svn commit: r1775356 - /httpd/site/trunk/content/security/vulnerabilities-httpd.xml

[wr...@apache.org]

Author: wrowe
Date: Tue Dec 20 21:09:23 2016
New Revision: 1775356

URL: http://svn.apache.org/viewvc?rev=1775356&view=rev
Log:
Note CVE-2016-2161 - this wording could use substantial improvement

Modified:
    httpd/site/trunk/content/security/vulnerabilities-httpd.xml

Modified: httpd/site/trunk/content/security/vulnerabilities-httpd.xml
URL: http://svn.apache.org/viewvc/httpd/site/trunk/content/security/vulnerabilities-httpd.xml?rev=1775356&r1=1775355&r2=1775356&view=diff
==============================================================================
--- httpd/site/trunk/content/security/vulnerabilities-httpd.xml (original)
+++ httpd/site/trunk/content/security/vulnerabilities-httpd.xml Tue Dec 20 21:09:23 2016
@@ -103,10 +103,10 @@ as well as Régis Leroy for each repor
 <severity level="0">n/a</severity>
 <title>HTTP/2 CONTINUATION denial of service</title>
 <description><p>
-
   The HTTP/2 protocol implementation (mod_http2) had an incomplete handling
   of the 
-  <a href="https://httpd.apache.org/docs/2.4/mod/core.html#limitrequestfields">LimitRequestFields</a>
+  <a href="https://httpd.apache.org/docs/2.4/mod/core.html#limitrequestfields"
+     >LimitRequestFields</a>
   directive. This allowed an attacker to inject unlimited request headers into
   the server, leading to eventual memory exhaustion.
 </p></description>
@@ -125,7 +125,6 @@ and CDF/SEFCOM at Arizona State Universi
 <severity level="0">n/a</severity>
 <title>HTTP_PROXY environment variable "httpoxy" mitigation</title>
 <description><p>
-
   HTTP_PROXY is a well-defined environment variable in a CGI process,
   which collided with a number of libraries which failed to avoid
   colliding with this CGI namespace. A mitigation is provided for the
@@ -158,12 +157,38 @@ for reporting and proposing a fix for th
 <affects prod="httpd" version="2.4.1"/>
 </issue>
 
+<issue fixed="2.4.25" reported="20160711" public="20161220" released="20161220">
+<cve name="CVE-2016-2161"/>
+<severity level="4">low</severity>
+<title>DoS vulnerability in mod_auth_digest</title>
+<description><p>
+  Malicious input to mod_auth_digest will cause the server to crash, and 
+  each instance continues to crash even for subsequently valid requests.
+</p></description>
+<acknowledgements>
+We would like to thank Maksim Malyutin for reporting this issue.
+</acknowledgements>
+<affects prod="httpd" version="2.4.23"/>
+<affects prod="httpd" version="2.4.20"/>
+<affects prod="httpd" version="2.4.18"/>
+<affects prod="httpd" version="2.4.17"/>
+<affects prod="httpd" version="2.4.16"/>
+<affects prod="httpd" version="2.4.12"/>
+<affects prod="httpd" version="2.4.10"/>
+<affects prod="httpd" version="2.4.9"/>
+<affects prod="httpd" version="2.4.7"/>
+<affects prod="httpd" version="2.4.6"/>
+<affects prod="httpd" version="2.4.4"/>
+<affects prod="httpd" version="2.4.3"/>
+<affects prod="httpd" version="2.4.2"/>
+<affects prod="httpd" version="2.4.1"/>
+</issue>
+
 <issue fixed="2.2.32-dev" reported="20160702" public="20160718" released="20160718">
 <cve name="CVE-2016-5387"/>
 <severity level="0">n/a</severity>
 <title>HTTP_PROXY environment variable "httpoxy" mitigation</title>
 <description><p>
-
   HTTP_PROXY is a well-defined environment variable in a CGI process,
   which collided with a number of libraries which failed to avoid
   colliding with this CGI namespace. A mitigation is provided for the
@@ -214,11 +239,10 @@ for reporting and proposing a fix for th
 <severity level="2">important</severity>
 <title>TLS/SSL X.509 client certificate auth bypass with HTTP/2</title>
 <description><p>
-
   For configurations enabling support for HTTP/2, SSL client
   certificate validation was not enforced if configured, allowing
   clients unauthorized access to protected resources over HTTP/2.
-
+</p><p>
   This issue affected releases 2.4.18 and 2.4.20 only.
 </p></description>
 <affects prod="httpd" version="2.4.20"/>