svn commit: r1851890 - /httpd/site/trunk/content/security/vulnerabilities-httpd.xml

[mj...@apache.org]

Author: mjc
Date: Wed Jan 23 08:17:36 2019
New Revision: 1851890

URL: http://svn.apache.org/viewvc?rev=1851890&view=rev
Log:
Missing update to vulns-xml 

Modified:
    httpd/site/trunk/content/security/vulnerabilities-httpd.xml

Modified: httpd/site/trunk/content/security/vulnerabilities-httpd.xml
URL: http://svn.apache.org/viewvc/httpd/site/trunk/content/security/vulnerabilities-httpd.xml?rev=1851890&r1=1851889&r2=1851890&view=diff
==============================================================================
--- httpd/site/trunk/content/security/vulnerabilities-httpd.xml (original)
+++ httpd/site/trunk/content/security/vulnerabilities-httpd.xml Wed Jan 23 08:17:36 2019
@@ -1,4 +1,95 @@
-<security updated="20180925">  
+<security updated="20190122">  
+<issue reported="20190101" public="20190122">
+   <cve name="CVE-2019-0190"/>
+   <severity level="2">important</severity>
+   <title>mod_ssl 2.4.37 remote DoS when used with OpenSSL 1.1.1</title>
+   <description>
+     <p>A bug exists in the way mod_ssl handled client renegotiations.
+     A remote attacker could send a carefully crafted request that
+     would cause mod_ssl to enter a loop leading to a denial of
+     service.  This bug can be only triggered with Apache HTTP Server
+     version 2.4.37 when using OpenSSL version 1.1.1 or later, due to
+     an interaction in changes to handling of renegotiation attempts.
+     </p>
+   </description>
+   <acknowledgements>
+     The issue was discovered through user bug reports.
+   </acknowledgements>
+   <fixed base="2.4" version="2.4.38" date=""/>
+   <affects prod="httpd" version="2.4.37"/>
+</issue>
+<issue reported="20181008" public="20190122">
+   <cve name="CVE-2018-17199"/>
+   <severity level="4">low</severity>
+   <title>mod_session_cookie does not respect expiry time</title>
+   <description>
+      <p>In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session
+      checks the session expiry time before decoding the session.
+      This causes session expiry time to be ignored for
+      mod_session_cookie sessions since the expiry time is loaded
+      when the session is decoded.</p>
+   </description>
+   <acknowledgements>
+      The issue was discovered by Diego Angulo from ImExHS.
+   </acknowledgements>
+   <fixed base="2.4" version="2.4.38" date=""/>
+   <affects prod="httpd" version="2.4.37"/>
+   <affects prod="httpd" version="2.4.35"/>
+   <affects prod="httpd" version="2.4.34"/>
+   <affects prod="httpd" version="2.4.33"/>
+   <affects prod="httpd" version="2.4.30"/>
+   <affects prod="httpd" version="2.4.29"/>
+   <affects prod="httpd" version="2.4.28"/>
+   <affects prod="httpd" version="2.4.27"/>
+   <affects prod="httpd" version="2.4.26"/>
+   <affects prod="httpd" version="2.4.25"/>
+   <affects prod="httpd" version="2.4.23"/>
+   <affects prod="httpd" version="2.4.20"/>
+   <affects prod="httpd" version="2.4.18"/>
+   <affects prod="httpd" version="2.4.17"/>
+   <affects prod="httpd" version="2.4.16"/>
+   <affects prod="httpd" version="2.4.12"/>
+   <affects prod="httpd" version="2.4.10"/>
+   <affects prod="httpd" version="2.4.9"/>
+   <affects prod="httpd" version="2.4.7"/>
+   <affects prod="httpd" version="2.4.6"/>
+   <affects prod="httpd" version="2.4.4"/>
+   <affects prod="httpd" version="2.4.3"/>
+   <affects prod="httpd" version="2.4.2"/>
+   <affects prod="httpd" version="2.4.1"/>
+   <affects prod="httpd" version="2.4.0"/>
+</issue>
+<issue reported="20181016" public="20190122">
+   <cve name="CVE-2018-17189"/>
+   <severity level="4">low</severity>
+   <title>DoS for HTTP/2 connections via slow request bodies</title>
+   <description>
+      <p>By sending request bodies in a slow loris way to plain
+               resources, the h2 stream for that request unnecessarily
+               occupied a server thread cleaning up that incoming data.
+               This affects only HTTP/2 connections. A possible mitigation
+               is to not enable the h2 protocol.
+</p>
+   </description>
+   <acknowledgements>
+The issue was discovered by Gal Goldshtein of F5 Networks.
+</acknowledgements>
+   <fixed base="2.4" version="2.4.38" date=""/>
+   <affects prod="httpd" version="2.4.37"/>
+   <affects prod="httpd" version="2.4.35"/>
+   <affects prod="httpd" version="2.4.34"/>
+   <affects prod="httpd" version="2.4.33"/>
+   <affects prod="httpd" version="2.4.30"/>
+   <affects prod="httpd" version="2.4.29"/>
+   <affects prod="httpd" version="2.4.28"/>
+   <affects prod="httpd" version="2.4.27"/>
+   <affects prod="httpd" version="2.4.26"/>
+   <affects prod="httpd" version="2.4.25"/>
+   <affects prod="httpd" version="2.4.23"/>
+   <affects prod="httpd" version="2.4.20"/>
+   <affects prod="httpd" version="2.4.18"/>
+   <affects prod="httpd" version="2.4.17"/>
+</issue>
 
 <issue reported="20180718" public="20180925">
 <cve name="CVE-2018-11763"/>