Описание
The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."
A flaw was found in the way httpd handled HTTP Trailer headers when processing requests using chunked encoding. A malicious client could use Trailer headers to set additional HTTP headers after header processing was performed by other modules. This could, for example, lead to a bypass of header restrictions defined with mod_headers.
Отчет
This issue affects the versions of the httpd package as shipped with Red Hat JBoss Enterprise Application Platform 6; and Red Hat JBoss Web Server 2. Red Hat Product Security has rated this issue as having Low security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/. Red Hat Certificate System does not use the mod_headers module, even when installed, and is thus not affected by this flaw. Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/. Red Hat JBoss Enterprise Application Platform 5 and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/
Затронутые пакеты
Платформа | Пакет | Состояние | Рекомендация | Релиз |
---|---|---|---|---|
Red Hat Directory Server 8 | httpd | Will not fix | ||
Red Hat Enterprise Linux 5 | httpd | Will not fix | ||
Red Hat JBoss Enterprise Application Platform 5 | httpd | Will not fix | ||
Red Hat JBoss Enterprise Application Platform 6 | httpd | Fix deferred | ||
Red Hat JBoss Enterprise Web Server 1 | httpd | Will not fix | ||
Red Hat Enterprise Linux 6 | httpd | Fixed | RHSA-2015:1249 | 20.07.2015 |
Red Hat Enterprise Linux 7 | httpd | Fixed | RHSA-2015:0325 | 05.03.2015 |
Red Hat JBoss Enterprise Web Server 2 for RHEL 5 | httpd | Fixed | RHSA-2016:0061 | 21.01.2016 |
Red Hat JBoss Enterprise Web Server 2 for RHEL 5 | mod_cluster-native | Fixed | RHSA-2016:0061 | 21.01.2016 |
Red Hat JBoss Enterprise Web Server 2 for RHEL 6 | httpd | Fixed | RHSA-2016:0061 | 21.01.2016 |
Показывать по
Дополнительная информация
Статус:
EPSS
4.3 Medium
CVSS2
Связанные уязвимости
The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."
The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."
The mod_headers module in the Apache HTTP Server 2.2.22 allows remote ...
The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."
ELSA-2015-1249: httpd security, bug fix, and enhancement update (LOW)
EPSS
4.3 Medium
CVSS2