the
API unusuable in httpd 2.4.x. In particular the API is documented
to answering if the request required authentication but only answers
@@ -1206,8 +1033,7 @@ This issue was reported by Régis Lero
the request is entirely unrestricted. This could lead to modules
using this API to allow access when they should otherwise not do so.
API users should use the new ap_some_authn_required API added in
- 2.4.16 instead.
-
+ 2.4.16 instead.
</p></description>
<affects prod="httpd" version="2.4.12"/>
<affects prod="httpd" version="2.4.10"/>
@@ -1225,7 +1051,8 @@ This issue was reported by Ben Reser.
</acknowledgements>
</issue>
-<issue fixed="2.4.12" reported="20141109" public="20141109" released="20150130">
+<issue reported="20141109" public="20141109">
+<fixed base="2.4" version="2.4.12" date="20150130"/>
<cve name="CVE-2014-8109"/>
<severity level="4">low</severity>
<title>mod_lua multiple "Require" directive handling is broken</title>
@@ -1244,7 +1071,8 @@ lead to different authentication rules t
<affects prod="httpd" version="2.4.1"/>
</issue>
-<issue fixed="2.4.12" reported="20140917" public="20141112" released="20150130">
+<issue reported="20140917" public="20141112">
+<fixed base="2.4" version="2.4.12" date="20150130"/>
<cve name="CVE-2014-3583"/>
<severity level="4">low</severity>
<title>mod_proxy_fcgi out-of-bounds memory read</title>
@@ -1260,7 +1088,8 @@ This issue was reported by Teguh P. Alko
<affects prod="httpd" version="2.4.10"/>
</issue>
-<issue fixed="2.4.12" reported="20140908" public="20140908" released="20150130">
+<issue reported="20140908" public="20140908">
+<fixed base="2.4" version="2.4.12" date="20150130"/>
<cve name="CVE-2014-3581"/>
<severity level="4">low</severity>
<title>mod_cache crash with empty Content-Type header</title>
@@ -1279,7 +1108,9 @@ This crash would only be a denial of ser
<affects prod="httpd" version="2.4.1"/>
</issue>
-<issue fixed="2.4.12" reported="20130906" public="20131019" released="20150130">
+<issue reported="20130906" public="20131019">
+<fixed base="2.4" version="2.4.12" date="20150130"/>
+<fixed base="2.2" version="2.2.29" date="20140903"/>
<cve name="CVE-2013-5704"/>
<severity level="4">low</severity>
<title>HTTP Trailers processing bypass</title>
@@ -1300,21 +1131,6 @@ This issue was reported by Martin Holst
<affects prod="httpd" version="2.4.3"/>
<affects prod="httpd" version="2.4.2"/>
<affects prod="httpd" version="2.4.1"/>
-</issue>
-
-<issue fixed="2.2.29" reported="20130906" public="20131019" released="20140903">
-<cve name="CVE-2013-5704"/>
-<severity level="4">low</severity>
-<title>HTTP Trailers processing bypass</title>
-<description><p>
-HTTP trailers could be used to replace HTTP headers late during request
-processing, potentially undoing or otherwise confusing modules that
-examined or modified request headers earlier.</p>
-<p>This fix adds the "MergeTrailers" directive to restore legacy behavior.
-</p></description>
-<acknowledgements>
-This issue was reported by Martin Holst Swende.
-</acknowledgements>
<affects prod="httpd" version="2.2.27"/>
<affects prod="httpd" version="2.2.26"/>
<affects prod="httpd" version="2.2.25"/>
@@ -1343,7 +1159,9 @@ This issue was reported by Martin Holst
<affects prod="httpd" version="2.2.0"/>
</issue>
-<issue fixed="2.4.10" reported="20140616" public="20140714" released="20140714">
+<issue reported="20140616" public="20140714">
+<fixed base="2.4" version="2.4.10" date="20140715"/>
+<fixed base="2.2" version="2.2.29" date="20140903"/>
<cve name="CVE-2014-0231"/>
<severity level="2">important</severity>
<title>mod_cgid denial of service</title>
@@ -1363,21 +1181,6 @@ This issue was reported by Rainer Jung o
<affects prod="httpd" version="2.4.3"/>
<affects prod="httpd" version="2.4.2"/>
<affects prod="httpd" version="2.4.1"/>
-</issue>
-
-<issue fixed="2.2.29" reported="20140616" public="20140714" released="20140903">
-<cve name="CVE-2014-0231"/>
-<severity level="2">important</severity>
-<title>mod_cgid denial of service</title>
-<description><p>
-A flaw was found in mod_cgid. If a server using mod_cgid hosted CGI
-scripts which did not consume standard input, a remote attacker could
-cause child processes to hang indefinitely, leading to denial of
-service.
-</p></description>
-<acknowledgements>
-This issue was reported by Rainer Jung of the ASF
-</acknowledgements>
<affects prod="httpd" version="2.2.27"/>
<affects prod="httpd" version="2.2.26"/>
<affects prod="httpd" version="2.2.25"/>
@@ -1406,7 +1209,8 @@ This issue was reported by Rainer Jung o
<affects prod="httpd" version="2.2.0"/>
</issue>
-<issue fixed="2.4.10" reported="20140407" public="20140715" released="20140715">
+<issue reported="20140407" public="20140715">
+<fixed base="2.4" version="2.4.10" date="20140715"/>
<cve name="CVE-2014-0117"/>
<severity level="3">moderate</severity>
<title>mod_proxy denial of service</title>
@@ -1423,7 +1227,8 @@ This issue was reported by Marek Kroemek
<affects prod="httpd" version="2.4.6"/>
</issue>
-<issue fixed="2.4.10" reported="20140701" public="20140715" released="20140715">
+<issue reported="20140701" public="20140715">
+<fixed base="2.4" version="2.4.10" date="20140715"/>
<cve name="CVE-2014-3523"/>
<severity level="2">important</severity>
<title>WinNT MPM denial of service</title>
@@ -1445,7 +1250,9 @@ This issue was reported by Jeff Trawick
<affects prod="httpd" version="2.4.1"/>
</issue>
-<issue fixed="2.4.10" reported="20140219" public="20140714" released="20140714">
+<issue reported="20140219" public="20140714">
+<fixed base="2.4" version="2.4.10" date="20140715"/>
+<fixed base="2.2" version="2.2.29" date="20140903"/>
<cve name="CVE-2014-0118"/>
<severity level="3">moderate</severity>
<title>mod_deflate denial of service</title>
@@ -1466,22 +1273,6 @@ This issue was reported by Giancarlo Pel
<affects prod="httpd" version="2.4.3"/>
<affects prod="httpd" version="2.4.2"/>
<affects prod="httpd" version="2.4.1"/>
-</issue>
-
-<issue fixed="2.2.29" reported="20140219" public="20140714" released="20140903">
-<cve name="CVE-2014-0118"/>
-<severity level="3">moderate</severity>
-<title>mod_deflate denial of service</title>
-<description><p>
-A resource consumption flaw was found in mod_deflate. If request body
-decompression was configured (using the "DEFLATE" input filter), a
-remote attacker could cause the server to consume significant memory
-and/or CPU resources. The use of request body decompression is not a common
-configuration.
-</p></description>
-<acknowledgements>
-This issue was reported by Giancarlo Pellegrino and Davide Balzarotti
-</acknowledgements>
<affects prod="httpd" version="2.2.27"/>
<affects prod="httpd" version="2.2.26"/>
<affects prod="httpd" version="2.2.25"/>
@@ -1510,7 +1301,9 @@ This issue was reported by Giancarlo Pel
<affects prod="httpd" version="2.2.0"/>
</issue>
-<issue fixed="2.4.10" reported="20140530" public="20140714" released="20140714">
+<issue reported="20140530" public="20140714">
+<fixed base="2.4" version="2.4.10" date="20140715"/>
+<fixed base="2.2" version="2.2.29" date="20140903"/>
<cve name="CVE-2014-0226"/>
<severity level="3">moderate</severity>
<title>mod_status buffer overflow</title>
@@ -1532,23 +1325,6 @@ This issue was reported by Marek Kroemek
<affects prod="httpd" version="2.4.3"/>
<affects prod="httpd" version="2.4.2"/>
<affects prod="httpd" version="2.4.1"/>
-</issue>
-
-<issue fixed="2.2.29" reported="20140530" public="20140714" released="20140903">
-<cve name="CVE-2014-0226"/>
-<severity level="3">moderate</severity>
-<title>mod_status buffer overflow</title>
-<description><p>
-A race condition was found in mod_status. An attacker able to access
-a public server status page on a server using a threaded MPM could send a
-carefully crafted request which could lead to a heap buffer overflow. Note
-that it is not a default or recommended configuration to have a public
-accessible server status page.
-</p></description>
-<acknowledgements>
-This issue was reported by Marek Kroemeke, AKAT-1 and
-22733db72ab3ed94b5f8a1ffcde850251fe6f466 via HP ZDI
-</acknowledgements>
<affects prod="httpd" version="2.2.27"/>
<affects prod="httpd" version="2.2.26"/>
<affects prod="httpd" version="2.2.25"/>
@@ -1577,20 +1353,9 @@ This issue was reported by Marek Kroemek
<affects prod="httpd" version="2.2.0"/>
</issue>
-<issue fixed="2.4.7" reported="20130914" public="20140714" released="20131126">
-<cve name="CVE-2013-4352"/>
-<severity level="4">low</severity>
-<title>mod_cache crash</title>
-<description><p>
-A NULL pointer dereference was found in mod_cache. A malicious HTTP
-server could cause a crash in a caching forward proxy configuration.
-(Note that this vulnerability was fixed in the 2.4.7 release, but the
-security impact was not disclosed at the time of the release.)
-</p></description>
-<affects prod="httpd" version="2.4.6"/>
-</issue>
-
-<issue fixed="2.4.9" reported="20140225" public="20140317" released="20140317">
+<issue reported="20140225" public="20140317">
+<fixed base="2.4" version="2.4.9" date="20140317"/>
+<fixed base="2.2" version="2.2.27" date="20140326"/>
<cve name="CVE-2014-0098"/>
<severity level="4">low</severity>
<title>mod_log_config crash</title>
@@ -1605,20 +1370,6 @@ denial of service if using a threaded MP
<affects prod="httpd" version="2.4.3"/>
<affects prod="httpd" version="2.4.2"/>
<affects prod="httpd" version="2.4.1"/>
-<acknowledgements>
-This issue was reported by Rainer M Canavan
-</acknowledgements>
-</issue>
-
-<issue fixed="2.2.27" reported="20140225" public="20140317" released="20140326">
-<cve name="CVE-2014-0098"/>
-<severity level="4">low</severity>
-<title>mod_log_config crash</title>
-<description><p>
-A flaw was found in mod_log_config. A remote attacker could send a
-specific truncated cookie causing a crash. This crash would only be a
-denial of service if using a threaded MPM.
-</p></description>
<affects prod="httpd" version="2.2.26"/>
<affects prod="httpd" version="2.2.25"/>
<affects prod="httpd" version="2.2.24"/>
@@ -1649,7 +1400,9 @@ This issue was reported by Rainer M Cana
</acknowledgements>
</issue>
-<issue fixed="2.4.9" reported="20131210" public="20140317" released="20140317">
+<issue reported="20131210" public="20140317">
+<fixed base="2.4" version="2.4.9" date="20140317"/>
+<fixed base="2.2" version="2.2.27" date="20140326"/>
<cve name="CVE-2013-6438"/>
<severity level="3">moderate</severity>
<title>mod_dav crash</title>
@@ -1659,27 +1412,15 @@ removing leading spaces and places a NUL
random crashes. This XML parsing code is only used with DAV provider modules
that support DeltaV, of which the only publicly released provider is mod_dav_svn.
</p></description>
+<acknowledgements>
+This issue was reported by Ning Zhang & Amin Tora of Neustar
+</acknowledgements>
<affects prod="httpd" version="2.4.7"/>
<affects prod="httpd" version="2.4.6"/>
<affects prod="httpd" version="2.4.4"/>
<affects prod="httpd" version="2.4.3"/>
<affects prod="httpd" version="2.4.2"/>
<affects prod="httpd" version="2.4.1"/>
-<acknowledgements>
-This issue was reported by Ning Zhang & Amin Tora of Neustar
-</acknowledgements>
-</issue>
-
-<issue fixed="2.2.27" reported="20131210" public="20140317" released="20140326">
-<cve name="CVE-2013-6438"/>
-<severity level="3">moderate</severity>
-<title>mod_dav crash</title>
-<description><p>
-XML parsing code in mod_dav incorrectly calculates the end of the string when
-removing leading spaces and places a NUL character outside the buffer, causing
-random crashes. This XML parsing code is only used with DAV provider modules
-that support DeltaV, of which the only publicly released provider is mod_dav_svn.
-</p></description>
<affects prod="httpd" version="2.2.26"/>
<affects prod="httpd" version="2.2.25"/>
<affects prod="httpd" version="2.2.24"/>
@@ -1705,30 +1446,25 @@ that support DeltaV, of which the only p
<affects prod="httpd" version="2.2.3"/>
<affects prod="httpd" version="2.2.2"/>
<affects prod="httpd" version="2.2.0"/>
-<acknowledgements>
-This issue was reported by Ning Zhang & Amin Tora of Neustar
-</acknowledgements>
</issue>
-<issue fixed="2.4.6" reported="20130307" public="20130523" released="20130722">
-<cve name="CVE-2013-1896"/>
-<severity level="3">moderate</severity>
-<title>mod_dav crash</title>
+<issue reported="20130914" public="20140714">
+<fixed base="2.4" version="2.4.7" date="20131126"/>
+<cve name="CVE-2013-4352"/>
+<severity level="4">low</severity>
+<title>mod_cache crash</title>
<description><p>
-Sending a MERGE request against a URI handled by mod_dav_svn with the
-source href (sent as part of the request body as XML) pointing to a
-URI that is not configured for DAV will trigger a segfault.
+A NULL pointer dereference was found in mod_cache. A malicious HTTP
+server could cause a crash in a caching forward proxy configuration.
+(Note that this vulnerability was fixed in the 2.4.7 release, but the
+security impact was not disclosed at the time of the release.)
</p></description>
-<acknowledgements>
-This issue was reported by Ben Reser
-</acknowledgements>
-<affects prod="httpd" version="2.4.4"/>
-<affects prod="httpd" version="2.4.3"/>
-<affects prod="httpd" version="2.4.2"/>
-<affects prod="httpd" version="2.4.1"/>
+<affects prod="httpd" version="2.4.6"/>
</issue>
-<issue fixed="2.2.25" reported="20130307" public="20130523" released="20130722">
+<issue reported="20130307" public="20130523">
+<fixed base="2.4" version="2.4.6" date="20130722"/>
+<fixed base="2.2" version="2.2.25" date="20130722"/>
<cve name="CVE-2013-1896"/>
<severity level="3">moderate</severity>
<title>mod_dav crash</title>
@@ -1740,6 +1476,10 @@ URI that is not configured for DAV will
<acknowledgements>
This issue was reported by Ben Reser
</acknowledgements>
+<affects prod="httpd" version="2.4.4"/>
+<affects prod="httpd" version="2.4.3"/>
+<affects prod="httpd" version="2.4.2"/>
+<affects prod="httpd" version="2.4.1"/>
<affects prod="httpd" version="2.2.23"/>
<affects prod="httpd" version="2.2.22"/>
<affects prod="httpd" version="2.2.21"/>
@@ -1764,7 +1504,9 @@ This issue was reported by Ben Reser
<affects prod="httpd" version="2.2.0"/>
</issue>
-<issue fixed="2.2.25" reported="20130313" public="20130419" released="20130722">
+<issue reported="20130313" public="20130419">
+<fixed base="2.2" version="2.2.25" date="20130722"/>
+<fixed base="2.0" version="2.0.65" date="20130722"/>
<cve name="CVE-2013-1862"/>
<severity level="4">low</severity>
<title>mod_rewrite log escape filtering</title>
@@ -1799,21 +1541,6 @@ This issue was reported by Ramiro Molina
<affects prod="httpd" version="2.2.3"/>
<affects prod="httpd" version="2.2.2"/>
<affects prod="httpd" version="2.2.0"/>
-</issue>
-
-<issue fixed="2.0.65" reported="20130313" public="20130419" released="20130722">
-<cve name="CVE-2013-1862"/>
-<severity level="4">low</severity>
-<title>mod_rewrite log escape filtering</title>
-<description><p>
-mod_rewrite does not filter terminal escape sequences from logs,
-which could make it easier for attackers to insert those sequences
-into terminal emulators containing vulnerabilities related to escape
-sequences.
-</p></description>
-<acknowledgements>
-This issue was reported by Ramiro Molina
-</acknowledgements>
<affects prod="httpd" version="2.0.64"/>
<affects prod="httpd" version="2.0.63"/>
<affects prod="httpd" version="2.0.61"/>
@@ -1840,7 +1567,8 @@ This issue was reported by Ramiro Molina
<affects prod="httpd" version="2.0.35"/>
</issue>
-<issue fixed="2.4.6" reported="20130529" public="20130722" released="20130722">
+<issue reported="20130529" public="20130722">
+<fixed base="2.4" version="2.4.6" date="20130722"/>
<cve name="CVE-2013-2249"/>
<severity level="3">moderate</severity>
<title>mod_session_dbd session fixation flaw</title>
@@ -1858,7 +1586,9 @@ This issue was reported by Takashi Sato
<affects prod="httpd" version="2.4.1"/>
</issue>
-<issue fixed="2.4.4" reported="20121007" public="20130218" released="20130225">
+<issue reported="20121007" public="20130218">
+<fixed base="2.4" version="2.4.4" date="20130225"/>
+<fixed base="2.2" version="2.2.24" date="20130225"/>
<cve name="CVE-2012-4558"/>
<severity level="3">moderate</severity>
<title>XSS in mod_proxy_balancer</title>
@@ -1872,36 +1602,6 @@ This issue was reported by Niels Heinen
<affects prod="httpd" version="2.4.3"/>
<affects prod="httpd" version="2.4.2"/>
<affects prod="httpd" version="2.4.1"/>
-</issue>
-
-<issue fixed="2.4.4" reported="20120711" public="20130218" released="20130225">
-<cve name="CVE-2012-3499"/>
-<severity level="4">low</severity>
-<title>XSS due to unescaped hostnames</title>
-<description><p>
-Various XSS flaws due to unescaped hostnames and URIs HTML output in
-mod_info, mod_status, mod_imagemap, mod_ldap, and mod_proxy_ftp.
-</p>
-</description>
-<acknowledgements>
-This issue was reported by Niels Heinen of Google
-</acknowledgements>
-<affects prod="httpd" version="2.4.3"/>
-<affects prod="httpd" version="2.4.2"/>
-<affects prod="httpd" version="2.4.1"/>
-</issue>
-
-<issue fixed="2.2.24" reported="20121007" public="20130218" released="20130225">
-<cve name="CVE-2012-4558"/>
-<severity level="3">moderate</severity>
-<title>XSS in mod_proxy_balancer</title>
-<description><p>
-A XSS flaw affected the mod_proxy_balancer manager interface.
-</p>
-</description>
-<acknowledgements>
-This issue was reported by Niels Heinen of Google
-</acknowledgements>
<affects prod="httpd" version="2.2.23"/>
<affects prod="httpd" version="2.2.22"/>
<affects prod="httpd" version="2.2.21"/>
@@ -1926,7 +1626,9 @@ This issue was reported by Niels Heinen
<affects prod="httpd" version="2.2.0"/>
</issue>
-<issue fixed="2.2.24" reported="20120711" public="20130218" released="20130225">
+<issue reported="20120711" public="20130218">
+<fixed base="2.4" version="2.4.4" date="20130225"/>
+<fixed base="2.2" version="2.2.24" date="20130225"/>
<cve name="CVE-2012-3499"/>
<severity level="4">low</severity>
<title>XSS due to unescaped hostnames</title>
@@ -1938,6 +1640,9 @@ mod_info, mod_status, mod_imagemap, mod_
<acknowledgements>
This issue was reported by Niels Heinen of Google
</acknowledgements>
+<affects prod="httpd" version="2.4.3"/>
+<affects prod="httpd" version="2.4.2"/>
+<affects prod="httpd" version="2.4.1"/>
<affects prod="httpd" version="2.2.23"/>
<affects prod="httpd" version="2.2.22"/>
<affects prod="httpd" version="2.2.21"/>
@@ -1962,7 +1667,9 @@ This issue was reported by Niels Heinen
<affects prod="httpd" version="2.2.0"/>
</issue>
-<issue fixed="2.2.23" reported="20120531" public="20120613" released="20120913">
+<issue reported="20120531" public="20120613">
+<fixed base="2.2" version="2.2.23" date="20120913"/>
+<fixed base="2.4" version="2.4.3" date="20120821"/>
<cve name="CVE-2012-2687"/>
<severity level="4">low</severity>
<title>XSS in mod_negotiation when untrusted uploads are supported</title>
@@ -1993,23 +1700,12 @@ untrusted uploads to locations which hav
<affects prod="httpd" version="2.2.3"/>
<affects prod="httpd" version="2.2.2"/>
<affects prod="httpd" version="2.2.0"/>
-</issue>
-
-<issue fixed="2.4.3" reported="20120531" public="20120613" released="20120821">
-<cve name="CVE-2012-2687"/>
-<severity level="4">low</severity>
-<title>XSS in mod_negotiation when untrusted uploads are supported</title>
-<description><p>
-Possible XSS for sites which use mod_negotiation and allow
-untrusted uploads to locations which have MultiViews enabled.
-</p>
-<p>Note: This issue is also known as CVE-2008-0455.</p>
-</description>
<affects prod="httpd" version="2.4.2"/>
<affects prod="httpd" version="2.4.1"/>
</issue>
-<issue fixed="2.4.3" reported="20120816" public="20120816" released="20120821">
+<issue reported="20120816" public="20120816">
+<fixed base="2.4" version="2.4.3" date="20120821"/>
<cve name="CVE-2012-3502"/>
<severity level="2">important</severity>
<title>Response mixup when using mod_proxy_ajp or mod_proxy_http</title>
@@ -2024,7 +1720,9 @@ between users.
<affects prod="httpd" version="2.4.1"/>
</issue>
-<issue fixed="2.2.23" reported="20120214" public="20120302" released="20120913">
+<issue reported="20120214" public="20120302">
+<fixed base="2.4" version="2.4.2" date="20120417"/>
+<fixed base="2.2" version="2.2.23" date="20120913"/>
<cve name="CVE-2012-0883"/>
<severity level="4">low</severity>
<title>insecure LD_LIBRARY_PATH handling</title>
@@ -2056,34 +1754,20 @@ administrator runs apachectl from an unt
<affects prod="httpd" version="2.2.3"/>
<affects prod="httpd" version="2.2.2"/>
<affects prod="httpd" version="2.2.0"/>
-</issue>
-
-<issue fixed="2.4.2" reported="20120214" public="20120302" released="20120417">
-<cve name="CVE-2012-0883"/>
-<severity level="4">low</severity>
-<title>insecure LD_LIBRARY_PATH handling</title>
-<description><p>
-Insecure handling of LD_LIBRARY_PATH was found that could
-lead to the current working directory to be searched for DSOs.
-This could allow a local user to execute code as root if an
-administrator runs apachectl from an untrusted directory.
-</p>
-</description>
<affects prod="httpd" version="2.4.1"/>
</issue>
-<issue fixed="2.2.22" reported="20121011" public="20120104" released="20120131">
+<issue reported="20121011" public="20120104">
+<fixed base="2.2" version="2.2.22" date="20120131"/>
<cve name="CVE-2012-4557"/>
<severity level="4">low</severity>
<title>mod_proxy_ajp remote DoS</title>
<description><p>
-
A flaw was found when mod_proxy_ajp connects to a backend server that
takes too long to respond. Given a specific configuration, a remote
attacker could send certain requests, putting a backend server into an
error state until the retry timeout expired. This could lead to a
temporary denial of service.</p>
-
</description>
<affects prod="httpd" version="2.2.21"/>
<affects prod="httpd" version="2.2.20"/>
@@ -2097,7 +1781,9 @@ temporary denial of service.</p>
<affects prod="httpd" version="2.2.12"/>
</issue>
-<issue fixed="2.2.22" reported="20111004" public="20111102" released="20120131">
+<issue reported="20111004" public="20111102">
+<fixed base="2.2" version="2.2.22" date="20120131"/>
+<fixed base="2.0" version="2.0.65" date="20130722"/>
<cve name="CVE-2011-3607"/>
<severity level="4">low</severity>
<title>mod_setenvif .htaccess privilege escalation</title>
@@ -2130,22 +1816,6 @@ This issue was reported by halfdog
<affects prod="httpd" version="2.2.3"/>
<affects prod="httpd" version="2.2.2"/>
<affects prod="httpd" version="2.2.0"/>
-</issue>
-
-
-<issue fixed="2.0.65" reported="20111004" public="20111102" released="20130722">
-<cve name="CVE-2011-3607"/>
-<severity level="4">low</severity>
-<title>mod_setenvif .htaccess privilege escalation</title>
-<description><p>
-An integer overflow flaw was found which, when the mod_setenvif module
-is enabled, could allow local users to gain privileges via a .htaccess
-file.
-</p>
-</description>
-<acknowledgements>
-This issue was reported by halfdog
-</acknowledgements>
<affects prod="httpd" version="2.0.64"/>
<affects prod="httpd" version="2.0.63"/>
<affects prod="httpd" version="2.0.61"/>
@@ -2172,7 +1842,8 @@ This issue was reported by halfdog
<affects prod="httpd" version="2.0.35"/>
</issue>
-<issue fixed="2.2.22" reported="20111020" public="20120122" released="20120131">
+<issue reported="20111020" public="20120122">
+<fixed base="2.2" version="2.2.22" date="20120131"/>
<cve name="CVE-2011-4317"/>
<severity level="3">moderate</severity>
<title>mod_proxy reverse proxy exposure </title>
@@ -2210,7 +1881,8 @@ This issue was reported by Prutha Parikh
<affects prod="httpd" version="2.2.0"/>
</issue>
-<issue fixed="2.2.22" reported="20111230" public="20111128" released="20120131">
+<issue reported="20111230" public="20111128">
+<fixed base="2.2" version="2.2.22" date="20120131"/>
<cve name="CVE-2012-0021"/>
<severity level="4">low</severity>
<title>mod_log_config crash</title>
@@ -2227,7 +1899,9 @@ This crash would only be a denial of ser
<affects prod="httpd" version="2.2.17"/>
</issue>
-<issue fixed="2.2.22" reported="20111230" public="20120111" released="20120131">
+<issue reported="20111230" public="20120111">
+<fixed base="2.2" version="2.2.22" date="20120131"/>
+<fixed base="2.0" version="2.0.65" date="20130722"/>
<cve name="CVE-2012-0031"/>
<severity level="4">low</severity>
<title>scoreboard parent DoS</title>
@@ -2260,21 +1934,6 @@ This issue was reported by halfdog
<affects prod="httpd" version="2.2.3"/>
<affects prod="httpd" version="2.2.2"/>
<affects prod="httpd" version="2.2.0"/>
-</issue>
-
-<issue fixed="2.0.65" reported="20111230" public="20120111" released="20130722">
-<cve name="CVE-2012-0031"/>
-<severity level="4">low</severity>
-<title>scoreboard parent DoS</title>
-<description><p>
-A flaw was found in the handling of the scoreboard. An
-unprivileged child process could cause the parent process to crash at
-shutdown rather than terminate cleanly.
-</p>
-</description>
-<acknowledgements>
-This issue was reported by halfdog
-</acknowledgements>
<affects prod="httpd" version="2.0.64"/>
<affects prod="httpd" version="2.0.63"/>
<affects prod="httpd" version="2.0.61"/>
@@ -2301,7 +1960,9 @@ This issue was reported by halfdog
<affects prod="httpd" version="2.0.35"/>
</issue>
-<issue fixed="2.2.22" reported="20120115" public="20120123" released="20120131">
+<issue reported="20120115" public="20120123">
+<fixed base="2.2" version="2.2.22" date="20120131"/>
+<fixed base="2.0" version="2.0.65" date="20130722"/>
<cve name="CVE-2012-0053"/>
<severity level="3">moderate</severity>
<title>error responses can expose cookies</title>
@@ -2334,21 +1995,6 @@ This issue was reported by Norman Hipper
<affects prod="httpd" version="2.2.3"/>
<affects prod="httpd" version="2.2.2"/>
<affects prod="httpd" version="2.2.0"/>
-</issue>
-
-<issue fixed="2.0.65" reported="20120115" public="20120123" released="20130722">
-<cve name="CVE-2012-0053"/>
-<severity level="3">moderate</severity>
-<title>error responses can expose cookies</title>
-<description><p>
-A flaw was found in the default error response for status code 400. This flaw could
-be used by an attacker to expose "httpOnly" cookies
-when no custom ErrorDocument is specified.
-</p>
-</description>
-<acknowledgements>
-This issue was reported by Norman Hippert
-</acknowledgements>
<affects prod="httpd" version="2.0.64"/>
<affects prod="httpd" version="2.0.63"/>
<affects prod="httpd" version="2.0.61"/>
@@ -2375,7 +2021,10 @@ This issue was reported by Norman Hipper
<affects prod="httpd" version="2.0.35"/>
</issue>
-<issue fixed="2.2.22" reported="20110916" public="20111005" released="20120131">
+<issue reported="20110916" public="20111005">
+<fixed base="2.2" version="2.2.22" date="20120131"/>
+<fixed base="2.0" version="2.0.65" date="20130722"/>
+<fixed base="1.3" version="1.3-never" date=""/>
<cve name="CVE-2011-3368"/>
<severity level="3">moderate</severity>
<title>mod_proxy reverse proxy exposure</title>
@@ -2386,6 +2035,9 @@ ProxyPassMatch, a remote attacker could
connect to an arbitrary server, possibly disclosing sensitive
information from internal web servers not directly accessible to
attacker.</p>
+<p>No update of 1.3 will be released. Patches will be published to
+<a href="https://archive.apache.org/dist/httpd/patches/apply_to_1.3.42/"
+>https://archive.apache.org/dist/httpd/patches/apply_to_1.3.42/</a></p>
</description>
<acknowledgements>
This issue was reported by Context Information Security Ltd
@@ -2410,23 +2062,6 @@ This issue was reported by Context Infor
<affects prod="httpd" version="2.2.3"/>
<affects prod="httpd" version="2.2.2"/>
<affects prod="httpd" version="2.2.0"/>
-</issue>
-
-<issue fixed="2.0.65" reported="20110916" public="20111005" released="20130712">
-<cve name="CVE-2011-3368"/>
-<severity level="3">moderate</severity>
-<title>mod_proxy reverse proxy exposure</title>
-<description><p>
-An exposure was found when using mod_proxy in reverse proxy mode.
-In certain configurations using RewriteRule with proxy flag or
-ProxyPassMatch, a remote attacker could cause the reverse proxy to
-connect to an arbitrary server, possibly disclosing sensitive
-information from internal web servers not directly accessible to
-attacker.</p>
-</description>
-<acknowledgements>
-This issue was reported by Context Information Security Ltd
-</acknowledgements>
<affects prod="httpd" version="2.0.64"/>
<affects prod="httpd" version="2.0.63"/>
<affects prod="httpd" version="2.0.61"/>
@@ -2451,26 +2086,6 @@ This issue was reported by Context Infor
<affects prod="httpd" version="2.0.37"/>
<affects prod="httpd" version="2.0.36"/>
<affects prod="httpd" version="2.0.35"/>
-</issue>
-
-<issue fixed="1.3-never" reported="20110916" public="20111005" released="">
-<cve name="CVE-2011-3368"/>
-<severity level="3">moderate</severity>
-<title>mod_proxy reverse proxy exposure</title>
-<description><p>
-An exposure was found when using mod_proxy in reverse proxy mode.
-In certain configurations using RewriteRule with proxy flag,
-a remote attacker could cause the reverse proxy to
-connect to an arbitrary server, possibly disclosing sensitive
-information from internal web servers not directly accessible to
-attacker.</p>
-<p>No update of 1.3 will be released. Patches will be published to
-<a href="http://archive.apache.org/dist/httpd/patches/apply_to_1.3.42/"
->http://archive.apache.org/dist/httpd/patches/apply_to_1.3.42/</a></p>
-</description>
-<acknowledgements>
-This issue was reported by Context Information Security Ltd
-</acknowledgements>
<affects prod="httpd" version="1.3.42"/>
<affects prod="httpd" version="1.3.41"/>
<affects prod="httpd" version="1.3.39"/>
@@ -2500,7 +2115,8 @@ This issue was reported by Context Infor
<affects prod="httpd" version="1.3.2"/>
</issue>
-<issue fixed="2.2.21" reported="20110907" public="20110914" released="20110914">
+<issue reported="20110907" public="20110914">
+<fixed base="2.2" version="2.2.21" date="20110914"/>
<cve name="CVE-2011-3348"/>
<severity level="3">moderate</severity>
<title>mod_proxy_ajp remote DoS</title>
@@ -2522,7 +2138,9 @@ This could lead to a temporary denial of
<affects prod="httpd" version="2.2.12"/>
</issue>
-<issue fixed="2.2.20" reported="20110820" public="20110820" released="20110830">
+<issue reported="20110820" public="20110820">
+<fixed base="2.2" version="2.2.20" date="20110830"/>
+<fixed base="2.0" version="2.0.65" date="20130712"/>
<cve name="CVE-2011-3192"/>
<severity level="2">important</severity>
<title>Range header remote DoS</title>
@@ -2533,7 +2151,7 @@ an excessive amount of memory and CPU ti
specially-crafted Range header. This could be used in a denial of
service attack. </p>
<p>
-Advisory: <a href="CVE-2011-3192.txt">CVE-2011-3192.txt</a>
+Advisory: <a href="https://httpd.apache.org/security/CVE-2011-3192.txt">CVE-2011-3192.txt</a>
</p>
</description>
<affects prod="httpd" version="2.2.19"/>
@@ -2554,22 +2172,6 @@ Advisory: <a href="CVE-2011-3192.txt">CV
<affects prod="httpd" version="2.2.3"/>
<affects prod="httpd" version="2.2.2"/>
<affects prod="httpd" version="2.2.0"/>
-</issue>
-
-<issue fixed="2.0.65" reported="20110820" public="20110820" released="20130712">
-<cve name="CVE-2011-3192"/>
-<severity level="2">important</severity>
-<title>Range header remote DoS</title>
-<description><p>
-A flaw was found in the way the Apache HTTP Server handled Range HTTP
-headers. A remote attacker could use this flaw to cause httpd to use
-an excessive amount of memory and CPU time via HTTP requests with a
-specially-crafted Range header. This could be used in a denial of
-service attack. </p>
-<p>
-Advisory: <a href="CVE-2011-3192.txt">CVE-2011-3192.txt</a>
-</p>
-</description>
<affects prod="httpd" version="2.0.64"/>
<affects prod="httpd" version="2.0.63"/>
<affects prod="httpd" version="2.0.61"/>
@@ -2596,7 +2198,9 @@ Advisory: <a href="CVE-2011-3192.txt">CV
<affects prod="httpd" version="2.0.35"/>
</issue>
-<issue fixed="2.2.19" reported="20110302" public="20110510" released="20110521">
+<issue reported="20110302" public="20110510">
+<fixed base="2.2" version="2.2.19" date="20110521"/>
+<fixed base="2.0" version="2.0.65" date="20110521"/>
<cve name="CVE-2011-0419"/>
<severity level="3">moderate</severity>
<title>apr_fnmatch flaw leads to mod_autoindex remote DoS</title>
@@ -2613,6 +2217,7 @@ directive disables processing of the cli
arguments, preventing this attack.
</p><p>
Resolution: Update APR to release 1.4.5 (bundled with httpd 2.2.19)
+or release 0.9.20 (bundled with httpd 2.0.65)
</p>
</description>
<acknowledgements>
@@ -2635,30 +2240,6 @@ This issue was reported by Maksymilian A
<affects prod="httpd" version="2.2.3"/>
<affects prod="httpd" version="2.2.2"/>
<affects prod="httpd" version="2.2.0"/>
-</issue>
-
-<issue fixed="2.0.65" reported="20110302" public="20110510" released="20110521">
-<cve name="CVE-2011-0419"/>
-<severity level="3">moderate</severity>
-<title>apr_fnmatch flaw leads to mod_autoindex remote DoS</title>
-<description><p>
-A flaw was found in the apr_fnmatch() function of the bundled APR
-library. Where mod_autoindex is enabled, and a directory indexed by
-mod_autoindex contained files with sufficiently long names, a
-remote attacker could send a carefully crafted request which would
-cause excessive CPU usage. This could be used in a denial of service
-attack.
-</p><p>
-Workaround: Setting the 'IgnoreClient' option to the 'IndexOptions'
-directive disables processing of the client-supplied request query
-arguments, preventing this attack.
-</p><p>
-Resolution: Update APR to release 0.9.20 (to be bundled with httpd 2.0.65)
-</p>
-</description>
-<acknowledgements>
-This issue was reported by Maksymilian Arciemowicz
-</acknowledgements>
<affects prod="httpd" version="2.0.64"/>
<affects prod="httpd" version="2.0.63"/>
<affects prod="httpd" version="2.0.61"/>
@@ -2685,7 +2266,9 @@ This issue was reported by Maksymilian A
<affects prod="httpd" version="2.0.35"/>
</issue>
-<issue fixed="2.2.17" reported="20090821" public="20090117" released="20101019">
+<issue reported="20090821" public="20090117">
+<fixed base="2.2" version="2.2.17" date="20101019"/>
+<fixed base="2.0" version="2.0.64" date="20101019"/>
<cve name="CVE-2009-3720"/>
<severity level="4">low</severity>
<title>expat DoS</title>
@@ -2712,20 +2295,6 @@ be a denial of service if using the work
<affects prod="httpd" version="2.2.3"/>
<affects prod="httpd" version="2.2.2"/>
<affects prod="httpd" version="2.2.0"/>
-</issue>
-
-<issue fixed="2.0.64" reported="20090821" public="20090117" released="20101019">
-<cve name="CVE-2009-3720"/>
-<severity level="4">low</severity>
-<title>expat DoS</title>
-<description><p>
-A buffer over-read flaw was found in the bundled expat
-library. An attacker who is able to get Apache to parse
-an untrused XML document (for example through mod_dav) may
-be able to cause a crash. This crash would only
-be a denial of service if using the worker MPM.
-</p>
-</description>
<affects prod="httpd" version="2.0.63"/>
<affects prod="httpd" version="2.0.61"/>
<affects prod="httpd" version="2.0.59"/>
@@ -2751,7 +2320,9 @@ be a denial of service if using the work
<affects prod="httpd" version="2.0.35"/>
</issue>
-<issue fixed="2.2.17" reported="20091218" public="20091202" released="20101019">
+<issue reported="20091218" public="20091202">
+<fixed base="2.2" version="2.2.17" date="20101019"/>
+<fixed base="2.0" version="2.0.64" date="20101019"/>
<cve name="CVE-2009-3560"/>
<severity level="4">low</severity>
<title>expat DoS</title>
@@ -2778,20 +2349,6 @@ be a denial of service if using the work
<affects prod="httpd" version="2.2.3"/>
<affects prod="httpd" version="2.2.2"/>
<affects prod="httpd" version="2.2.0"/>
-</issue>
-
-<issue fixed="2.0.64" reported="20091218" public="20091202" released="20101019">
-<cve name="CVE-2009-3560"/>
-<severity level="4">low</severity>
-<title>expat DoS</title>
-<description><p>
-A buffer over-read flaw was found in the bundled expat
-library. An attacker who is able to get Apache to parse
-an untrused XML document (for example through mod_dav) may
-be able to cause a crash. This crash would only
-be a denial of service if using the worker MPM.
-</p>
-</description>
<affects prod="httpd" version="2.0.63"/>
<affects prod="httpd" version="2.0.61"/>
<affects prod="httpd" version="2.0.59"/>
@@ -2817,7 +2374,9 @@ be a denial of service if using the work
<affects prod="httpd" version="2.0.35"/>
</issue>
-<issue fixed="2.2.17" reported="20100303" public="20101001" released="20101019">
+<issue reported="20100303" public="20101001">
+<fixed base="2.2" version="2.2.17" date="20101019"/>
+<fixed base="2.0" version="2.0.64" date="20101019"/>
<cve name="CVE-2010-1623"/>
<severity level="4">low</severity>
<title>apr_bridage_split_line DoS</title>
@@ -2844,20 +2403,6 @@ service.
<affects prod="httpd" version="2.2.3"/>
<affects prod="httpd" version="2.2.2"/>
<affects prod="httpd" version="2.2.0"/>
-</issue>
-
-<issue fixed="2.0.64" reported="20100303" public="20101001" released="20101019">
-<cve name="CVE-2010-1623"/>
-<severity level="4">low</severity>
-<title>apr_bridage_split_line DoS</title>
-<description><p>
-A flaw was found in the apr_brigade_split_line() function of the bundled
-APR-util library, used to process non-SSL requests. A remote attacker
-could send requests, carefully crafting the timing of individual bytes,
-which would slowly consume memory, potentially leading to a denial of
-service.
-</p>
-</description>
<affects prod="httpd" version="2.0.63"/>
<affects prod="httpd" version="2.0.61"/>
<affects prod="httpd" version="2.0.59"/>
@@ -2883,12 +2428,14 @@ service.
<affects prod="httpd" version="2.0.35"/>
</issue>
-<issue fixed="2.2.16" reported="20100504" public="20100725" released="20100725">
+<issue reported="20100504" public="20100725">
+<fixed base="2.2" version="2.2.16" date="20100725"/>
+<fixed base="2.0" version="2.0.64" date="20101019"/>
<cve name="CVE-2010-1452"/>
<severity level="4">low</severity>
<title>mod_cache and mod_dav DoS</title>
<description><p>
-A flaw was found in the handling of requests by mod_cache and mod_dav.
+A flaw was found in the handling of requests by mod_cache (2.2) and mod_dav (2.0 and 2.2).
A malicious remote attacker could send a carefully crafted request and
cause a httpd child process to crash. This crash would only
be a denial of service if using the worker MPM. This issue is further
@@ -2915,24 +2462,6 @@ This issue was reported by Mark Drayton.
<affects prod="httpd" version="2.2.3"/>
<affects prod="httpd" version="2.2.2"/>
<affects prod="httpd" version="2.2.0"/>
-</issue>
-
-
-<issue fixed="2.0.64" reported="20100504" public="20100725" released="20101019">
-<cve name="CVE-2010-1452"/>
-<severity level="4">low</severity>
-<title>mod_dav DoS</title>
-<description><p>
-A flaw was found in the handling of requests by mod_dav. A malicious remote
-attacker could send a carefully crafted request and cause a httpd child process
-to crash. This crash would only be a denial of service if using the worker MPM.
-This issue is further mitigated as mod_dav is only affected by requests that are
-most likely to be authenticated.
-</p>
-</description>
-<acknowledgements>
-This issue was reported by Mark Drayton.
-</acknowledgements>
<affects prod="httpd" version="2.0.63"/>
<affects prod="httpd" version="2.0.61"/>
<affects prod="httpd" version="2.0.59"/>
@@ -2959,7 +2488,8 @@ This issue was reported by Mark Drayton.
</issue>
-<issue fixed="2.2.16" reported="20100609" public="20100609" released="20100725">
+<issue reported="20100609" public="20100609">
+<fixed base="2.2" version="2.2.16" date="20100725"/>
<cve name="CVE-2010-2068"/>
<severity level="2">important</severity>
<title>Timeout detection flaw (mod_proxy_http)</title>
@@ -2974,15 +2504,15 @@ yet introduced. The simplest workaround
<p>SetEnv proxy-nokeepalive 1</p>
<p>Source code patches are at;</p>
<ul>
-<li><a href="http://www.apache.org/dist/httpd/patches/apply_to_2.2.15/CVE-2010-2068-r953616.patch"
->http://www.apache.org/dist/httpd/patches/apply_to_2.2.15/CVE-2010-2068-r953616.patch</a></li>
-<li><a href="http://www.apache.org/dist/httpd/patches/apply_to_2.3.5/CVE-2010-2068-r953418.patch"
->http://www.apache.org/dist/httpd/patches/apply_to_2.3.5/CVE-2010-2068-r953418.patch</a></li>
+<li>2.2.15: <a href="https://archive.apache.org/dist/httpd/patches/apply_to_2.2.15/CVE-2010-2068-r953616.patch"
+>CVE-2010-2068-r953616.patch</a></li>
+<li>2.3.5: <a href="https://archive.apache.org/dist/httpd/patches/apply_to_2.3.5/CVE-2010-2068-r953418.patch"
+>CVE-2010-2068-r953418.patch</a></li>
</ul>
<p>Binary replacement modules are at</p>
<ul>
-<li><a href="http://www.apache.org/dist/httpd/binaries/win32/mod_proxy_http-CVE-2010-2068.zip"
->http://www.apache.org/dist/httpd/binaries/win32/mod_proxy_http-CVE-2010-2068.zip</a></li>
+<li><a href="https://archive.apache.org/dist/httpd/binaries/win32/mod_proxy_http-CVE-2010-2068.zip"
+>mod_proxy_http-CVE-2010-2068.zip</a></li>
</ul>
</description>
<acknowledgements>
@@ -3001,7 +2531,9 @@ reporting of this issue.
</issue>
-<issue fixed="2.2.15" reported="20091209" public="20091209" released="20100305">
+<issue reported="20091209" public="20091209">
+<fixed base="2.2" version="2.2.15" date="20100305"/>
+<fixed base="2.0" version="2.0.64" date="20101019"/>
<cve name="CVE-2010-0434"/>
<severity level="4">low</severity>
<title>Subrequest handling of request headers (mod_headers)</title>
@@ -3034,9 +2566,34 @@ fix for this issue.
<affects prod="httpd" version="2.2.3"/>
<affects prod="httpd" version="2.2.2"/>
<affects prod="httpd" version="2.2.0"/>
+<affects prod="httpd" version="2.0.63"/>
+<affects prod="httpd" version="2.0.61"/>
+<affects prod="httpd" version="2.0.59"/>
+<affects prod="httpd" version="2.0.58"/>
+<affects prod="httpd" version="2.0.55"/>
+<affects prod="httpd" version="2.0.54"/>
+<affects prod="httpd" version="2.0.53"/>
+<affects prod="httpd" version="2.0.52"/>
+<affects prod="httpd" version="2.0.51"/>
+<affects prod="httpd" version="2.0.50"/>
+<affects prod="httpd" version="2.0.49"/>
+<affects prod="httpd" version="2.0.48"/>
+<affects prod="httpd" version="2.0.47"/>
+<affects prod="httpd" version="2.0.46"/>
+<affects prod="httpd" version="2.0.45"/>
+<affects prod="httpd" version="2.0.44"/>
+<affects prod="httpd" version="2.0.43"/>
+<affects prod="httpd" version="2.0.42"/>
+<affects prod="httpd" version="2.0.40"/>
+<affects prod="httpd" version="2.0.39"/>
+<affects prod="httpd" version="2.0.37"/>
+<affects prod="httpd" version="2.0.36"/>
+<affects prod="httpd" version="2.0.35"/>
</issue>
-<issue fixed="2.2.15" reported="20100209" public="20100302" released="20100305">
+<issue reported="20100209" public="20100302">
+<fixed base="2.2" version="2.2.15" date="20100305"/>
+<fixed base="2.0" version="2.0.64" date="20101019"/>
<cve name="CVE-2010-0425"/>
<severity level="2">important</severity>
<title>mod_isapi module unload flaw</title>
@@ -3065,9 +2622,31 @@ proposing a patch fix for this issue.
<affects prod="httpd" version="2.2.3"/>
<affects prod="httpd" version="2.2.2"/>
<affects prod="httpd" version="2.2.0"/>
+<affects prod="httpd" version="2.0.63"/>
+<affects prod="httpd" version="2.0.61"/>
+<affects prod="httpd" version="2.0.59"/>
+<affects prod="httpd" version="2.0.58"/>
+<affects prod="httpd" version="2.0.55"/>
+<affects prod="httpd" version="2.0.54"/>
+<affects prod="httpd" version="2.0.53"/>
+<affects prod="httpd" version="2.0.52"/>
+<affects prod="httpd" version="2.0.51"/>
+<affects prod="httpd" version="2.0.50"/>
+<affects prod="httpd" version="2.0.49"/>
+<affects prod="httpd" version="2.0.48"/>
+<affects prod="httpd" version="2.0.47"/>
+<affects prod="httpd" version="2.0.46"/>
+<affects prod="httpd" version="2.0.45"/>
+<affects prod="httpd" version="2.0.44"/>
+<affects prod="httpd" version="2.0.43"/>
+<affects prod="httpd" version="2.0.42"/>
+<affects prod="httpd" version="2.0.40"/>
+<affects prod="httpd" version="2.0.39"/>
+<affects prod="httpd" version="2.0.37"/>
</issue>
-<issue fixed="2.2.15" reported="20100202" public="20100302" released="20100305">
+<issue reported="20100202" public="20100302">
+<fixed base="2.2" version="2.2.15" date="20100305"/>
<cve name="CVE-2010-0408"/>
<severity level="3">moderate</severity>
<title>mod_proxy_ajp DoS</title>
@@ -3096,7 +2675,8 @@ proposing a patch fix for this issue.
<affects prod="httpd" version="2.2.0"/>
</issue>
-<issue fixed="2.2.14" reported="20090805" public="20090923" released="20091005">
+<issue reported="20090805" public="20090923">
+<fixed base="2.2" version="2.2.14" date="20091005"/>
<cve name="CVE-2009-2699"/>
<severity level="3">moderate</severity>
<title>Solaris pollset DoS</title>
@@ -3119,7 +2699,9 @@ event MPMs, resulting in a denial of ser
<affects prod="httpd" version="2.2.0"/>
</issue>
-<issue fixed="2.2.14" reported="20090904" public="20090902" released="20091005">
+<issue reported="20090904" public="20090902">
+<fixed base="2.2" version="2.2.14" date="20091005"/>
+<fixed base="2.0" version="2.0.64" date="20101019"/>
<cve name="CVE-2009-3094"/>
<severity level="4">low</severity>
<title>mod_proxy_ftp DoS</title>
@@ -3142,9 +2724,34 @@ service.
<affects prod="httpd" version="2.2.3"/>
<affects prod="httpd" version="2.2.2"/>
<affects prod="httpd" version="2.2.0"/>
+<affects prod="httpd" version="2.0.63"/>
+<affects prod="httpd" version="2.0.61"/>
+<affects prod="httpd" version="2.0.59"/>
+<affects prod="httpd" version="2.0.58"/>
+<affects prod="httpd" version="2.0.55"/>
+<affects prod="httpd" version="2.0.54"/>
+<affects prod="httpd" version="2.0.53"/>
+<affects prod="httpd" version="2.0.52"/>
+<affects prod="httpd" version="2.0.51"/>
+<affects prod="httpd" version="2.0.50"/>
+<affects prod="httpd" version="2.0.49"/>
+<affects prod="httpd" version="2.0.48"/>
+<affects prod="httpd" version="2.0.47"/>
+<affects prod="httpd" version="2.0.46"/>
+<affects prod="httpd" version="2.0.45"/>
+<affects prod="httpd" version="2.0.44"/>
+<affects prod="httpd" version="2.0.43"/>
+<affects prod="httpd" version="2.0.42"/>
+<affects prod="httpd" version="2.0.40"/>
+<affects prod="httpd" version="2.0.39"/>
+<affects prod="httpd" version="2.0.37"/>
+<affects prod="httpd" version="2.0.36"/>
+<affects prod="httpd" version="2.0.35"/>
</issue>
-<issue fixed="2.2.14" reported="20090903" public="20090903" released="20091005">
+<issue reported="20090903" public="20090903">
+<fixed base="2.2" version="2.2.14" date="20091005"/>
+<fixed base="2.0" version="2.0.64" date="20101019"/>
<cve name="CVE-2009-3095"/>
<severity level="4">low</severity>
<title>mod_proxy_ftp FTP command injection</title>
@@ -3167,9 +2774,34 @@ to the FTP server.
<affects prod="httpd" version="2.2.3"/>
<affects prod="httpd" version="2.2.2"/>
<affects prod="httpd" version="2.2.0"/>
+<affects prod="httpd" version="2.0.63"/>
+<affects prod="httpd" version="2.0.61"/>
+<affects prod="httpd" version="2.0.59"/>
+<affects prod="httpd" version="2.0.58"/>
+<affects prod="httpd" version="2.0.55"/>
+<affects prod="httpd" version="2.0.54"/>
+<affects prod="httpd" version="2.0.53"/>
+<affects prod="httpd" version="2.0.52"/>
+<affects prod="httpd" version="2.0.51"/>
+<affects prod="httpd" version="2.0.50"/>
+<affects prod="httpd" version="2.0.49"/>
+<affects prod="httpd" version="2.0.48"/>
+<affects prod="httpd" version="2.0.47"/>
+<affects prod="httpd" version="2.0.46"/>
+<affects prod="httpd" version="2.0.45"/>
+<affects prod="httpd" version="2.0.44"/>
+<affects prod="httpd" version="2.0.43"/>
+<affects prod="httpd" version="2.0.42"/>
+<affects prod="httpd" version="2.0.40"/>
+<affects prod="httpd" version="2.0.39"/>
+<affects prod="httpd" version="2.0.37"/>
+<affects prod="httpd" version="2.0.36"/>
+<affects prod="httpd" version="2.0.35"/>
</issue>
-<issue fixed="2.2.13" reported="20090727" public="20090804" released="20090809">
+<issue reported="20090727" public="20090804">
+<fixed base="2.2" version="2.2.13" date="20090809"/>
+<fixed base="2.0" version="2.0.64" date="20101019"/>
<cve name="CVE-2009-2412"/>
<severity level="4">low</severity>
<title>APR apr_palloc heap overflow</title>
@@ -3192,20 +2824,6 @@ in a vulnerable way.
<affects prod="httpd" version="2.2.3"/>
<affects prod="httpd" version="2.2.2"/>
<affects prod="httpd" version="2.2.0"/>
-</issue>
-
-<issue fixed="2.0.64" reported="20090727" public="20090804" released="20101019">
-<cve name="CVE-2009-2412"/>
-<severity level="4">low</severity>
-<title>APR apr_palloc heap overflow</title>
-<description><p>
-A flaw in apr_palloc() in the bundled copy of APR could
-cause heap overflows in programs that try to apr_palloc() a user
-controlled size. The Apache HTTP Server itself does not pass
-unsanitized user-provided sizes to this function, so it could only
-be triggered through some other application which uses apr_palloc()
-in a vulnerable way.
-</p></description>
<affects prod="httpd" version="2.0.63"/>
<affects prod="httpd" version="2.0.61"/>
<affects prod="httpd" version="2.0.59"/>
@@ -3231,7 +2849,8 @@ in a vulnerable way.
<affects prod="httpd" version="2.0.35"/>
</issue>
-<issue fixed="2.2.12" reported="20090424" public="20090424" released="20090727">
+<issue reported="20090424" public="20090424">
+<fixed base="2.2" version="2.2.12" date="20090727"/>
<cve name="CVE-2009-1956"/>
<severity level="3">moderate</severity>
<title>APR-util off-by-one overflow</title>
@@ -3255,7 +2874,8 @@ or a denial of service.
<affects prod="httpd" version="2.2.0"/>
</issue>
-<issue fixed="2.2.12" reported="20090606" public="20090601" released="20090727">
+<issue reported="20090606" public="20090601">
+<fixed base="2.2" version="2.2.12" date="20090727"/>
<cve name="CVE-2009-1955"/>
<severity level="3">moderate</severity>
<title>APR-util XML DoS</title>
@@ -3278,7 +2898,9 @@ engine.
<affects prod="httpd" version="2.2.0"/>
</issue>
-<issue fixed="2.2.12" public="20090626" reported="20090626" released="20090727">
+<issue public="20090626" reported="20090626">
+<fixed base="2.2" version="2.2.12" date="20090727"/>
+<fixed base="2.0" version="2.0.64" date="20101019"/>
<cve name="CVE-2009-1891"/>
<severity level="4">low</severity>
<cvss>2.6/AV:N/AC:H/Au:N/C:N/I:N/A:P</cvss>
@@ -3300,20 +2922,6 @@ file.</p></description>
<affects prod="httpd" version="2.2.3"/>
<affects prod="httpd" version="2.2.2"/>
<affects prod="httpd" version="2.2.0"/>
-</issue>
-
-<issue fixed="2.0.64" public="20090626" reported="20090626" released="20101019">
-<cve name="CVE-2009-1891"/>
-<severity level="4">low</severity>
-<cvss>2.6/AV:N/AC:H/Au:N/C:N/I:N/A:P</cvss>
-<title>mod_deflate DoS</title>
-<description><p>
-A denial of service flaw was found in the mod_deflate module. This
-module continued to compress large files until compression was
-complete, even if the network connection that requested the content
-was closed before compression completed. This would cause mod_deflate
-to consume large amounts of CPU if mod_deflate was enabled for a large
-file.</p></description>
<affects prod="httpd" version="2.0.63"/>
<affects prod="httpd" version="2.0.61"/>
<affects prod="httpd" version="2.0.59"/>
@@ -3339,7 +2947,8 @@ file.</p></description>
<affects prod="httpd" version="2.0.35"/>
</issue>
-<issue fixed="2.2.12" public="20090702" reported="20090630" released="20090727">
+<issue public="20090702" reported="20090630">
+<fixed base="2.2" version="2.2.12" date="20090727"/>
<cve name="CVE-2009-1890"/>
<severity level="2">important</severity>
<cvss>7.8/AV:N/AC:L/Au:N/C:N/I:N/A:C</cvss>
@@ -3361,7 +2970,8 @@ force a proxy process to consume large a
<affects prod="httpd" version="2.2.0"/>
</issue>
-<issue fixed="2.2.12" public="20090422" reported="20090309" released="20090727">
+<issue public="20090422" reported="20090309">
+<fixed base="2.2" version="2.2.12" date="20090727"/>
<cve name="CVE-2009-1195"/>
<severity level="4">low</severity>
<cvss>4.4/AV:L/AC:M/Au:N/C:P/I:P/A:P</cvss>
@@ -3384,7 +2994,8 @@ from executing commands from a Server-Si
<affects prod="httpd" version="2.2.0"/>
</issue>
-<issue fixed="2.2.12" public="20090421" reported="20090305" released="20090727">
+<issue public="20090421" reported="20090305">
+<fixed base="2.2" version="2.2.12" date="20090727"/>
<cve name="CVE-2009-1191"/>
<severity level="2">important</severity>
<cvss>5/AV:N/AC:L/Au:N/C:P/I:N/A:N</cvss>
@@ -3398,7 +3009,8 @@ could return a response intended for ano
<affects prod="httpd" version="2.2.11"/>
</issue>
-<issue fixed="2.2.12" reported="20081225" public="20090601" released="20090727">
+<issue reported="20081225" public="20090601">
+<fixed base="2.2" version="2.2.12" date="20090727"/>
<cve name="CVE-2009-0023"/>
<severity level="3">moderate</severity>
<title>APR-util heap underwrite</title>
@@ -3421,7 +3033,8 @@ processed by the pattern preparation eng
<affects prod="httpd" version="2.2.0"/>
</issue>
-<issue fixed="2.2.12" reported="20080115" public="20080121" released="20090727">
+<issue reported="20080115" public="20080121">
+<fixed base="2.2" version="2.2.12" date="20090727"/>
<cve name="CVE-2008-0456"/>
<severity level="4">low</severity>
<title>CRLF injection in mod_negotiation when untrusted uploads are supported</title>
@@ -3442,7 +3055,9 @@ MultiViews enabled.
<affects prod="httpd" version="2.2.0"/>
</issue>
-<issue fixed="2.2.10" public="20080805" reported="20080728" released="20081031">
+<issue public="20080805" reported="20080728">
+<fixed base="2.2" version="2.2.10" date="20081031"/>
+<fixed base="2.0" version="2.0.64" date="20101019"/>
<cve name="CVE-2008-2939"/>
<severity level="4">low</severity>
<title>mod_proxy_ftp globbing XSS</title>
@@ -3459,36 +3074,6 @@ to cross-site scripting (XSS) attacks.</
<affects prod="httpd" version="2.2.3"/>
<affects prod="httpd" version="2.2.2"/>
<affects prod="httpd" version="2.2.0"/>
-</issue>
-
-<issue fixed="2.2.10" reported="20100723" public="20100723" released="20081031">
-<cve name="CVE-2010-2791"/>
-<severity level="2">important</severity>
-<title>Timeout detection flaw (mod_proxy_http)</title>
-<description><p>
-An information disclosure flaw was found in mod_proxy_http in version
-2.2.9 only, on Unix platforms. Under certain timeout
-conditions, the server could return a response intended for another user.
-Only those configurations which trigger the use of proxy worker pools
-are affected. There was no vulnerability on earlier versions, as
-proxy pools were not yet introduced. The simplest workaround is to
-globally configure:</p>
-<p>SetEnv proxy-nokeepalive 1</p>
-</description>
-<affects prod="httpd" version="2.2.9"/>
-</issue>
-
-<issue fixed="2.0.64" reported="20090903" public="20090903" released="20101019">
-<cve name="CVE-2009-3095"/>
-<severity level="4">low</severity>
-<title>mod_proxy_ftp FTP command injection</title>
-<description><p>
-A flaw was found in the mod_proxy_ftp module. In a reverse proxy
-configuration, a remote attacker could use this flaw to bypass
-intended access restrictions by creating a carefully-crafted HTTP
-Authorization header, allowing the attacker to send arbitrary commands
-to the FTP server.
-</p></description>
<affects prod="httpd" version="2.0.63"/>
<affects prod="httpd" version="2.0.61"/>
<affects prod="httpd" version="2.0.59"/>
@@ -3514,127 +3099,27 @@ to the FTP server.
<affects prod="httpd" version="2.0.35"/>
</issue>
-<issue fixed="2.0.64" reported="20090904" public="20090902" released="20101019">
-<cve name="CVE-2009-3094"/>
-<severity level="4">low</severity>
-<title>mod_proxy_ftp DoS</title>
-<description><p>
-A NULL pointer dereference flaw was found in the mod_proxy_ftp
-module. A malicious FTP server to which requests are being proxied
-could use this flaw to crash an httpd child process via a malformed
-reply to the EPSV or PASV commands, resulting in a limited denial of
-service.
-</p></description>
-<affects prod="httpd" version="2.0.63"/>
-<affects prod="httpd" version="2.0.61"/>
-<affects prod="httpd" version="2.0.59"/>
-<affects prod="httpd" version="2.0.58"/>
-<affects prod="httpd" version="2.0.55"/>
-<affects prod="httpd" version="2.0.54"/>
-<affects prod="httpd" version="2.0.53"/>
-<affects prod="httpd" version="2.0.52"/>
-<affects prod="httpd" version="2.0.51"/>
-<affects prod="httpd" version="2.0.50"/>
-<affects prod="httpd" version="2.0.49"/>
-<affects prod="httpd" version="2.0.48"/>
-<affects prod="httpd" version="2.0.47"/>
-<affects prod="httpd" version="2.0.46"/>
-<affects prod="httpd" version="2.0.45"/>
-<affects prod="httpd" version="2.0.44"/>
-<affects prod="httpd" version="2.0.43"/>
-<affects prod="httpd" version="2.0.42"/>
-<affects prod="httpd" version="2.0.40"/>
-<affects prod="httpd" version="2.0.39"/>
-<affects prod="httpd" version="2.0.37"/>
-<affects prod="httpd" version="2.0.36"/>
-<affects prod="httpd" version="2.0.35"/>
-</issue>
-
-<issue fixed="2.0.64" reported="20091209" public="20091209" released="20101019">
-<cve name="CVE-2010-0434"/>
-<severity level="4">low</severity>
-<title>Subrequest handling of request headers (mod_headers)</title>
-<description><p>
-A flaw in the core subrequest process code was fixed, to always provide a shallow copy of the headers_in
-array to the subrequest, instead of a pointer to the parent request's array
-as it had for requests without request bodies. This meant all modules such
-as mod_headers which may manipulate the input headers for a subrequest would
-poison the parent request in two ways, one by modifying the parent request,
-which might not be intended, and second by leaving pointers to modified header
-fields in memory allocated to the subrequest scope, which could be freed
-before the main request processing was finished, resulting in a segfault or
-in revealing data from another request on threaded servers, such as the worker
-or winnt MPMs.
-</p></description>
-<acknowledgements>
-We would like to thank Philip Pickett of VMware for reporting and proposing a
-fix for this issue.
-</acknowledgements>
-<affects prod="httpd" version="2.0.63"/>
-<affects prod="httpd" version="2.0.61"/>
-<affects prod="httpd" version="2.0.59"/>
-<affects prod="httpd" version="2.0.58"/>
-<affects prod="httpd" version="2.0.55"/>
-<affects prod="httpd" version="2.0.54"/>
-<affects prod="httpd" version="2.0.53"/>
-<affects prod="httpd" version="2.0.52"/>
-<affects prod="httpd" version="2.0.51"/>
[... 1560 lines stripped ...]