RHSA-2017:1161MediumCVSS 7.5

Red Hat Security Advisory: httpd24-httpd security, bug fix, and enhancement update

Published
April 26, 2017
Last Modified
November 5, 2026

🔗 CVE IDs covered (6)

CVE-2016-2161 →CVE-2016-8740 →CVE-2016-8743 →CVE-2020-11985 →CVE-2016-0736 →CVE-2016-1546 →

📋 Description

CVE-2016-0736 — httpd: Padding Oracle in Apache mod_session_crypto CVE-2016-1546 — httpd: mod_http2 denial-of-service by thread starvation CVE-2016-2161 — httpd: DoS vulnerability in mod_auth_digest CVE-2016-8740 — httpd: Incomplete handling of LimitRequestFields directive in mod_http2 CVE-2016-8743 — httpd: Apache HTTP Request Parsing Whitespace Defects CVE-2020-11985 — httpd: IP address spoofing when proxying using mod_remoteip and mod_rewrite

🎯 Affected products66

  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)
  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)
  • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)
  • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)
  • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • httpd24-httpd-0:2.4.25-9.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)
  • httpd24-httpd-0:2.4.25-9.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)
  • httpd24-httpd-0:2.4.25-9.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)
  • httpd24-httpd-0:2.4.25-9.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)
  • httpd24-httpd-0:2.4.25-9.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)
  • httpd24-httpd-0:2.4.25-9.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)
  • httpd24-httpd-0:2.4.25-9.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • httpd24-httpd-0:2.4.25-9.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)
  • httpd24-httpd-0:2.4.25-9.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • httpd24-httpd-0:2.4.25-9.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • httpd24-httpd-0:2.4.25-9.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)
  • httpd24-httpd-0:2.4.25-9.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)
  • httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)
  • httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)
  • httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)
  • httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • httpd24-httpd-devel-0:2.4.25-9.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)
  • httpd24-httpd-devel-0:2.4.25-9.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)
  • httpd24-httpd-devel-0:2.4.25-9.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)
  • httpd24-httpd-devel-0:2.4.25-9.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)
  • httpd24-httpd-devel-0:2.4.25-9.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)
  • httpd24-httpd-devel-0:2.4.25-9.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)
  • +36 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the updated packages, the httpd daemon will be restarted automatically. Workaround: As a temporary workaround - HTTP/2 can be disabled by changing the configuration by removing h2 and h2c from the Protocols line(s) in the configuration file. The resulting line should read: Protocols http/1.1

🔗 References (14)