RHSA-2017:1413HighCVSS 7.5

Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 1 for RHEL 7

Published
June 7, 2017
Last Modified
November 5, 2026

🔗 CVE IDs covered (7)

CVE-2016-6304 →CVE-2016-7056 →CVE-2016-8610 →CVE-2016-8740 →CVE-2016-8743 →CVE-2016-0736 →CVE-2016-2161 →

📋 Description

CVE-2016-0736 — httpd: Padding Oracle in Apache mod_session_crypto CVE-2016-2161 — httpd: DoS vulnerability in mod_auth_digest CVE-2016-6304 — openssl: OCSP Status Request extension unbounded memory growth CVE-2016-7056 — openssl: ECDSA P-256 timing attack key recovery CVE-2016-8610 — SSL/TLS: Malformed plain-text ALERT packets could cause remote DoS CVE-2016-8740 — httpd: Incomplete handling of LimitRequestFields directive in mod_http2 CVE-2016-8743 — httpd: Apache HTTP Request Parsing Whitespace Defects

🎯 Affected products23

  • Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el7.noarch as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server
  • jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically. Workaround: As a temporary workaround - HTTP/2 can be disabled by changing the configuration by removing h2 and h2c from the Protocols line(s) in the configuration file. The resulting line should read: Protocols http/1.1

🔗 References (12)