You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by bu...@apache.org on 2021/03/30 14:43:03 UTC
svn commit: r1073164 - in /websites/staging/httpd/trunk/content: ./
security/ security/json/
Author: buildbot
Date: Tue Mar 30 14:43:03 2021
New Revision: 1073164
Log:
Staging update by buildbot for httpd
Modified:
websites/staging/httpd/trunk/content/ (props changed)
websites/staging/httpd/trunk/content/security/json/CVE-2010-2068.json
websites/staging/httpd/trunk/content/security/json/CVE-2010-2791.json
websites/staging/httpd/trunk/content/security/json/CVE-2011-0419.json
websites/staging/httpd/trunk/content/security/json/CVE-2011-3368.json
websites/staging/httpd/trunk/content/security/vulnerabilities_13.html
websites/staging/httpd/trunk/content/security/vulnerabilities_20.html
websites/staging/httpd/trunk/content/security/vulnerabilities_22.html
Propchange: websites/staging/httpd/trunk/content/
------------------------------------------------------------------------------
--- cms:source-revision (original)
+++ cms:source-revision Tue Mar 30 14:43:03 2021
@@ -1 +1 @@
-1888221
+1888222
Modified: websites/staging/httpd/trunk/content/security/json/CVE-2010-2068.json
==============================================================================
--- websites/staging/httpd/trunk/content/security/json/CVE-2010-2068.json (original)
+++ websites/staging/httpd/trunk/content/security/json/CVE-2010-2068.json Tue Mar 30 14:43:03 2021
@@ -61,7 +61,7 @@
"description_data": [
{
"lang": "eng",
- "value": "An information disclosure flaw was found in mod_proxy_http in versions 2.2.9 through 2.2.15, 2.3.4-alpha and 2.3.5-alpha. Under certain timeout conditions, the server could return a response intended for another user. Only Windows, Netware and OS2 operating systems are affected. Only those configurations which trigger the use of proxy worker pools are affected. There was no vulnerability on earlier versions, as proxy pools were not yet introduced. The simplest workaround is to globally configure; SetEnv proxy-nokeepalive 1 Source code patches are at; 2.2.15: CVE-2010-2068-r953616.patch 2.3.5: CVE-2010-2068-r953418.patch Binary replacement modules are at mod_proxy_http-CVE-2010-2068.zip"
+ "value": "An information disclosure flaw was found in mod_proxy_http in versions 2.2.9 through 2.2.15, 2.3.4-alpha and 2.3.5-alpha. Under certain timeout conditions, the server could return a response intended for another user. Only Windows, Netware and OS2 operating systems are affected. Only those configurations which trigger the use of proxy worker pools are affected. There was no vulnerability on earlier versions, as proxy pools were not yet introduced.\nThe simplest workaround is to globally configure;\nSetEnv proxy-nokeepalive 1"
}
]
},
@@ -135,4 +135,4 @@
]
}
}
-}
\ No newline at end of file
+}
Modified: websites/staging/httpd/trunk/content/security/json/CVE-2010-2791.json
==============================================================================
--- websites/staging/httpd/trunk/content/security/json/CVE-2010-2791.json (original)
+++ websites/staging/httpd/trunk/content/security/json/CVE-2010-2791.json Tue Mar 30 14:43:03 2021
@@ -55,7 +55,7 @@
"description_data": [
{
"lang": "eng",
- "value": "An information disclosure flaw was found in mod_proxy_http in version 2.2.9 only, on Unix platforms. Under certain timeout conditions, the server could return a response intended for another user. Only those configurations which trigger the use of proxy worker pools are affected. There was no vulnerability on earlier versions, as proxy pools were not yet introduced. The simplest workaround is to globally configure: SetEnv proxy-nokeepalive 1"
+ "value": "An information disclosure flaw was found in mod_proxy_http in version 2.2.9 only, on Unix platforms. Under certain timeout conditions, the server could return a response intended for another user. Only those configurations which trigger the use of proxy worker pools are affected. There was no vulnerability on earlier versions, as proxy pools were not yet introduced. The simplest workaround is to globally configure:\nSetEnv proxy-nokeepalive 1"
}
]
},
@@ -89,4 +89,4 @@
]
}
}
-}
\ No newline at end of file
+}
Modified: websites/staging/httpd/trunk/content/security/json/CVE-2011-0419.json
==============================================================================
--- websites/staging/httpd/trunk/content/security/json/CVE-2011-0419.json (original)
+++ websites/staging/httpd/trunk/content/security/json/CVE-2011-0419.json Tue Mar 30 14:43:03 2021
@@ -66,7 +66,7 @@
"description_data": [
{
"lang": "eng",
- "value": "A flaw was found in the apr_fnmatch() function of the bundled APR library. Where mod_autoindex is enabled, and a directory indexed by mod_autoindex contained files with sufficiently long names, a remote attacker could send a carefully crafted request which would cause excessive CPU usage. This could be used in a denial of service attack. Workaround: Setting the 'IgnoreClient' option to the 'IndexOptions' directive disables processing of the client-supplied request query arguments, preventing this attack. Resolution: Update APR to release 1.4.5 (bundled with httpd 2.2.19) or release 0.9.20 (bundled with httpd 2.0.65)"
+ "value": "A flaw was found in the apr_fnmatch() function of the bundled APR library. Where mod_autoindex is enabled, and a directory indexed by mod_autoindex contained files with sufficiently long names, a remote attacker could send a carefully crafted request which would cause excessive CPU usage. This could be used in a denial of service attack.\nWorkaround: Setting the 'IgnoreClient' option to the 'IndexOptions' directive disables processing of the client-supplied request query arguments, preventing this attack.\nResolution: Update APR to release 1.4.5 (bundled with httpd 2.2.19) or release 0.9.20 (bundled with httpd 2.0.65)"
}
]
},
@@ -300,4 +300,4 @@
]
}
}
-}
\ No newline at end of file
+}
Modified: websites/staging/httpd/trunk/content/security/json/CVE-2011-3368.json
==============================================================================
--- websites/staging/httpd/trunk/content/security/json/CVE-2011-3368.json (original)
+++ websites/staging/httpd/trunk/content/security/json/CVE-2011-3368.json Tue Mar 30 14:43:03 2021
@@ -71,7 +71,7 @@
"description_data": [
{
"lang": "eng",
- "value": "An exposure was found when using mod_proxy in reverse proxy mode. In certain configurations using RewriteRule with proxy flag or ProxyPassMatch, a remote attacker could cause the reverse proxy to connect to an arbitrary server, possibly disclosing sensitive information from internal web servers not directly accessible to attacker. No update of 1.3 will be released. Patches will be published to https://archive.apache.org/dist/httpd/patches/apply_to_1.3.42/"
+ "value": "An exposure was found when using mod_proxy in reverse proxy mode. In certain configurations using RewriteRule with proxy flag or ProxyPassMatch, a remote attacker could cause the reverse proxy to connect to an arbitrary server, possibly disclosing sensitive information from internal web servers not directly accessible to attacker. No update of 1.3 will be released.\nPatches will be published to https://archive.apache.org/dist/httpd/patches/apply_to_1.3.42/"
}
]
},
@@ -455,4 +455,4 @@
]
}
}
-}
\ No newline at end of file
+}
Modified: websites/staging/httpd/trunk/content/security/vulnerabilities_13.html
==============================================================================
--- websites/staging/httpd/trunk/content/security/vulnerabilities_13.html (original)
+++ websites/staging/httpd/trunk/content/security/vulnerabilities_13.html Tue Mar 30 14:43:03 2021
@@ -109,7 +109,7 @@ h2:hover > .headerlink, h3:hover > .head
<dt><h3 id="CVE-2011-3368">moderate: <name name="CVE-2011-3368">mod_proxy reverse proxy exposure</name>
(<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3368">CVE-2011-3368</a>)</h3></dt>
-<dd><p>An exposure was found when using mod_proxy in reverse proxy mode. In certain configurations using RewriteRule with proxy flag or ProxyPassMatch, a remote attacker could cause the reverse proxy to connect to an arbitrary server, possibly disclosing sensitive information from internal web servers not directly accessible to attacker. No update of 1.3 will be released. Patches will be published to https://archive.apache.org/dist/httpd/patches/apply_to_1.3.42/</p>
+<dd><p>An exposure was found when using mod_proxy in reverse proxy mode. In certain configurations using RewriteRule with proxy flag or ProxyPassMatch, a remote attacker could cause the reverse proxy to connect to an arbitrary server, possibly disclosing sensitive information from internal web servers not directly accessible to attacker. No update of 1.3 will be released.</p><p>Patches will be published to https://archive.apache.org/dist/httpd/patches/apply_to_1.3.42/</p>
<p>Acknowledgements: This issue was reported by Context Information Security Ltd</p>
<table class="cve"><tr><td class="cve-header">Reported to security team</td><td class="cve-value">2011-09-16</td></tr>
<tr><td class="cve-header">Issue public</td><td class="cve-value">2011-10-05</td></tr>
Modified: websites/staging/httpd/trunk/content/security/vulnerabilities_20.html
==============================================================================
--- websites/staging/httpd/trunk/content/security/vulnerabilities_20.html (original)
+++ websites/staging/httpd/trunk/content/security/vulnerabilities_20.html Tue Mar 30 14:43:03 2021
@@ -109,7 +109,7 @@ h2:hover > .headerlink, h3:hover > .head
<dt><h3 id="CVE-2011-0419">moderate: <name name="CVE-2011-0419">apr_fnmatch flaw leads to mod_autoindex remote DoS</name>
(<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0419">CVE-2011-0419</a>)</h3></dt>
-<dd><p>A flaw was found in the apr_fnmatch() function of the bundled APR library. Where mod_autoindex is enabled, and a directory indexed by mod_autoindex contained files with sufficiently long names, a remote attacker could send a carefully crafted request which would cause excessive CPU usage. This could be used in a denial of service attack. Workaround: Setting the 'IgnoreClient' option to the 'IndexOptions' directive disables processing of the client-supplied request query arguments, preventing this attack. Resolution: Update APR to release 1.4.5 (bundled with httpd 2.2.19) or release 0.9.20 (bundled with httpd 2.0.65)</p>
+<dd><p>A flaw was found in the apr_fnmatch() function of the bundled APR library. Where mod_autoindex is enabled, and a directory indexed by mod_autoindex contained files with sufficiently long names, a remote attacker could send a carefully crafted request which would cause excessive CPU usage. This could be used in a denial of service attack.</p><p>Workaround: Setting the 'IgnoreClient' option to the 'IndexOptions' directive disables processing of the client-supplied request query arguments, preventing this attack.</p><p>Resolution: Update APR to release 1.4.5 (bundled with httpd 2.2.19) or release 0.9.20 (bundled with httpd 2.0.65)</p>
<p>Acknowledgements: This issue was reported by Maksymilian Arciemowicz</p>
<table class="cve"><tr><td class="cve-header">Reported to security team</td><td class="cve-value">2011-03-02</td></tr>
<tr><td class="cve-header">Issue public</td><td class="cve-value">2011-05-10</td></tr>
@@ -128,7 +128,7 @@ h2:hover > .headerlink, h3:hover > .head
</table></dd>
<dt><h3 id="CVE-2011-3368">moderate: <name name="CVE-2011-3368">mod_proxy reverse proxy exposure</name>
(<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3368">CVE-2011-3368</a>)</h3></dt>
-<dd><p>An exposure was found when using mod_proxy in reverse proxy mode. In certain configurations using RewriteRule with proxy flag or ProxyPassMatch, a remote attacker could cause the reverse proxy to connect to an arbitrary server, possibly disclosing sensitive information from internal web servers not directly accessible to attacker. No update of 1.3 will be released. Patches will be published to https://archive.apache.org/dist/httpd/patches/apply_to_1.3.42/</p>
+<dd><p>An exposure was found when using mod_proxy in reverse proxy mode. In certain configurations using RewriteRule with proxy flag or ProxyPassMatch, a remote attacker could cause the reverse proxy to connect to an arbitrary server, possibly disclosing sensitive information from internal web servers not directly accessible to attacker. No update of 1.3 will be released.</p><p>Patches will be published to https://archive.apache.org/dist/httpd/patches/apply_to_1.3.42/</p>
<p>Acknowledgements: This issue was reported by Context Information Security Ltd</p>
<table class="cve"><tr><td class="cve-header">Reported to security team</td><td class="cve-value">2011-09-16</td></tr>
<tr><td class="cve-header">Issue public</td><td class="cve-value">2011-10-05</td></tr>
Modified: websites/staging/httpd/trunk/content/security/vulnerabilities_22.html
==============================================================================
--- websites/staging/httpd/trunk/content/security/vulnerabilities_22.html (original)
+++ websites/staging/httpd/trunk/content/security/vulnerabilities_22.html Tue Mar 30 14:43:03 2021
@@ -363,7 +363,7 @@ h2:hover > .headerlink, h3:hover > .head
<dt><h3 id="CVE-2011-3368">moderate: <name name="CVE-2011-3368">mod_proxy reverse proxy exposure</name>
(<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3368">CVE-2011-3368</a>)</h3></dt>
-<dd><p>An exposure was found when using mod_proxy in reverse proxy mode. In certain configurations using RewriteRule with proxy flag or ProxyPassMatch, a remote attacker could cause the reverse proxy to connect to an arbitrary server, possibly disclosing sensitive information from internal web servers not directly accessible to attacker. No update of 1.3 will be released. Patches will be published to https://archive.apache.org/dist/httpd/patches/apply_to_1.3.42/</p>
+<dd><p>An exposure was found when using mod_proxy in reverse proxy mode. In certain configurations using RewriteRule with proxy flag or ProxyPassMatch, a remote attacker could cause the reverse proxy to connect to an arbitrary server, possibly disclosing sensitive information from internal web servers not directly accessible to attacker. No update of 1.3 will be released.</p><p>Patches will be published to https://archive.apache.org/dist/httpd/patches/apply_to_1.3.42/</p>
<p>Acknowledgements: This issue was reported by Context Information Security Ltd</p>
<table class="cve"><tr><td class="cve-header">Reported to security team</td><td class="cve-value">2011-09-16</td></tr>
<tr><td class="cve-header">Issue public</td><td class="cve-value">2011-10-05</td></tr>
@@ -458,7 +458,7 @@ h2:hover > .headerlink, h3:hover > .head
<dt><h3 id="CVE-2011-0419">moderate: <name name="CVE-2011-0419">apr_fnmatch flaw leads to mod_autoindex remote DoS</name>
(<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0419">CVE-2011-0419</a>)</h3></dt>
-<dd><p>A flaw was found in the apr_fnmatch() function of the bundled APR library. Where mod_autoindex is enabled, and a directory indexed by mod_autoindex contained files with sufficiently long names, a remote attacker could send a carefully crafted request which would cause excessive CPU usage. This could be used in a denial of service attack. Workaround: Setting the 'IgnoreClient' option to the 'IndexOptions' directive disables processing of the client-supplied request query arguments, preventing this attack. Resolution: Update APR to release 1.4.5 (bundled with httpd 2.2.19) or release 0.9.20 (bundled with httpd 2.0.65)</p>
+<dd><p>A flaw was found in the apr_fnmatch() function of the bundled APR library. Where mod_autoindex is enabled, and a directory indexed by mod_autoindex contained files with sufficiently long names, a remote attacker could send a carefully crafted request which would cause excessive CPU usage. This could be used in a denial of service attack.</p><p>Workaround: Setting the 'IgnoreClient' option to the 'IndexOptions' directive disables processing of the client-supplied request query arguments, preventing this attack.</p><p>Resolution: Update APR to release 1.4.5 (bundled with httpd 2.2.19) or release 0.9.20 (bundled with httpd 2.0.65)</p>
<p>Acknowledgements: This issue was reported by Maksymilian Arciemowicz</p>
<table class="cve"><tr><td class="cve-header">Reported to security team</td><td class="cve-value">2011-03-02</td></tr>
<tr><td class="cve-header">Issue public</td><td class="cve-value">2011-05-10</td></tr>
@@ -513,7 +513,7 @@ h2:hover > .headerlink, h3:hover > .head
</table></dd>
<dt><h3 id="CVE-2010-2068">important: <name name="CVE-2010-2068">Timeout detection flaw (mod_proxy_http)</name>
(<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2068">CVE-2010-2068</a>)</h3></dt>
-<dd><p>An information disclosure flaw was found in mod_proxy_http in versions 2.2.9 through 2.2.15, 2.3.4-alpha and 2.3.5-alpha. Under certain timeout conditions, the server could return a response intended for another user. Only Windows, Netware and OS2 operating systems are affected. Only those configurations which trigger the use of proxy worker pools are affected. There was no vulnerability on earlier versions, as proxy pools were not yet introduced. The simplest workaround is to globally configure; SetEnv proxy-nokeepalive 1 Source code patches are at; 2.2.15: CVE-2010-2068-r953616.patch 2.3.5: CVE-2010-2068-r953418.patch Binary replacement modules are at mod_proxy_http-CVE-2010-2068.zip</p>
+<dd><p>An information disclosure flaw was found in mod_proxy_http in versions 2.2.9 through 2.2.15, 2.3.4-alpha and 2.3.5-alpha. Under certain timeout conditions, the server could return a response intended for another user. Only Windows, Netware and OS2 operating systems are affected. Only those configurations which trigger the use of proxy worker pools are affected. There was no vulnerability on earlier versions, as proxy pools were not yet introduced.</p><p>The simplest workaround is to globally configure;</p><p>SetEnv proxy-nokeepalive 1</p>
<p>Acknowledgements: We would like to thank Loren Anderson for the detailed analysis and reporting of this issue.</p>
<table class="cve"><tr><td class="cve-header">Reported to security team</td><td class="cve-value">2010-06-09</td></tr>
<tr><td class="cve-header">Issue public</td><td class="cve-value">2010-06-09</td></tr>
@@ -680,7 +680,7 @@ h2:hover > .headerlink, h3:hover > .head
</table></dd>
<dt><h3 id="CVE-2010-2791">important: <name name="CVE-2010-2791">Timeout detection flaw (mod_proxy_http)</name>
(<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2791">CVE-2010-2791</a>)</h3></dt>
-<dd><p>An information disclosure flaw was found in mod_proxy_http in version 2.2.9 only, on Unix platforms. Under certain timeout conditions, the server could return a response intended for another user. Only those configurations which trigger the use of proxy worker pools are affected. There was no vulnerability on earlier versions, as proxy pools were not yet introduced. The simplest workaround is to globally configure: SetEnv proxy-nokeepalive 1</p>
+<dd><p>An information disclosure flaw was found in mod_proxy_http in version 2.2.9 only, on Unix platforms. Under certain timeout conditions, the server could return a response intended for another user. Only those configurations which trigger the use of proxy worker pools are affected. There was no vulnerability on earlier versions, as proxy pools were not yet introduced. The simplest workaround is to globally configure:</p><p>SetEnv proxy-nokeepalive 1</p>
<table class="cve"><tr><td class="cve-header">Reported to security team</td><td class="cve-value">2010-07-23</td></tr>
<tr><td class="cve-header">Issue public</td><td class="cve-value">2010-07-23</td></tr>
<tr><td class="cve-header">Update 2.2.10 released</td><td class="cve-value">2008-10-31</td></tr>