Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2021.3784
httpd:2.4 security update
10 November 2021
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: httpd:2.4
Publisher: Red Hat
Operating System: Red Hat
Impact/Access: Denial of Service -- Remote/Unauthenticated
Provide Misleading Information -- Remote/Unauthenticated
Access Confidential Data -- Remote/Unauthenticated
Reduced Security -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2021-40438 CVE-2021-30641 CVE-2021-26691
CVE-2021-26690 CVE-2021-20325
Reference: ESB-2021.3429
ESB-2021.3394
ESB-2021.3373
ESB-2021.3366
Original Bulletin:
https://access.redhat.com/errata/RHSA-2021:4537
Comment: This bulletin contains two (2) Red Hat security advisories.
CVE-2021-20325: Missing fixes for CVE-2021-40438 and CVE-2021-26691 in
the versions of httpd, as shipped in Red Hat Enterprise Linux 8.5.0,
causes a security regression compared to the versions shipped in Red Hat
Enterprise Linux 8.4
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: httpd:2.4 security update
Advisory ID: RHSA-2021:4537-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2021:4537
Issue date: 2021-11-09
CVE Names: CVE-2021-20325
=====================================================================
1. Summary:
An update for the httpd:2.4 module is now available for Red Hat Enterprise
Linux 8.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64
3. Description:
The httpd packages provide the Apache HTTP Server, a powerful, efficient,
and extensible web server.
Security Fix(es):
* httpd: Regression of CVE-2021-40438 and CVE-2021-26691 fixes in Red Hat
Enterprise Linux 8.5 (CVE-2021-20325)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing the updated packages, the httpd daemon will be restarted
automatically.
5. Bugs fixed (https://bugzilla.redhat.com/):
2017321 - CVE-2021-20325 httpd: Regression of CVE-2021-40438 and CVE-2021-26691 fixes in Red Hat Enterprise Linux 8.5
6. Package List:
Red Hat Enterprise Linux AppStream (v. 8):
Source:
httpd-2.4.37-43.module+el8.5.0+13064+c4b14997.src.rpm
mod_http2-1.15.7-3.module+el8.4.0+8625+d397f3da.src.rpm
mod_md-2.0.8-8.module+el8.3.0+6814+67d1e611.src.rpm
aarch64:
httpd-2.4.37-43.module+el8.5.0+13064+c4b14997.aarch64.rpm
httpd-debuginfo-2.4.37-43.module+el8.5.0+13064+c4b14997.aarch64.rpm
httpd-debugsource-2.4.37-43.module+el8.5.0+13064+c4b14997.aarch64.rpm
httpd-devel-2.4.37-43.module+el8.5.0+13064+c4b14997.aarch64.rpm
httpd-tools-2.4.37-43.module+el8.5.0+13064+c4b14997.aarch64.rpm
httpd-tools-debuginfo-2.4.37-43.module+el8.5.0+13064+c4b14997.aarch64.rpm
mod_http2-1.15.7-3.module+el8.4.0+8625+d397f3da.aarch64.rpm
mod_http2-debuginfo-1.15.7-3.module+el8.4.0+8625+d397f3da.aarch64.rpm
mod_http2-debugsource-1.15.7-3.module+el8.4.0+8625+d397f3da.aarch64.rpm
mod_ldap-2.4.37-43.module+el8.5.0+13064+c4b14997.aarch64.rpm
mod_ldap-debuginfo-2.4.37-43.module+el8.5.0+13064+c4b14997.aarch64.rpm
mod_md-2.0.8-8.module+el8.3.0+6814+67d1e611.aarch64.rpm
mod_md-debuginfo-2.0.8-8.module+el8.3.0+6814+67d1e611.aarch64.rpm
mod_md-debugsource-2.0.8-8.module+el8.3.0+6814+67d1e611.aarch64.rpm
mod_proxy_html-2.4.37-43.module+el8.5.0+13064+c4b14997.aarch64.rpm
mod_proxy_html-debuginfo-2.4.37-43.module+el8.5.0+13064+c4b14997.aarch64.rpm
mod_session-2.4.37-43.module+el8.5.0+13064+c4b14997.aarch64.rpm
mod_session-debuginfo-2.4.37-43.module+el8.5.0+13064+c4b14997.aarch64.rpm
mod_ssl-2.4.37-43.module+el8.5.0+13064+c4b14997.aarch64.rpm
mod_ssl-debuginfo-2.4.37-43.module+el8.5.0+13064+c4b14997.aarch64.rpm
noarch:
httpd-filesystem-2.4.37-43.module+el8.5.0+13064+c4b14997.noarch.rpm
httpd-manual-2.4.37-43.module+el8.5.0+13064+c4b14997.noarch.rpm
ppc64le:
httpd-2.4.37-43.module+el8.5.0+13064+c4b14997.ppc64le.rpm
httpd-debuginfo-2.4.37-43.module+el8.5.0+13064+c4b14997.ppc64le.rpm
httpd-debugsource-2.4.37-43.module+el8.5.0+13064+c4b14997.ppc64le.rpm
httpd-devel-2.4.37-43.module+el8.5.0+13064+c4b14997.ppc64le.rpm
httpd-tools-2.4.37-43.module+el8.5.0+13064+c4b14997.ppc64le.rpm
httpd-tools-debuginfo-2.4.37-43.module+el8.5.0+13064+c4b14997.ppc64le.rpm
mod_http2-1.15.7-3.module+el8.4.0+8625+d397f3da.ppc64le.rpm
mod_http2-debuginfo-1.15.7-3.module+el8.4.0+8625+d397f3da.ppc64le.rpm
mod_http2-debugsource-1.15.7-3.module+el8.4.0+8625+d397f3da.ppc64le.rpm
mod_ldap-2.4.37-43.module+el8.5.0+13064+c4b14997.ppc64le.rpm
mod_ldap-debuginfo-2.4.37-43.module+el8.5.0+13064+c4b14997.ppc64le.rpm
mod_md-2.0.8-8.module+el8.3.0+6814+67d1e611.ppc64le.rpm
mod_md-debuginfo-2.0.8-8.module+el8.3.0+6814+67d1e611.ppc64le.rpm
mod_md-debugsource-2.0.8-8.module+el8.3.0+6814+67d1e611.ppc64le.rpm
mod_proxy_html-2.4.37-43.module+el8.5.0+13064+c4b14997.ppc64le.rpm
mod_proxy_html-debuginfo-2.4.37-43.module+el8.5.0+13064+c4b14997.ppc64le.rpm
mod_session-2.4.37-43.module+el8.5.0+13064+c4b14997.ppc64le.rpm
mod_session-debuginfo-2.4.37-43.module+el8.5.0+13064+c4b14997.ppc64le.rpm
mod_ssl-2.4.37-43.module+el8.5.0+13064+c4b14997.ppc64le.rpm
mod_ssl-debuginfo-2.4.37-43.module+el8.5.0+13064+c4b14997.ppc64le.rpm
s390x:
httpd-2.4.37-43.module+el8.5.0+13064+c4b14997.s390x.rpm
httpd-debuginfo-2.4.37-43.module+el8.5.0+13064+c4b14997.s390x.rpm
httpd-debugsource-2.4.37-43.module+el8.5.0+13064+c4b14997.s390x.rpm
httpd-devel-2.4.37-43.module+el8.5.0+13064+c4b14997.s390x.rpm
httpd-tools-2.4.37-43.module+el8.5.0+13064+c4b14997.s390x.rpm
httpd-tools-debuginfo-2.4.37-43.module+el8.5.0+13064+c4b14997.s390x.rpm
mod_http2-1.15.7-3.module+el8.4.0+8625+d397f3da.s390x.rpm
mod_http2-debuginfo-1.15.7-3.module+el8.4.0+8625+d397f3da.s390x.rpm
mod_http2-debugsource-1.15.7-3.module+el8.4.0+8625+d397f3da.s390x.rpm
mod_ldap-2.4.37-43.module+el8.5.0+13064+c4b14997.s390x.rpm
mod_ldap-debuginfo-2.4.37-43.module+el8.5.0+13064+c4b14997.s390x.rpm
mod_md-2.0.8-8.module+el8.3.0+6814+67d1e611.s390x.rpm
mod_md-debuginfo-2.0.8-8.module+el8.3.0+6814+67d1e611.s390x.rpm
mod_md-debugsource-2.0.8-8.module+el8.3.0+6814+67d1e611.s390x.rpm
mod_proxy_html-2.4.37-43.module+el8.5.0+13064+c4b14997.s390x.rpm
mod_proxy_html-debuginfo-2.4.37-43.module+el8.5.0+13064+c4b14997.s390x.rpm
mod_session-2.4.37-43.module+el8.5.0+13064+c4b14997.s390x.rpm
mod_session-debuginfo-2.4.37-43.module+el8.5.0+13064+c4b14997.s390x.rpm
mod_ssl-2.4.37-43.module+el8.5.0+13064+c4b14997.s390x.rpm
mod_ssl-debuginfo-2.4.37-43.module+el8.5.0+13064+c4b14997.s390x.rpm
x86_64:
httpd-2.4.37-43.module+el8.5.0+13064+c4b14997.x86_64.rpm
httpd-debuginfo-2.4.37-43.module+el8.5.0+13064+c4b14997.x86_64.rpm
httpd-debugsource-2.4.37-43.module+el8.5.0+13064+c4b14997.x86_64.rpm
httpd-devel-2.4.37-43.module+el8.5.0+13064+c4b14997.x86_64.rpm
httpd-tools-2.4.37-43.module+el8.5.0+13064+c4b14997.x86_64.rpm
httpd-tools-debuginfo-2.4.37-43.module+el8.5.0+13064+c4b14997.x86_64.rpm
mod_http2-1.15.7-3.module+el8.4.0+8625+d397f3da.x86_64.rpm
mod_http2-debuginfo-1.15.7-3.module+el8.4.0+8625+d397f3da.x86_64.rpm
mod_http2-debugsource-1.15.7-3.module+el8.4.0+8625+d397f3da.x86_64.rpm
mod_ldap-2.4.37-43.module+el8.5.0+13064+c4b14997.x86_64.rpm
mod_ldap-debuginfo-2.4.37-43.module+el8.5.0+13064+c4b14997.x86_64.rpm
mod_md-2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64.rpm
mod_md-debuginfo-2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64.rpm
mod_md-debugsource-2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64.rpm
mod_proxy_html-2.4.37-43.module+el8.5.0+13064+c4b14997.x86_64.rpm
mod_proxy_html-debuginfo-2.4.37-43.module+el8.5.0+13064+c4b14997.x86_64.rpm
mod_session-2.4.37-43.module+el8.5.0+13064+c4b14997.x86_64.rpm
mod_session-debuginfo-2.4.37-43.module+el8.5.0+13064+c4b14997.x86_64.rpm
mod_ssl-2.4.37-43.module+el8.5.0+13064+c4b14997.x86_64.rpm
mod_ssl-debuginfo-2.4.37-43.module+el8.5.0+13064+c4b14997.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2021-20325
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/errata/RHSA-2021:3816
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2021 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBYYswotzjgjWX9erEAQhiCxAAiYXqPy9Wb3l3+GbVhoY0jae8NbwmAHcv
nNviY/vHHdMy8RrOp1fKrp3rbkCZp/IYvm24j4qdIys8iS8ShCCHAqnVpLexSG5h
UJGVAi3Kqy/yVSf3xB4kI3yaaTjkSJ20TB9lpcxA8Y22R6STMwjchrp/SIRh81oP
LUzst/OikO7504GXsCrqj+PNZkG1qN4O2WaPZVQ/pCZpQHqGSGme76dDbeS0LowW
V1LVwCK49zepUPi5RkCqbGNBktzt+hmLHuzZg7acDcmQpuCWTPt85QeEYi2YtNWJ
7BLTpRFK9mXXYuesiJA2A+gFs7LDnboAzVbJEZarkIV7kANZiqVS80QSVjbnG0zF
2da3hVYAbOQcIl4g/hzxBctvFCZHUkJyBLA9ccUaHzO6U+mDIOQt1Rh96Pi/GsJh
eJd08Nzj4HHpuCJILpiRu1gwp93TlsuvoUC6gmtmg3xiLLAIKjDIRm8BWj2nVG5N
ToE2emSSmj9se5nCq6/yPLbHp5JtMCW5KKe3VNoBz5ybtNhnNUZ3FLr4vkivIjrx
SMHGkkFs1DHKj0OopR2BQO5IQv+qaTetLg85UJzC8gwDfDBhooE+V83osPC8PgJG
3FAWvE4Zow6Jr2KBAQKIwr01+/qA546jKbcKz5+1GkI7CXIodA2u3XCfMl+uU1x/
7Alo43qHDwo=
=aakR
- -----END PGP SIGNATURE-----
- -----------------------------------------------------------------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: httpd:2.4 security, bug fix, and enhancement update
Advisory ID: RHSA-2021:4257-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2021:4257
Issue date: 2021-11-09
CVE Names: CVE-2021-26690 CVE-2021-30641
=====================================================================
1. Summary:
An update for the httpd:2.4 module is now available for Red Hat Enterprise
Linux 8.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64
3. Description:
The httpd packages provide the Apache HTTP Server, a powerful, efficient,
and extensible web server.
Security Fix(es):
* httpd: mod_session: NULL pointer dereference when parsing Cookie header
(CVE-2021-26690)
* httpd: Unexpected URL matching with 'MergeSlashes OFF' (CVE-2021-30641)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat
Enterprise Linux 8.5 Release Notes linked from the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing the updated packages, the httpd daemon will be restarted
automatically.
5. Bugs fixed (https://bugzilla.redhat.com/):
1905613 - mod_ssl does not like valid certificate chain
1934741 - Apache trademark update - new logo
1935742 - [RFE] backport samesite/httponly/secure flags for usertrack
1937334 - SSLProtocol with based virtual hosts
1952557 - mod_proxy_wstunnel.html is a malformed XML
1966729 - CVE-2021-26690 httpd: mod_session: NULL pointer dereference when parsing Cookie header
1966743 - CVE-2021-30641 httpd: Unexpected URL matching with 'MergeSlashes OFF'
6. Package List:
Red Hat Enterprise Linux AppStream (v. 8):
Source:
httpd-2.4.37-41.module+el8.5.0+11772+c8e0c271.src.rpm
mod_http2-1.15.7-3.module+el8.4.0+8625+d397f3da.src.rpm
mod_md-2.0.8-8.module+el8.3.0+6814+67d1e611.src.rpm
aarch64:
httpd-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm
httpd-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm
httpd-debugsource-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm
httpd-devel-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm
httpd-tools-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm
httpd-tools-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm
mod_http2-1.15.7-3.module+el8.4.0+8625+d397f3da.aarch64.rpm
mod_http2-debuginfo-1.15.7-3.module+el8.4.0+8625+d397f3da.aarch64.rpm
mod_http2-debugsource-1.15.7-3.module+el8.4.0+8625+d397f3da.aarch64.rpm
mod_ldap-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm
mod_ldap-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm
mod_md-2.0.8-8.module+el8.3.0+6814+67d1e611.aarch64.rpm
mod_md-debuginfo-2.0.8-8.module+el8.3.0+6814+67d1e611.aarch64.rpm
mod_md-debugsource-2.0.8-8.module+el8.3.0+6814+67d1e611.aarch64.rpm
mod_proxy_html-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm
mod_proxy_html-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm
mod_session-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm
mod_session-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm
mod_ssl-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm
mod_ssl-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.aarch64.rpm
noarch:
httpd-filesystem-2.4.37-41.module+el8.5.0+11772+c8e0c271.noarch.rpm
httpd-manual-2.4.37-41.module+el8.5.0+11772+c8e0c271.noarch.rpm
ppc64le:
httpd-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm
httpd-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm
httpd-debugsource-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm
httpd-devel-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm
httpd-tools-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm
httpd-tools-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm
mod_http2-1.15.7-3.module+el8.4.0+8625+d397f3da.ppc64le.rpm
mod_http2-debuginfo-1.15.7-3.module+el8.4.0+8625+d397f3da.ppc64le.rpm
mod_http2-debugsource-1.15.7-3.module+el8.4.0+8625+d397f3da.ppc64le.rpm
mod_ldap-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm
mod_ldap-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm
mod_md-2.0.8-8.module+el8.3.0+6814+67d1e611.ppc64le.rpm
mod_md-debuginfo-2.0.8-8.module+el8.3.0+6814+67d1e611.ppc64le.rpm
mod_md-debugsource-2.0.8-8.module+el8.3.0+6814+67d1e611.ppc64le.rpm
mod_proxy_html-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm
mod_proxy_html-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm
mod_session-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm
mod_session-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm
mod_ssl-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm
mod_ssl-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.ppc64le.rpm
s390x:
httpd-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm
httpd-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm
httpd-debugsource-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm
httpd-devel-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm
httpd-tools-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm
httpd-tools-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm
mod_http2-1.15.7-3.module+el8.4.0+8625+d397f3da.s390x.rpm
mod_http2-debuginfo-1.15.7-3.module+el8.4.0+8625+d397f3da.s390x.rpm
mod_http2-debugsource-1.15.7-3.module+el8.4.0+8625+d397f3da.s390x.rpm
mod_ldap-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm
mod_ldap-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm
mod_md-2.0.8-8.module+el8.3.0+6814+67d1e611.s390x.rpm
mod_md-debuginfo-2.0.8-8.module+el8.3.0+6814+67d1e611.s390x.rpm
mod_md-debugsource-2.0.8-8.module+el8.3.0+6814+67d1e611.s390x.rpm
mod_proxy_html-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm
mod_proxy_html-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm
mod_session-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm
mod_session-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm
mod_ssl-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm
mod_ssl-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.s390x.rpm
x86_64:
httpd-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm
httpd-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm
httpd-debugsource-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm
httpd-devel-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm
httpd-tools-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm
httpd-tools-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm
mod_http2-1.15.7-3.module+el8.4.0+8625+d397f3da.x86_64.rpm
mod_http2-debuginfo-1.15.7-3.module+el8.4.0+8625+d397f3da.x86_64.rpm
mod_http2-debugsource-1.15.7-3.module+el8.4.0+8625+d397f3da.x86_64.rpm
mod_ldap-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm
mod_ldap-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm
mod_md-2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64.rpm
mod_md-debuginfo-2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64.rpm
mod_md-debugsource-2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64.rpm
mod_proxy_html-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm
mod_proxy_html-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm
mod_session-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm
mod_session-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm
mod_ssl-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm
mod_ssl-debuginfo-2.4.37-41.module+el8.5.0+11772+c8e0c271.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2021-26690
https://access.redhat.com/security/cve/CVE-2021-30641
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2021 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBYYrer9zjgjWX9erEAQidnxAAljIz0c1qtUxP9lnANeO/5Dkx3XhX1VaN
sOO/DRmelj7YeHeelF1HfX3lTfRXZ22/rSzV/EbCMhnRYheTpKq5kCmCanqRmHvo
F3CVF2c9wbPpi6b/ww+VzdF4RuhWSY7ZN+oOT8P8rxtX9GcmQ9lYB+HF/BAKVPB7
BHWcJ9eK+wenF931qT6Tg00dfWLJdwEeefZOw1G0VeeUdw4S420LYNM0DHA10HiC
58mzqQMCh2lJ4nlMlK5BHWcTOm0J6AJkoHNrDWHvyAdbtKmK6wgRiSx5WMRmhTin
RgXchqrR52GwZwrCCkXhXzMhZ2Ps7G1hgPLXguApDP2AGDFQ/YlTMAImMBGwZw8i
jwMq8BL785q4FRKrgCjM0iNBoGYW5rkBtJbiSPeiBuE0VF8ryDp8uwTsREaw/Ybk
xKw5kry6Cj2Kl1kuvEI7Px9oFh5Wz1ZImfUaUP+GYDFwUmHdmMZj+bzwGQF21B1M
IRpnQH1A8LGF73FWrPX7UBUmzstRadxfbtLXdeOnxxooXbCTwRS4afz4JkZubEZ6
XhrOCJsTM6idFd6NTMYT8f+UhoSojMvqrP27oi4DhiJw4T9Qh5qV0sp3v4+UwD0b
VXWRUvWSRk3pVgDPVnhlnK1Ga9GFG5hg0TMo3ssqjq0PknJWcaSIEoFsOkuGxa4t
F+wizQuyFY4=
=Bqs/
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBYYtKQuNLKJtyKPYoAQgHxBAAkVw8HcN5goyDCqlItoDoG5a42oQuOQp/
hJndPWOA3bz05ei8jidU6TvtVmFMI4sv+7aVte7dJMoYrv627qO0ZClipipQbOHf
wPIKIARIg4UmbKME+SyuwbvukiW2G7SReleE31jqUfj5LfltfviGjs0zkXYtewoq
fj4o3iyok2w2OmHASn11GT2Occpel0qA6p2MU6/Ag+rsk1Zp0GXHF9Q128bibBvh
+NOAkeAEMb8prS1LWwqzaF17VVkv+sMY8k/RiKwPh4BpQ2lebFFBu5NqC8LoyEKB
7cwrcHDZRU9CRMsYwLuYomvgWaEk+y295tmmKlXwYJBj2SGCJcItsihz0+X+pKuE
q0aaa49nHk3ZVlszxTzCpJ1zKlZp6QXlbVW4XoBCw2BMM6Ap2gV7c0gZcdfCHoZU
9+eea/Huu0Zpg4Rf22QxkcCholhik+E7MUYZDAHR7PSuezqS1jbOR4aoHqmDNvJ7
ILcPtQsZLnH3zoNgfM6cuSD+G9Ta5DSGf2SoquakDPGo4SG7DOZmqUVF+LXrjNII
p/KomrDt6kNTmIn4Uakd7mE7ZBe7esvWIuUvEp6CJmXVnPt7plfgyc/ier+KqFhd
vn2L0Y7q0zRkKLlzskhnZJ0DlIZrMqVGAuhDYvrS1JEei4kT8BsoZO7iopKoG6HR
oxBncsnsD10=
=x9a4
-----END PGP SIGNATURE-----