You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by bu...@apache.org on 2017/09/21 18:33:54 UTC
svn commit: r1018502 - in /websites/staging/httpd/trunk/content: ./
security/vulnerabilities-httpd.xml security/vulnerabilities_22.html
security/vulnerabilities_24.html
Author: buildbot
Date: Thu Sep 21 18:33:54 2017
New Revision: 1018502
Log:
Staging update by buildbot for httpd
Modified:
websites/staging/httpd/trunk/content/ (props changed)
websites/staging/httpd/trunk/content/security/vulnerabilities-httpd.xml
websites/staging/httpd/trunk/content/security/vulnerabilities_22.html
websites/staging/httpd/trunk/content/security/vulnerabilities_24.html
Propchange: websites/staging/httpd/trunk/content/
------------------------------------------------------------------------------
--- cms:source-revision (original)
+++ cms:source-revision Thu Sep 21 18:33:54 2017
@@ -1 +1 @@
-1807586
+1809192
Modified: websites/staging/httpd/trunk/content/security/vulnerabilities-httpd.xml
==============================================================================
--- websites/staging/httpd/trunk/content/security/vulnerabilities-httpd.xml (original)
+++ websites/staging/httpd/trunk/content/security/vulnerabilities-httpd.xml Thu Sep 21 18:33:54 2017
@@ -1,4 +1,99 @@
-<security updated="20170726">
+<security updated="20170921">
+
+<issue fixed="2.4.28-dev" reported="20170712" public="20170918" released="">
+<cve name="CVE-2017-9798"/>
+<severity level="4">low</severity>
+<title>Use-after-free when using <Limit > with an unrecognized method in .htaccess ("OptionsBleed")</title>
+<description>
+<p>When an unrecognized HTTP Method is given in an <Limit {method}>
+directive in an .htaccess file, and that .htaccess file is processed by the
+corresponding request, the global methods table is corrupted in the current
+worker process, resulting in erratic behaviour.</p>
+<p>This behavior may be avoided by listing all unusual HTTP Methods in a global
+httpd.conf RegisterHttpMethod directive in httpd release 2.4.25 and later.</p>
+<p>To permit other .htaccess directives while denying the <Limit > directive, see the AllowOverrideList directive.</p>
+<p>Source code patch is at;</p>
+<ul>
+<li><a href="http://www.apache.org/dist/httpd/patches/apply_to_2.4.27/CVE-2017-9798-patch-2.4.patch"
+>http://www.apache.org/dist/httpd/patches/apply_to_2.4.27/CVE-2017-9798-patch-2.4.patch</a></li>
+</ul>
+</description>
+<acknowledgements>
+We would like to thank Hanno Böck for reporting this issue.
+</acknowledgements>
+<affects prod="httpd" version="2.4.27"/>
+<affects prod="httpd" version="2.4.26"/>
+<affects prod="httpd" version="2.4.25"/>
+<affects prod="httpd" version="2.4.23"/>
+<affects prod="httpd" version="2.4.20"/>
+<affects prod="httpd" version="2.4.18"/>
+<affects prod="httpd" version="2.4.17"/>
+<affects prod="httpd" version="2.4.16"/>
+<affects prod="httpd" version="2.4.12"/>
+<affects prod="httpd" version="2.4.10"/>
+<affects prod="httpd" version="2.4.9"/>
+<affects prod="httpd" version="2.4.7"/>
+<affects prod="httpd" version="2.4.6"/>
+<affects prod="httpd" version="2.4.4"/>
+<affects prod="httpd" version="2.4.3"/>
+<affects prod="httpd" version="2.4.2"/>
+<affects prod="httpd" version="2.4.1"/>
+</issue>
+
+<issue fixed="2.2.35-dev" reported="20170712" public="20170918" released="">
+<cve name="CVE-2017-9798"/>
+<severity level="4">low</severity>
+<title>Use-after-free when using <Limit > with an unrecognized method in .htaccess ("OptionsBleed")</title>
+<description>
+<p>When an unrecognized HTTP Method is given in an <Limit {method}>
+directive in an .htaccess file, and that .htaccess file is processed by the
+corresponding request, the global methods table is corrupted in the current
+worker process, resulting in erratic behaviour.</p>
+<p>This behavior may be avoided by listing all unusual HTTP Methods in a global
+httpd.conf RegisterHttpMethod directive in httpd release 2.2.32 and later.</p>
+<p>To permit other .htaccess directives while denying the <Limit > directive, see the AllowOverrideList directive.</p>
+<p>Source code patch is at;</p>
+<ul>
+<li><a href="http://www.apache.org/dist/httpd/patches/apply_to_2.2.34/CVE-2017-9798-patch-2.4.patch"
+>http://www.apache.org/dist/httpd/patches/apply_to_2.2.34/CVE-2017-9798-patch-2.2.patch</a></li>
+</ul>
+<p>Note 2.2 is end-of-life, no further release with this fix is planned. Users
+are encouraged to migrate to 2.4.28 or later for this and other fixes.</p>
+</description>
+<acknowledgements>
+We would like to thank Hanno Böck for reporting this issue.
+</acknowledgements>
+<affects prod="httpd" version="2.2.34"/>
+<affects prod="httpd" version="2.2.32"/>
+<affects prod="httpd" version="2.2.31"/>
+<affects prod="httpd" version="2.2.29"/>
+<affects prod="httpd" version="2.2.27"/>
+<affects prod="httpd" version="2.2.26"/>
+<affects prod="httpd" version="2.2.25"/>
+<affects prod="httpd" version="2.2.24"/>
+<affects prod="httpd" version="2.2.23"/>
+<affects prod="httpd" version="2.2.22"/>
+<affects prod="httpd" version="2.2.21"/>
+<affects prod="httpd" version="2.2.20"/>
+<affects prod="httpd" version="2.2.19"/>
+<affects prod="httpd" version="2.2.18"/>
+<affects prod="httpd" version="2.2.17"/>
+<affects prod="httpd" version="2.2.16"/>
+<affects prod="httpd" version="2.2.15"/>
+<affects prod="httpd" version="2.2.14"/>
+<affects prod="httpd" version="2.2.13"/>
+<affects prod="httpd" version="2.2.12"/>
+<affects prod="httpd" version="2.2.11"/>
+<affects prod="httpd" version="2.2.10"/>
+<affects prod="httpd" version="2.2.9"/>
+<affects prod="httpd" version="2.2.8"/>
+<affects prod="httpd" version="2.2.6"/>
+<affects prod="httpd" version="2.2.5"/>
+<affects prod="httpd" version="2.2.4"/>
+<affects prod="httpd" version="2.2.3"/>
+<affects prod="httpd" version="2.2.2"/>
+<affects prod="httpd" version="2.2.0"/>
+</issue>
<issue fixed="2.4.27" reported="20170630" public="20170711" released="20170711">
<cve name="CVE-2017-9789"/>
Modified: websites/staging/httpd/trunk/content/security/vulnerabilities_22.html
==============================================================================
--- websites/staging/httpd/trunk/content/security/vulnerabilities_22.html (original)
+++ websites/staging/httpd/trunk/content/security/vulnerabilities_22.html Thu Sep 21 18:33:54 2017
@@ -106,7 +106,47 @@ in a "-dev" release then this means that
the development source tree and will be part of an upcoming full release.</p><p> This page is created from a database of vulnerabilities originally
populated by Apache Week. Please send comments or corrections for
these vulnerabilities to the <a href="/security_report.html">Security
-Team</a>. </p><br/><h1 id="2.2.34">
+Team</a>. </p><br/><h1 id="2.2.35-dev">
+Fixed in Apache httpd 2.2.35-dev</h1><dl>
+ <dt>
+ <h3 id="CVE-2017-9798">low:
+ <name name="CVE-2017-9798">Use-after-free when using <Limit > with an unrecognized method in .htaccess ("OptionsBleed")</name>
+ (<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9798">CVE-2017-9798</a>)
+ </h3>
+ </dt>
+ <dd>
+ <p>When an unrecognized HTTP Method is given in an <Limit {method}>
+directive in an .htaccess file, and that .htaccess file is processed by the
+corresponding request, the global methods table is corrupted in the current
+worker process, resulting in erratic behaviour.</p>
+ <p>This behavior may be avoided by listing all unusual HTTP Methods in a global
+httpd.conf RegisterHttpMethod directive in httpd release 2.2.32 and later.</p>
+ <p>To permit other .htaccess directives while denying the <Limit > directive, see the AllowOverrideList directive.</p>
+ <p>Source code patch is at;</p>
+ <ul>
+<li><a href="http://www.apache.org/dist/httpd/patches/apply_to_2.2.34/CVE-2017-9798-patch-2.4.patch">http://www.apache.org/dist/httpd/patches/apply_to_2.2.34/CVE-2017-9798-patch-2.2.patch</a></li>
+</ul>
+ <p>Note 2.2 is end-of-life, no further release with this fix is planned. Users
+are encouraged to migrate to 2.4.28 or later for this and other fixes.</p>
+ <p>Acknowledgements:
+We would like to thank Hanno Böck for reporting this issue.
+</p>
+ <table class="cve">
+ <tr>
+ <td class="cve-header">Reported to security team</td>
+ <td class="cve-value">12th July 2017</td>
+ </tr>
+ <tr>
+ <td class="cve-header">Issue public</td>
+ <td class="cve-value">18th September 2017</td>
+ </tr>
+ <tr>
+ <td class="cve-header">Affects</td>
+ <td class="cve-value">2.2.34, 2.2.32, 2.2.31, 2.2.29, 2.2.27, 2.2.26, 2.2.25, 2.2.24, 2.2.23, 2.2.22, 2.2.21, 2.2.20, 2.2.19, 2.2.18, 2.2.17, 2.2.16, 2.2.15, 2.2.14, 2.2.13, 2.2.12, 2.2.11, 2.2.10, 2.2.9, 2.2.8, 2.2.6, 2.2.5, 2.2.4, 2.2.3, 2.2.2, 2.2.0</td>
+ </tr>
+ </table>
+ </dd>
+</dl><br/><h1 id="2.2.34">
Fixed in Apache httpd 2.2.34</h1><dl>
<dt>
<h3 id="CVE-2017-9788">important:
Modified: websites/staging/httpd/trunk/content/security/vulnerabilities_24.html
==============================================================================
--- websites/staging/httpd/trunk/content/security/vulnerabilities_24.html (original)
+++ websites/staging/httpd/trunk/content/security/vulnerabilities_24.html Thu Sep 21 18:33:54 2017
@@ -106,7 +106,45 @@ in a "-dev" release then this means that
the development source tree and will be part of an upcoming full release.</p><p> This page is created from a database of vulnerabilities originally
populated by Apache Week. Please send comments or corrections for
these vulnerabilities to the <a href="/security_report.html">Security
-Team</a>. </p><p><em>The initial GA release, Apache httpd 2.4.1, includes fixes for all vulnerabilities which have been resolved in Apache httpd 2.2.22 and all older releases. Consult the <a href="vulnerabilities_22.html">Apache httpd 2.2 vulnerabilities list</a> for more information.</em></p><br/><h1 id="2.4.27">
+Team</a>. </p><p><em>The initial GA release, Apache httpd 2.4.1, includes fixes for all vulnerabilities which have been resolved in Apache httpd 2.2.22 and all older releases. Consult the <a href="vulnerabilities_22.html">Apache httpd 2.2 vulnerabilities list</a> for more information.</em></p><br/><h1 id="2.4.28-dev">
+Fixed in Apache httpd 2.4.28-dev</h1><dl>
+ <dt>
+ <h3 id="CVE-2017-9798">low:
+ <name name="CVE-2017-9798">Use-after-free when using <Limit > with an unrecognized method in .htaccess ("OptionsBleed")</name>
+ (<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9798">CVE-2017-9798</a>)
+ </h3>
+ </dt>
+ <dd>
+ <p>When an unrecognized HTTP Method is given in an <Limit {method}>
+directive in an .htaccess file, and that .htaccess file is processed by the
+corresponding request, the global methods table is corrupted in the current
+worker process, resulting in erratic behaviour.</p>
+ <p>This behavior may be avoided by listing all unusual HTTP Methods in a global
+httpd.conf RegisterHttpMethod directive in httpd release 2.4.25 and later.</p>
+ <p>To permit other .htaccess directives while denying the <Limit > directive, see the AllowOverrideList directive.</p>
+ <p>Source code patch is at;</p>
+ <ul>
+<li><a href="http://www.apache.org/dist/httpd/patches/apply_to_2.4.27/CVE-2017-9798-patch-2.4.patch">http://www.apache.org/dist/httpd/patches/apply_to_2.4.27/CVE-2017-9798-patch-2.4.patch</a></li>
+</ul>
+ <p>Acknowledgements:
+We would like to thank Hanno Böck for reporting this issue.
+</p>
+ <table class="cve">
+ <tr>
+ <td class="cve-header">Reported to security team</td>
+ <td class="cve-value">12th July 2017</td>
+ </tr>
+ <tr>
+ <td class="cve-header">Issue public</td>
+ <td class="cve-value">18th September 2017</td>
+ </tr>
+ <tr>
+ <td class="cve-header">Affects</td>
+ <td class="cve-value">2.4.27, 2.4.26, 2.4.25, 2.4.23, 2.4.20, 2.4.18, 2.4.17, 2.4.16, 2.4.12, 2.4.10, 2.4.9, 2.4.7, 2.4.6, 2.4.4, 2.4.3, 2.4.2, 2.4.1</td>
+ </tr>
+ </table>
+ </dd>
+</dl><br/><h1 id="2.4.27">
Fixed in Apache httpd 2.4.27</h1><dl>
<dt>
<h3 id="CVE-2017-9789">important: