RHSA-2017:1415HighCVSS 7.5

Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 1

Published
June 7, 2017
Last Modified
November 5, 2026

🔗 CVE IDs covered (7)

CVE-2016-0736 →CVE-2016-2161 →CVE-2016-6304 →CVE-2016-7056 →CVE-2016-8610 →CVE-2016-8740 →CVE-2016-8743 →

📋 Description

CVE-2016-0736 — httpd: Padding Oracle in Apache mod_session_crypto CVE-2016-2161 — httpd: DoS vulnerability in mod_auth_digest CVE-2016-6304 — openssl: OCSP Status Request extension unbounded memory growth CVE-2016-7056 — openssl: ECDSA P-256 timing attack key recovery CVE-2016-8610 — SSL/TLS: Malformed plain-text ALERT packets could cause remote DoS CVE-2016-8740 — httpd: Incomplete handling of LimitRequestFields directive in mod_http2 CVE-2016-8743 — httpd: Apache HTTP Request Parsing Whitespace Defects

🎯 Affected products1

  • Red Hat JBoss Core Services

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: As a temporary workaround - HTTP/2 can be disabled by changing the configuration by removing h2 and h2c from the Protocols line(s) in the configuration file. The resulting line should read: Protocols http/1.1

🔗 References (12)