Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2004-0488
Vulnerability from cvelistv5
Published
2004-05-28 04:00
Modified
2024-08-08 00:17
Severity ?
EPSS score ?
Summary
Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.
References
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-08T00:17:15.134Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { name: "2004-0031", tags: [ "vendor-advisory", "x_refsource_TRUSTIX", "x_transferred", ], url: "http://www.trustix.net/errata/2004/0031/", }, { name: "oval:org.mitre.oval:def:11458", tags: [ "vdb-entry", "signature", "x_refsource_OVAL", "x_transferred", ], url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11458", }, { name: "MDKSA-2004:054", tags: [ "vendor-advisory", "x_refsource_MANDRAKE", "x_transferred", ], url: "http://www.mandriva.com/security/advisories?name=MDKSA-2004:054", }, { name: "RHSA-2004:342", tags: [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred", ], url: "http://www.redhat.com/support/errata/RHSA-2004-342.html", }, { name: "RHSA-2004:245", tags: [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred", ], url: "http://rhn.redhat.com/errata/RHSA-2004-245.html", }, { name: "GLSA-200406-05", tags: [ "vendor-advisory", "x_refsource_GENTOO", "x_transferred", ], url: "http://security.gentoo.org/glsa/glsa-200406-05.xml", }, { name: "20040527 [OpenPKG-SA-2004.026] OpenPKG Security Advisory (apache)", tags: [ "mailing-list", "x_refsource_BUGTRAQ", "x_transferred", ], url: "http://marc.info/?l=bugtraq&m=108567431823750&w=2", }, { name: "RHSA-2004:405", tags: [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred", ], url: "http://www.redhat.com/support/errata/RHSA-2004-405.html", }, { name: "SSRT4788", tags: [ "vendor-advisory", "x_refsource_HP", "x_transferred", ], url: "http://marc.info/?l=bugtraq&m=109215056218824&w=2", }, { name: "20040605-01-U", tags: [ "vendor-advisory", "x_refsource_SGI", "x_transferred", ], url: "ftp://patches.sgi.com/support/free/security/advisories/20040605-01-U.asc", }, { name: "RHSA-2005:816", tags: [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred", ], url: "http://www.redhat.com/support/errata/RHSA-2005-816.html", }, { name: "SSRT4777", tags: [ "vendor-advisory", "x_refsource_HP", "x_transferred", ], url: "http://marc.info/?l=bugtraq&m=109181600614477&w=2", }, { name: "20040517 mod_ssl ssl_util_uuencode_binary potential problem", tags: [ "mailing-list", "x_refsource_FULLDISC", "x_transferred", ], url: "http://lists.grok.org.uk/pipermail/full-disclosure/2004-May/021610.html", }, { name: "10355", tags: [ "vdb-entry", "x_refsource_BID", "x_transferred", ], url: "http://www.securityfocus.com/bid/10355", }, { name: "DSA-532", tags: [ "vendor-advisory", "x_refsource_DEBIAN", "x_transferred", ], url: "http://www.debian.org/security/2004/dsa-532", }, { name: "FLSA:1888", tags: [ "vendor-advisory", "x_refsource_FEDORA", "x_transferred", ], url: "https://bugzilla.fedora.us/show_bug.cgi?id=1888", }, { name: "MDKSA-2004:055", tags: [ "vendor-advisory", "x_refsource_MANDRAKE", "x_transferred", ], url: "http://www.mandriva.com/security/advisories?name=MDKSA-2004:055", }, { name: "apache-modssl-uuencode-bo(16214)", tags: [ "vdb-entry", "x_refsource_XF", "x_transferred", ], url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/16214", }, { name: "20040601 TSSA-2004-008 - apache", tags: [ "mailing-list", "x_refsource_BUGTRAQ", "x_transferred", ], url: "http://marc.info/?l=bugtraq&m=108619129727620&w=2", }, { name: "[httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20200401 svn commit: r1058586 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20200401 svn commit: r1058587 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073139 [3/13] - in /websites/staging/httpd/trunk/content: ./ security/json/", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/re895fc1736d25c8cf57e102c871613b8aeec9ea26fd8a44e7942b5ab%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1888194 [3/13] - /httpd/site/trunk/content/security/json/", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/rd65d8ba68ba17e7deedafbf5bb4899f2ae4dad781d21b931c2941ac3%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073140 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073143 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073149 [3/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/raa117ef183f0da9b3f46efbeaa66f7622bd68868a450cae4fd8ed594%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210606 svn commit: r1075470 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", "x_transferred", ], url: "https://lists.apache.org/thread.html/r5001ecf3d6b2bdd0b732e527654248abb264f08390045d30709a92f6%40%3Ccvs.httpd.apache.org%3E", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "n/a", vendor: "n/a", versions: [ { status: "affected", version: "n/a", }, ], }, ], datePublic: "2004-05-17T00:00:00", descriptions: [ { lang: "en", value: "Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.", }, ], problemTypes: [ { descriptions: [ { description: "n/a", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2021-06-06T10:10:24", orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", shortName: "mitre", }, references: [ { name: "2004-0031", tags: [ "vendor-advisory", "x_refsource_TRUSTIX", ], url: "http://www.trustix.net/errata/2004/0031/", }, { name: "oval:org.mitre.oval:def:11458", tags: [ "vdb-entry", "signature", "x_refsource_OVAL", ], url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11458", }, { name: "MDKSA-2004:054", tags: [ "vendor-advisory", "x_refsource_MANDRAKE", ], url: "http://www.mandriva.com/security/advisories?name=MDKSA-2004:054", }, { name: "RHSA-2004:342", tags: [ "vendor-advisory", "x_refsource_REDHAT", ], url: "http://www.redhat.com/support/errata/RHSA-2004-342.html", }, { name: "RHSA-2004:245", tags: [ "vendor-advisory", "x_refsource_REDHAT", ], url: "http://rhn.redhat.com/errata/RHSA-2004-245.html", }, { name: "GLSA-200406-05", tags: [ "vendor-advisory", "x_refsource_GENTOO", ], url: "http://security.gentoo.org/glsa/glsa-200406-05.xml", }, { name: "20040527 [OpenPKG-SA-2004.026] OpenPKG Security Advisory (apache)", tags: [ "mailing-list", "x_refsource_BUGTRAQ", ], url: "http://marc.info/?l=bugtraq&m=108567431823750&w=2", }, { name: "RHSA-2004:405", tags: [ "vendor-advisory", "x_refsource_REDHAT", ], url: "http://www.redhat.com/support/errata/RHSA-2004-405.html", }, { name: "SSRT4788", tags: [ "vendor-advisory", "x_refsource_HP", ], url: "http://marc.info/?l=bugtraq&m=109215056218824&w=2", }, { name: "20040605-01-U", tags: [ "vendor-advisory", "x_refsource_SGI", ], url: "ftp://patches.sgi.com/support/free/security/advisories/20040605-01-U.asc", }, { name: "RHSA-2005:816", tags: [ "vendor-advisory", "x_refsource_REDHAT", ], url: "http://www.redhat.com/support/errata/RHSA-2005-816.html", }, { name: "SSRT4777", tags: [ "vendor-advisory", "x_refsource_HP", ], url: "http://marc.info/?l=bugtraq&m=109181600614477&w=2", }, { name: "20040517 mod_ssl ssl_util_uuencode_binary potential problem", tags: [ "mailing-list", "x_refsource_FULLDISC", ], url: "http://lists.grok.org.uk/pipermail/full-disclosure/2004-May/021610.html", }, { name: "10355", tags: [ "vdb-entry", "x_refsource_BID", ], url: "http://www.securityfocus.com/bid/10355", }, { name: "DSA-532", tags: [ "vendor-advisory", "x_refsource_DEBIAN", ], url: "http://www.debian.org/security/2004/dsa-532", }, { name: "FLSA:1888", tags: [ "vendor-advisory", "x_refsource_FEDORA", ], url: "https://bugzilla.fedora.us/show_bug.cgi?id=1888", }, { name: "MDKSA-2004:055", tags: [ "vendor-advisory", "x_refsource_MANDRAKE", ], url: "http://www.mandriva.com/security/advisories?name=MDKSA-2004:055", }, { name: "apache-modssl-uuencode-bo(16214)", tags: [ "vdb-entry", "x_refsource_XF", ], url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/16214", }, { name: "20040601 TSSA-2004-008 - apache", tags: [ "mailing-list", "x_refsource_BUGTRAQ", ], url: "http://marc.info/?l=bugtraq&m=108619129727620&w=2", }, { name: "[httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20200401 svn commit: r1058586 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20200401 svn commit: r1058587 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073139 [3/13] - in /websites/staging/httpd/trunk/content: ./ security/json/", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/re895fc1736d25c8cf57e102c871613b8aeec9ea26fd8a44e7942b5ab%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1888194 [3/13] - /httpd/site/trunk/content/security/json/", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/rd65d8ba68ba17e7deedafbf5bb4899f2ae4dad781d21b931c2941ac3%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073140 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073143 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073149 [3/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/raa117ef183f0da9b3f46efbeaa66f7622bd68868a450cae4fd8ed594%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210606 svn commit: r1075470 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", tags: [ "mailing-list", "x_refsource_MLIST", ], url: "https://lists.apache.org/thread.html/r5001ecf3d6b2bdd0b732e527654248abb264f08390045d30709a92f6%40%3Ccvs.httpd.apache.org%3E", }, ], x_legacyV4Record: { CVE_data_meta: { ASSIGNER: "cve@mitre.org", ID: "CVE-2004-0488", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "n/a", version: { version_data: [ { version_value: "n/a", }, ], }, }, ], }, vendor_name: "n/a", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "n/a", }, ], }, ], }, references: { reference_data: [ { name: "2004-0031", refsource: "TRUSTIX", url: "http://www.trustix.net/errata/2004/0031/", }, { name: "oval:org.mitre.oval:def:11458", refsource: "OVAL", url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11458", }, { name: "MDKSA-2004:054", refsource: "MANDRAKE", url: "http://www.mandriva.com/security/advisories?name=MDKSA-2004:054", }, { name: "RHSA-2004:342", refsource: "REDHAT", url: "http://www.redhat.com/support/errata/RHSA-2004-342.html", }, { name: "RHSA-2004:245", refsource: "REDHAT", url: "http://rhn.redhat.com/errata/RHSA-2004-245.html", }, { name: "GLSA-200406-05", refsource: "GENTOO", url: "http://security.gentoo.org/glsa/glsa-200406-05.xml", }, { name: "20040527 [OpenPKG-SA-2004.026] OpenPKG Security Advisory (apache)", refsource: "BUGTRAQ", url: "http://marc.info/?l=bugtraq&m=108567431823750&w=2", }, { name: "RHSA-2004:405", refsource: "REDHAT", url: "http://www.redhat.com/support/errata/RHSA-2004-405.html", }, { name: "SSRT4788", refsource: "HP", url: "http://marc.info/?l=bugtraq&m=109215056218824&w=2", }, { name: "20040605-01-U", refsource: "SGI", url: "ftp://patches.sgi.com/support/free/security/advisories/20040605-01-U.asc", }, { name: "RHSA-2005:816", refsource: "REDHAT", url: "http://www.redhat.com/support/errata/RHSA-2005-816.html", }, { name: "SSRT4777", refsource: "HP", url: "http://marc.info/?l=bugtraq&m=109181600614477&w=2", }, { name: "20040517 mod_ssl ssl_util_uuencode_binary potential problem", refsource: "FULLDISC", url: "http://lists.grok.org.uk/pipermail/full-disclosure/2004-May/021610.html", }, { name: "10355", refsource: "BID", url: "http://www.securityfocus.com/bid/10355", }, { name: "DSA-532", refsource: "DEBIAN", url: "http://www.debian.org/security/2004/dsa-532", }, { name: "FLSA:1888", refsource: "FEDORA", url: "https://bugzilla.fedora.us/show_bug.cgi?id=1888", }, { name: "MDKSA-2004:055", refsource: "MANDRAKE", url: "http://www.mandriva.com/security/advisories?name=MDKSA-2004:055", }, { name: "apache-modssl-uuencode-bo(16214)", refsource: "XF", url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/16214", }, { name: "20040601 TSSA-2004-008 - apache", refsource: "BUGTRAQ", url: "http://marc.info/?l=bugtraq&m=108619129727620&w=2", }, { name: "[httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20200401 svn commit: r1058586 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20200401 svn commit: r1058587 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073139 [3/13] - in /websites/staging/httpd/trunk/content: ./ security/json/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/re895fc1736d25c8cf57e102c871613b8aeec9ea26fd8a44e7942b5ab@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1888194 [3/13] - /httpd/site/trunk/content/security/json/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/rd65d8ba68ba17e7deedafbf5bb4899f2ae4dad781d21b931c2941ac3@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073140 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073143 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073149 [3/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/raa117ef183f0da9b3f46efbeaa66f7622bd68868a450cae4fd8ed594@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210606 svn commit: r1075470 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r5001ecf3d6b2bdd0b732e527654248abb264f08390045d30709a92f6@%3Ccvs.httpd.apache.org%3E", }, ], }, }, }, }, cveMetadata: { assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca", assignerShortName: "mitre", cveId: "CVE-2004-0488", datePublished: "2004-05-28T04:00:00", dateReserved: "2004-05-24T00:00:00", dateUpdated: "2024-08-08T00:17:15.134Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", "vulnerability-lookup:meta": { fkie_nvd: { configurations: "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2.0.35\", \"versionEndExcluding\": \"2.0.50\", \"matchCriteriaId\": \"B71C49F3-0F7C-4B25-AB0D-BBB2A0C5144F\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:3.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2CAE037F-111C-4A76-8FFE-716B74D65EF3\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:redhat:enterprise_linux_server:2.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0F9EF63F-DDA3-448B-92D7-27ED92C51FED\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:redhat:enterprise_linux_workstation:2.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"53A61204-33CE-422F-8285-20A5E98ADF3F\"}]}]}]", descriptions: "[{\"lang\": \"en\", \"value\": \"Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.\"}, {\"lang\": \"es\", \"value\": \"Desbordamiento de b\\u00fafer basado en la pila en la funci\\u00f3n ssl_util_uuencode_binary en ssl_util.c de mod_ssl de Apache cuando se configura mod_ssl para que confie en la Autoridad Certificadora emisora, puede permitir a atacantes remotos ejecutar c\\u00f3digo arbitrario mediante un certificado de cliente con un DN de asunto grande.\"}]", id: "CVE-2004-0488", lastModified: "2024-11-20T23:48:41.960", metrics: "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:P/I:P/A:P\", \"baseScore\": 7.5, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"HIGH\", \"exploitabilityScore\": 10.0, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": true, \"userInteractionRequired\": false}]}", published: "2004-07-07T04:00:00.000", references: "[{\"url\": \"ftp://patches.sgi.com/support/free/security/advisories/20040605-01-U.asc\", \"source\": \"cve@mitre.org\", \"tags\": [\"Broken Link\"]}, {\"url\": \"http://lists.grok.org.uk/pipermail/full-disclosure/2004-May/021610.html\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://marc.info/?l=bugtraq&m=108567431823750&w=2\", \"source\": \"cve@mitre.org\", \"tags\": [\"Issue Tracking\", \"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://marc.info/?l=bugtraq&m=108619129727620&w=2\", \"source\": \"cve@mitre.org\", \"tags\": [\"Issue Tracking\", \"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://marc.info/?l=bugtraq&m=109181600614477&w=2\", \"source\": \"cve@mitre.org\", \"tags\": [\"Issue Tracking\", \"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://marc.info/?l=bugtraq&m=109215056218824&w=2\", \"source\": \"cve@mitre.org\", \"tags\": [\"Issue Tracking\", \"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2004-245.html\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://security.gentoo.org/glsa/glsa-200406-05.xml\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.debian.org/security/2004/dsa-532\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.mandriva.com/security/advisories?name=MDKSA-2004:054\", \"source\": \"cve@mitre.org\", \"tags\": [\"Broken Link\"]}, {\"url\": \"http://www.mandriva.com/security/advisories?name=MDKSA-2004:055\", \"source\": \"cve@mitre.org\", \"tags\": [\"Broken Link\"]}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2004-342.html\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2004-405.html\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2005-816.html\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/10355\", \"source\": \"cve@mitre.org\", \"tags\": [\"Patch\", \"Third Party Advisory\", \"VDB Entry\", \"Vendor Advisory\"]}, {\"url\": \"http://www.trustix.net/errata/2004/0031/\", \"source\": \"cve@mitre.org\", \"tags\": [\"Broken Link\"]}, {\"url\": \"https://bugzilla.fedora.us/show_bug.cgi?id=1888\", \"source\": \"cve@mitre.org\", \"tags\": [\"Broken Link\", \"Issue Tracking\"]}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/16214\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://lists.apache.org/thread.html/r5001ecf3d6b2bdd0b732e527654248abb264f08390045d30709a92f6%40%3Ccvs.httpd.apache.org%3E\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://lists.apache.org/thread.html/raa117ef183f0da9b3f46efbeaa66f7622bd68868a450cae4fd8ed594%40%3Ccvs.httpd.apache.org%3E\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://lists.apache.org/thread.html/rd65d8ba68ba17e7deedafbf5bb4899f2ae4dad781d21b931c2941ac3%40%3Ccvs.httpd.apache.org%3E\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://lists.apache.org/thread.html/re895fc1736d25c8cf57e102c871613b8aeec9ea26fd8a44e7942b5ab%40%3Ccvs.httpd.apache.org%3E\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11458\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"ftp://patches.sgi.com/support/free/security/advisories/20040605-01-U.asc\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\"]}, {\"url\": \"http://lists.grok.org.uk/pipermail/full-disclosure/2004-May/021610.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://marc.info/?l=bugtraq&m=108567431823750&w=2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Issue Tracking\", \"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://marc.info/?l=bugtraq&m=108619129727620&w=2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Issue Tracking\", \"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://marc.info/?l=bugtraq&m=109181600614477&w=2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Issue Tracking\", \"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://marc.info/?l=bugtraq&m=109215056218824&w=2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Issue Tracking\", \"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2004-245.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://security.gentoo.org/glsa/glsa-200406-05.xml\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.debian.org/security/2004/dsa-532\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.mandriva.com/security/advisories?name=MDKSA-2004:054\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\"]}, {\"url\": \"http://www.mandriva.com/security/advisories?name=MDKSA-2004:055\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\"]}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2004-342.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2004-405.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.redhat.com/support/errata/RHSA-2005-816.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/10355\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\", \"VDB Entry\", \"Vendor Advisory\"]}, {\"url\": \"http://www.trustix.net/errata/2004/0031/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\"]}, {\"url\": \"https://bugzilla.fedora.us/show_bug.cgi?id=1888\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\", \"Issue Tracking\"]}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/16214\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/r5001ecf3d6b2bdd0b732e527654248abb264f08390045d30709a92f6%40%3Ccvs.httpd.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/raa117ef183f0da9b3f46efbeaa66f7622bd68868a450cae4fd8ed594%40%3Ccvs.httpd.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/rd65d8ba68ba17e7deedafbf5bb4899f2ae4dad781d21b931c2941ac3%40%3Ccvs.httpd.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/re895fc1736d25c8cf57e102c871613b8aeec9ea26fd8a44e7942b5ab%40%3Ccvs.httpd.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11458\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]", sourceIdentifier: "cve@mitre.org", vendorComments: "[{\"organization\": \"Apache\", \"comment\": \"Fixed in Apache HTTP Server 2.0.50:\\nhttp://httpd.apache.org/security/vulnerabilities_20.html\", \"lastModified\": \"2008-07-02T00:00:00\"}]", vulnStatus: "Modified", weaknesses: "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-787\"}]}]", }, nvd: "{\"cve\":{\"id\":\"CVE-2004-0488\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2004-07-07T04:00:00.000\",\"lastModified\":\"2025-04-03T01:03:51.193\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.\"},{\"lang\":\"es\",\"value\":\"Desbordamiento de búfer basado en la pila en la función ssl_util_uuencode_binary en ssl_util.c de mod_ssl de Apache cuando se configura mod_ssl para que confie en la Autoridad Certificadora emisora, puede permitir a atacantes remotos ejecutar código arbitrario mediante un certificado de cliente con un DN de asunto grande.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":7.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":true,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.0.35\",\"versionEndExcluding\":\"2.0.50\",\"matchCriteriaId\":\"B71C49F3-0F7C-4B25-AB0D-BBB2A0C5144F\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2CAE037F-111C-4A76-8FFE-716B74D65EF3\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_server:2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0F9EF63F-DDA3-448B-92D7-27ED92C51FED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux_workstation:2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"53A61204-33CE-422F-8285-20A5E98ADF3F\"}]}]}],\"references\":[{\"url\":\"ftp://patches.sgi.com/support/free/security/advisories/20040605-01-U.asc\",\"source\":\"cve@mitre.org\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://lists.grok.org.uk/pipermail/full-disclosure/2004-May/021610.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://marc.info/?l=bugtraq&m=108567431823750&w=2\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://marc.info/?l=bugtraq&m=108619129727620&w=2\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://marc.info/?l=bugtraq&m=109181600614477&w=2\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://marc.info/?l=bugtraq&m=109215056218824&w=2\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2004-245.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://security.gentoo.org/glsa/glsa-200406-05.xml\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.debian.org/security/2004/dsa-532\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDKSA-2004:054\",\"source\":\"cve@mitre.org\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDKSA-2004:055\",\"source\":\"cve@mitre.org\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2004-342.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2004-405.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2005-816.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/10355\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\",\"VDB Entry\",\"Vendor Advisory\"]},{\"url\":\"http://www.trustix.net/errata/2004/0031/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Broken Link\"]},{\"url\":\"https://bugzilla.fedora.us/show_bug.cgi?id=1888\",\"source\":\"cve@mitre.org\",\"tags\":[\"Broken Link\",\"Issue Tracking\"]},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/16214\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/r5001ecf3d6b2bdd0b732e527654248abb264f08390045d30709a92f6%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/raa117ef183f0da9b3f46efbeaa66f7622bd68868a450cae4fd8ed594%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/rd65d8ba68ba17e7deedafbf5bb4899f2ae4dad781d21b931c2941ac3%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/re895fc1736d25c8cf57e102c871613b8aeec9ea26fd8a44e7942b5ab%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11458\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"ftp://patches.sgi.com/support/free/security/advisories/20040605-01-U.asc\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://lists.grok.org.uk/pipermail/full-disclosure/2004-May/021610.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://marc.info/?l=bugtraq&m=108567431823750&w=2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://marc.info/?l=bugtraq&m=108619129727620&w=2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://marc.info/?l=bugtraq&m=109181600614477&w=2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://marc.info/?l=bugtraq&m=109215056218824&w=2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Issue Tracking\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2004-245.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://security.gentoo.org/glsa/glsa-200406-05.xml\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.debian.org/security/2004/dsa-532\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDKSA-2004:054\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDKSA-2004:055\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2004-342.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2004-405.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2005-816.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/10355\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\",\"VDB Entry\",\"Vendor Advisory\"]},{\"url\":\"http://www.trustix.net/errata/2004/0031/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"https://bugzilla.fedora.us/show_bug.cgi?id=1888\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\",\"Issue Tracking\"]},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/16214\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r5001ecf3d6b2bdd0b732e527654248abb264f08390045d30709a92f6%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/raa117ef183f0da9b3f46efbeaa66f7622bd68868a450cae4fd8ed594%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rd65d8ba68ba17e7deedafbf5bb4899f2ae4dad781d21b931c2941ac3%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/re895fc1736d25c8cf57e102c871613b8aeec9ea26fd8a44e7942b5ab%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11458\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}],\"vendorComments\":[{\"organization\":\"Apache\",\"comment\":\"Fixed in Apache HTTP Server 2.0.50:\\nhttp://httpd.apache.org/security/vulnerabilities_20.html\",\"lastModified\":\"2008-07-02T00:00:00\"}]}}", }, }
var-200407-0075
Vulnerability from variot
Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN. mod_ssl Is httpd.conf In SSLOptions Is a directive option FakeBasicAuth If enabled, a buffer overflow vulnerability exists.SSL Is enabled Apache HTTP Server Service disruption at (DoS) It may be in a state. Oracle Database Server, Oracle Application Server, Oracle Collaboration Suite, Oracle E-Business and Applications, Oracle Enterprise Manager Grid Control, and Oracle PeopleSoft Applications are reported prone to multiple vulnerabilities. Oracle has released a Critical Patch Update to address these issues in various supported applications and platforms. Other non-supported versions may be affected, but Symantec has not confirmed this. The issues identified by the vendor affect all security properties of the Oracle products and present local and remote threats. While various levels of authorization are required to leverage some issues, others do not require any authorization. This BID will be divided and updated into separate BIDs when more information is available. A stack-based buffer overflow has been reported in the Apache 'mod_ssl' module. This issue is exposed in utility code for uuencoding binary data. This issue would most likely result in a denial of service if triggered, but could theoretically allow arbitrary code to run. The issue is not believed to be exploitable to execute arbitrary code on x86 architectures, but this may not be the case with other architectures. Mod_SSL is the SSL implementation on the Apache server, used to provide encryption support for the Apache web server. A remote attacker can use the ssl_engine_kernel.c module that uses this function to conduct a denial of service attack or execute arbitrary instructions in the WEB process
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", affected_products: { "@id": "https://www.variotdbs.pl/ref/affected_products", }, configurations: { "@id": "https://www.variotdbs.pl/ref/configurations", }, credits: { "@id": "https://www.variotdbs.pl/ref/credits", }, cvss: { "@id": "https://www.variotdbs.pl/ref/cvss/", }, description: { "@id": "https://www.variotdbs.pl/ref/description/", }, exploit_availability: { "@id": "https://www.variotdbs.pl/ref/exploit_availability/", }, external_ids: { "@id": "https://www.variotdbs.pl/ref/external_ids/", }, iot: { "@id": "https://www.variotdbs.pl/ref/iot/", }, iot_taxonomy: { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/", }, patch: { "@id": "https://www.variotdbs.pl/ref/patch/", }, problemtype_data: { "@id": "https://www.variotdbs.pl/ref/problemtype_data/", }, references: { "@id": "https://www.variotdbs.pl/ref/references/", }, sources: { "@id": "https://www.variotdbs.pl/ref/sources/", }, sources_release_date: { "@id": "https://www.variotdbs.pl/ref/sources_release_date/", }, sources_update_date: { "@id": "https://www.variotdbs.pl/ref/sources_update_date/", }, threat_type: { "@id": "https://www.variotdbs.pl/ref/threat_type/", }, title: { "@id": "https://www.variotdbs.pl/ref/title/", }, type: { "@id": "https://www.variotdbs.pl/ref/type/", }, }, "@id": "https://www.variotdbs.pl/vuln/VAR-200407-0075", affected_products: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, "@id": "https://www.variotdbs.pl/ref/sources", }, }, data: [ { model: "linux", scope: "eq", trust: 1.3, vendor: "debian", version: "3.0", }, { model: "enterprise linux server", scope: "eq", trust: 1, vendor: "redhat", version: "2.0", }, { model: "http server", scope: "gte", trust: 1, vendor: "apache", version: "2.0.35", }, { model: "enterprise linux workstation", scope: "eq", trust: 1, vendor: "redhat", version: "2.0", }, { model: "http server", scope: "lt", trust: 1, vendor: "apache", version: "2.0.50", }, { model: "secure linux", scope: "eq", trust: 0.9, vendor: "trustix", version: "2.1", }, { model: "secure linux", scope: "eq", trust: 0.9, vendor: "trustix", version: "1.5", }, { model: "secure linux", scope: "eq", trust: 0.9, vendor: "trustix", version: "2.0", }, { model: "http server", scope: "lte", trust: 0.8, vendor: "apache", version: "2.0.49", }, { model: "mod ssl", scope: "lte", trust: 0.8, vendor: "modssl", version: "2.8.17", }, { model: "asianux server", scope: "eq", trust: 0.8, vendor: "cybertrust", version: "1.1", }, { model: "asianux server", scope: "eq", trust: 0.8, vendor: "cybertrust", version: "2.0", }, { model: "asianux server", scope: "eq", trust: 0.8, vendor: "cybertrust", version: "2.1", }, { model: "asianux server", scope: "eq", trust: 0.8, vendor: "cybertrust", version: "3.0", }, { model: "cobalt raq550", scope: null, trust: 0.8, vendor: "sun microsystems", version: null, }, { model: "turbolinux server", scope: "eq", trust: 0.8, vendor: "turbo linux", version: "6.5", }, { model: "turbolinux server", scope: "eq", trust: 0.8, vendor: "turbo linux", version: "7", }, { model: "turbolinux server", scope: "eq", trust: 0.8, vendor: "turbo linux", version: "8", }, { model: "hp-ux", scope: "eq", trust: 0.8, vendor: "hewlett packard", version: "11.00", }, { model: "hp-ux", scope: "eq", trust: 0.8, vendor: "hewlett packard", version: "11.04", }, { model: "hp-ux", scope: "eq", trust: 0.8, vendor: "hewlett packard", version: "11.11", }, { model: "hp-ux", scope: "eq", trust: 0.8, vendor: "hewlett packard", version: "11.22", }, { model: "hp-ux", scope: "eq", trust: 0.8, vendor: "hewlett packard", version: "11.23", }, { model: "enterprise linux", scope: "eq", trust: 0.8, vendor: "red hat", version: "2.1 (as)", }, { model: "enterprise linux", scope: "eq", trust: 0.8, vendor: "red hat", version: "2.1 (es)", }, { model: "enterprise linux", scope: "eq", trust: 0.8, vendor: "red hat", version: "2.1 (ws)", }, { model: "enterprise linux", scope: "eq", trust: 0.8, vendor: "red hat", version: "3 (as)", }, { model: "enterprise linux", scope: "eq", trust: 0.8, vendor: "red hat", version: "3 (es)", }, { model: "enterprise linux", scope: "eq", trust: 0.8, vendor: "red hat", version: "3 (ws)", }, { model: "oneworld xe/erp8 applications sp22", scope: null, trust: 0.3, vendor: "peoplesoft", version: null, }, { model: "enterpriseone applications", scope: "eq", trust: 0.3, vendor: "peoplesoft", version: "8.93", }, { model: "enterpriseone applications sp2", scope: "eq", trust: 0.3, vendor: "peoplesoft", version: "8.9", }, { model: "oracle9i standard edition", scope: "eq", trust: 0.3, vendor: "oracle", version: "9.2.6", }, { model: "oracle9i standard edition", scope: "eq", trust: 0.3, vendor: "oracle", version: "9.2.0.5", }, { model: "oracle9i standard edition", scope: "eq", trust: 0.3, vendor: "oracle", version: "9.0.4", }, { model: "oracle9i standard edition", scope: "eq", trust: 0.3, vendor: "oracle", version: "9.0.1.5", }, { model: "oracle9i standard edition", scope: "eq", trust: 0.3, vendor: "oracle", version: "9.0.1.4", }, { model: "oracle9i personal edition", scope: "eq", trust: 0.3, vendor: "oracle", version: "9.2.6", }, { model: "oracle9i personal edition", scope: "eq", trust: 0.3, vendor: "oracle", version: "9.2.0.5", }, { model: "oracle9i personal edition", scope: "eq", trust: 0.3, vendor: "oracle", version: "9.0.4", }, { model: "oracle9i personal edition", scope: "eq", trust: 0.3, vendor: "oracle", version: "9.0.1.5", }, { model: "oracle9i personal edition", scope: "eq", trust: 0.3, vendor: "oracle", version: "9.0.1.4", }, { model: "oracle9i enterprise edition", scope: "eq", trust: 0.3, vendor: "oracle", version: "9.2.6.0", }, { model: "oracle9i enterprise edition", scope: "eq", trust: 0.3, vendor: "oracle", version: "9.2.0.5", }, { model: "oracle9i enterprise edition", scope: "eq", trust: 0.3, vendor: "oracle", version: "9.0.4", }, { model: "oracle9i enterprise edition", scope: "eq", trust: 0.3, vendor: "oracle", version: "9.0.1.5", }, { model: "oracle9i enterprise edition", scope: "eq", trust: 0.3, vendor: "oracle", version: "9.0.1.4", }, { model: "oracle9i application server", scope: "eq", trust: 0.3, vendor: "oracle", version: "9.0.3.1", }, { model: "oracle9i application server", scope: "eq", trust: 0.3, vendor: "oracle", version: "9.0.2.3", }, { model: "oracle9i application server", scope: "eq", trust: 0.3, vendor: "oracle", version: "1.0.2.2", }, { model: "oracle8i standard edition", scope: "eq", trust: 0.3, vendor: "oracle", version: "8.1.7.4", }, { model: "oracle8i enterprise edition", scope: "eq", trust: 0.3, vendor: "oracle", version: "8.1.7.4.0", }, { model: "oracle10g standard edition", scope: "eq", trust: 0.3, vendor: "oracle", version: "10.1.0.4", }, { model: "oracle10g standard edition", scope: "eq", trust: 0.3, vendor: "oracle", version: "10.1.0.3.1", }, { model: "oracle10g standard edition", scope: "eq", trust: 0.3, vendor: "oracle", version: "10.1.0.3", }, { model: "oracle10g standard edition", scope: "eq", trust: 0.3, vendor: "oracle", version: "10.1.0.2", }, { model: "oracle10g personal edition", scope: "eq", trust: 0.3, vendor: "oracle", version: "10.1.0.4", }, { model: "oracle10g personal edition", scope: "eq", trust: 0.3, vendor: "oracle", version: "10.1.0.3.1", }, { model: "oracle10g personal edition", scope: "eq", trust: 0.3, vendor: "oracle", version: "10.1.0.3", }, { model: "oracle10g personal edition", scope: "eq", trust: 0.3, vendor: "oracle", version: "10.1.0.2", }, { model: "oracle10g enterprise edition", scope: "eq", trust: 0.3, vendor: "oracle", version: "10.1.0.4", }, { model: "oracle10g enterprise edition", scope: "eq", trust: 0.3, vendor: "oracle", version: "10.1.0.3.1", }, { model: "oracle10g enterprise edition", scope: "eq", trust: 0.3, vendor: "oracle", version: "10.1.0.3", }, { model: "oracle10g enterprise edition", scope: "eq", trust: 0.3, vendor: "oracle", version: "10.1.0.2", }, { model: "oracle10g application server", scope: "eq", trust: 0.3, vendor: "oracle", version: "10.1.2", }, { model: "oracle10g application server", scope: "eq", trust: 0.3, vendor: "oracle", version: "10.1.0.3.1", }, { model: "oracle10g application server", scope: "eq", trust: 0.3, vendor: "oracle", version: "9.0.4.1", }, { model: "oracle10g application server", scope: "eq", trust: 0.3, vendor: "oracle", version: "9.0.4.0", }, { model: "enterprise manager grid control 10g", scope: "eq", trust: 0.3, vendor: "oracle", version: "10.1.3", }, { model: "enterprise manager grid control 10g", scope: "eq", trust: 0.3, vendor: "oracle", version: "10.1.0.2", }, { model: "enterprise manager", scope: "eq", trust: 0.3, vendor: "oracle", version: "9.0.4.1", }, { model: "enterprise manager", scope: "eq", trust: 0.3, vendor: "oracle", version: "9.0.4.0", }, { model: "e-business suite 11i", scope: "eq", trust: 0.3, vendor: "oracle", version: "11.5.10", }, { model: "e-business suite 11i", scope: "eq", trust: 0.3, vendor: "oracle", version: "11.5.9", }, { model: "e-business suite 11i", scope: "eq", trust: 0.3, vendor: "oracle", version: "11.5.8", }, { model: "e-business suite 11i", scope: "eq", trust: 0.3, vendor: "oracle", version: "11.5.7", }, { model: "e-business suite 11i", scope: "eq", trust: 0.3, vendor: "oracle", version: "11.5.6", }, { model: "e-business suite 11i", scope: "eq", trust: 0.3, vendor: "oracle", version: "11.5.5", }, { model: "e-business suite 11i", scope: "eq", trust: 0.3, vendor: "oracle", version: "11.5.4", }, { model: "e-business suite 11i", scope: "eq", trust: 0.3, vendor: "oracle", version: "11.5.3", }, { model: "e-business suite 11i", scope: "eq", trust: 0.3, vendor: "oracle", version: "11.5.2", }, { model: "e-business suite 11i", scope: "eq", trust: 0.3, vendor: "oracle", version: "11.5.1", }, { model: "e-business suite 11i", scope: "eq", trust: 0.3, vendor: "oracle", version: "11.5", }, { model: "e-business suite", scope: "eq", trust: 0.3, vendor: "oracle", version: "11.0", }, { model: "collaboration suite release", scope: "eq", trust: 0.3, vendor: "oracle", version: "29.0.4.2", }, { model: "collaboration suite release", scope: "eq", trust: 0.3, vendor: "oracle", version: "29.0.4.1", }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "2.0.49", }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "2.0.35", }, { model: "multi network firewall", scope: "eq", trust: 0.3, vendor: "mandrakesoft", version: "2.0", }, { model: "hp-ux b.11.23", scope: null, trust: 0.3, vendor: "hp", version: null, }, { model: "enterprise linux ws", scope: "eq", trust: 0.3, vendor: "redhat", version: "2.1", }, { model: "mod ssl", scope: "eq", trust: 0.3, vendor: "mod ssl", version: "2.8.12", }, { model: "mod ssl", scope: "eq", trust: 0.3, vendor: "mod ssl", version: "2.8.9", }, { model: "stronghold", scope: "eq", trust: 0.3, vendor: "redhat", version: "4.0", }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "2.0", }, { model: "-current", scope: null, trust: 0.3, vendor: "openbsd", version: null, }, { model: "hp-ux b.11.22", scope: null, trust: 0.3, vendor: "hp", version: null, }, { model: "openbsd", scope: "eq", trust: 0.3, vendor: "openbsd", version: "3.5", }, { model: "linux mandrake", scope: "eq", trust: 0.3, vendor: "mandriva", version: "9.1", }, { model: "linux m68k", scope: "eq", trust: 0.3, vendor: "debian", version: "3.0", }, { model: "linux mandrake amd64", scope: "eq", trust: 0.3, vendor: "mandriva", version: "9.2", }, { model: "mac os server", scope: "eq", trust: 0.3, vendor: "apple", version: "x10.3.4", }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "1.3.28", }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "2.0.39", }, { model: "linux ia-64", scope: "eq", trust: 0.3, vendor: "debian", version: "3.0", }, { model: "mod ssl", scope: "eq", trust: 0.3, vendor: "mod ssl", version: "2.8.7", }, { model: "linux mandrake amd64", scope: "eq", trust: 0.3, vendor: "mandriva", version: "10.0", }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "2.0.32", }, { model: "-dev", scope: "eq", trust: 0.3, vendor: "apache", version: "1.3.7", }, { model: "linux sparc", scope: "eq", trust: 0.3, vendor: "debian", version: "3.0", }, { model: "corporate server x86 64", scope: "eq", trust: 0.3, vendor: "mandrakesoft", version: "2.1", }, { model: "webproxy a.02.00", scope: null, trust: 0.3, vendor: "hp", version: null, }, { model: "linux hppa", scope: "eq", trust: 0.3, vendor: "debian", version: "3.0", }, { model: "advanced workstation for the itanium processor", scope: "eq", trust: 0.3, vendor: "redhat", version: "2.1", }, { model: "enterprise server", scope: "eq", trust: 0.3, vendor: "tinysofa", version: "1.0", }, { model: "compaq secure web server for openvms", scope: "eq", trust: 0.3, vendor: "hp", version: "1.2", }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "1.3.22", }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "1.3.9", }, { model: "virtualvault a.04.70", scope: null, trust: 0.3, vendor: "hp", version: null, }, { model: "enterprise linux ws ia64", scope: "eq", trust: 0.3, vendor: "redhat", version: "2.1", }, { model: "linux", scope: "eq", trust: 0.3, vendor: "redhat", version: "7.3", }, { model: "mac os", scope: "eq", trust: 0.3, vendor: "apple", version: "x10.2.8", }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "2.0.43", }, { model: "openvms secure web server", scope: "eq", trust: 0.3, vendor: "hp", version: "7.3", }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "2.0.47", }, { model: "linux mandrake ppc", scope: "eq", trust: 0.3, vendor: "mandriva", version: "9.1", }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "1.3.20", }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "1.3.26", }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "1.3.25", }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "2.0.37", }, { model: "mac os server", scope: "eq", trust: 0.3, vendor: "apple", version: "x10.3.5", }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "1.3.14", }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "1.3.11", }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "1.3.4", }, { model: "network proxy (for rhel", scope: "eq", trust: 0.3, vendor: "redhat", version: "4)4.2", }, { model: "enterprise linux es", scope: "eq", trust: 0.3, vendor: "redhat", version: "2.1", }, { model: "openvms secure web server", scope: "eq", trust: 0.3, vendor: "hp", version: "7.3-1", }, { model: "linux", scope: "eq", trust: 0.3, vendor: "gentoo", version: "1.4", }, { model: "linux mandrake", scope: "eq", trust: 0.3, vendor: "mandriva", version: "9.2", }, { model: "home", scope: null, trust: 0.3, vendor: "turbolinux", version: null, }, { model: "linux i686", scope: "eq", trust: 0.3, vendor: "redhat", version: "7.3", }, { model: "linux alpha", scope: "eq", trust: 0.3, vendor: "debian", version: "3.0", }, { model: "advanced workstation for the itanium processor ia64", scope: "eq", trust: 0.3, vendor: "redhat", version: "2.1", }, { model: "openvms secure web server", scope: "eq", trust: 0.3, vendor: "hp", version: "7.3-2", }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "2.0.48", }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "2.0.45", }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "1.3.12", }, { model: "linux i386", scope: "eq", trust: 0.3, vendor: "redhat", version: "7.3", }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "1.3.1", }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "2.0.38", }, { model: "mod ssl", scope: "eq", trust: 0.3, vendor: "mod ssl", version: "2.8.10", }, { model: "openvms secure web server", scope: "eq", trust: 0.3, vendor: "hp", version: "7.2-2", }, { model: "secure enterprise linux", scope: "eq", trust: 0.3, vendor: "trustix", version: "2.0", }, { model: "virtualvault a.04.50", scope: null, trust: 0.3, vendor: "hp", version: null, }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "2.0.46", }, { model: "compaq secure web server for openvms", scope: "eq", trust: 0.3, vendor: "hp", version: "1.3", }, { model: "desktop", scope: "eq", trust: 0.3, vendor: "turbolinux", version: "10.0", }, { model: "server", scope: "eq", trust: 0.3, vendor: "turbolinux", version: "10.0", }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "2.0.44", }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "1.3.24", }, { model: "beta", scope: "eq", trust: 0.3, vendor: "apache", version: "2.0.28", }, { model: "enterprise linux as ia64", scope: "eq", trust: 0.3, vendor: "redhat", version: "2.1", }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "2.0.40", }, { model: "openbsd", scope: "eq", trust: 0.3, vendor: "openbsd", version: "3.4", }, { model: "mod ssl", scope: "eq", trust: 0.3, vendor: "mod ssl", version: "2.8.16", }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "1.3.23", }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "1.3", }, { model: "webproxy a.02.10", scope: null, trust: 0.3, vendor: "hp", version: null, }, { model: "compaq secure web server for openvms", scope: "eq", trust: 0.3, vendor: "hp", version: "2.0", }, { model: "virtualvault a.04.60", scope: null, trust: 0.3, vendor: "hp", version: null, }, { model: "hp-ux b.11.11", scope: null, trust: 0.3, vendor: "hp", version: null, }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "1.3.19", }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "1.3.18", }, { model: "compaq secure web server for openvms php", scope: "eq", trust: 0.3, vendor: "hp", version: "2.0", }, { model: "enterprise server -u1", scope: "eq", trust: 0.3, vendor: "tinysofa", version: "1.0", }, { model: "a9", scope: "eq", trust: 0.3, vendor: "apache", version: "2.0", }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "1.3.27", }, { model: "hp-ux b.11.00", scope: null, trust: 0.3, vendor: "hp", version: null, }, { model: "linux ia-32", scope: "eq", trust: 0.3, vendor: "debian", version: "3.0", }, { model: "linux mipsel", scope: "eq", trust: 0.3, vendor: "debian", version: "3.0", }, { model: "linux mips", scope: "eq", trust: 0.3, vendor: "debian", version: "3.0", }, { model: "network proxy (for rhel", scope: "eq", trust: 0.3, vendor: "redhat", version: "3)4.2", }, { model: "mac os server", scope: "eq", trust: 0.3, vendor: "apple", version: "x10.2.8", }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "2.0.42", }, { model: "apache", scope: "ne", trust: 0.3, vendor: "apache", version: "2.0.50", }, { model: "corporate server", scope: "eq", trust: 0.3, vendor: "mandrakesoft", version: "2.1", }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "2.0.28", }, { model: "mac os", scope: "eq", trust: 0.3, vendor: "apple", version: "x10.3.5", }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "1.3.3", }, { model: "linux arm", scope: "eq", trust: 0.3, vendor: "debian", version: "3.0", }, { model: "mac os", scope: "eq", trust: 0.3, vendor: "apple", version: "x10.3.4", }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "2.0.36", }, { model: "linux s/390", scope: "eq", trust: 0.3, vendor: "debian", version: "3.0", }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "2.0.41", }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "1.3.29", }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "1.3.6", }, { model: "linux ppc", scope: "eq", trust: 0.3, vendor: "debian", version: "3.0", }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "1.3.17", }, { model: "enterprise linux es ia64", scope: "eq", trust: 0.3, vendor: "redhat", version: "2.1", }, { model: "linux mandrake", scope: "eq", trust: 0.3, vendor: "mandriva", version: "10.0", }, { model: "enterprise linux as", scope: "eq", trust: 0.3, vendor: "redhat", version: "2.1", }, { model: "apache", scope: "eq", trust: 0.3, vendor: "apache", version: "1.3.31", }, { model: "mod ssl", scope: "eq", trust: 0.3, vendor: "mod ssl", version: "2.8.15", }, { model: "propack", scope: "eq", trust: 0.3, vendor: "sgi", version: "2.4", }, ], sources: [ { db: "BID", id: "13139", }, { db: "BID", id: "10355", }, { db: "JVNDB", id: "JVNDB-2004-000199", }, { db: "NVD", id: "CVE-2004-0488", }, { db: "CNNVD", id: "CNNVD-200407-016", }, ], }, configurations: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", children: { "@container": "@list", }, cpe_match: { "@container": "@list", }, data: { "@container": "@list", }, nodes: { "@container": "@list", }, }, data: [ { CVE_data_version: "4.0", nodes: [ { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*", cpe_name: [], versionEndExcluding: "2.0.50", versionStartIncluding: "2.0.35", vulnerable: true, }, ], operator: "OR", }, { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:o:debian:debian_linux:3.0:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, ], operator: "OR", }, { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:o:redhat:enterprise_linux_server:2.0:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:o:redhat:enterprise_linux_workstation:2.0:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, ], operator: "OR", }, ], }, ], sources: [ { db: "NVD", id: "CVE-2004-0488", }, ], }, credits: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "Georgi Guninski※ guninski@guninski.com", sources: [ { db: "CNNVD", id: "CNNVD-200407-016", }, ], trust: 0.6, }, cve: "CVE-2004-0488", cvss: { "@context": { cvssV2: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#", }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2", }, cvssV3: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#", }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/", }, severity: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#", }, "@id": "https://www.variotdbs.pl/ref/cvss/severity", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, "@id": "https://www.variotdbs.pl/ref/sources", }, }, data: [ { cvssV2: [ { acInsufInfo: false, accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", author: "NVD", availabilityImpact: "PARTIAL", baseScore: 7.5, confidentialityImpact: "PARTIAL", exploitabilityScore: 10, impactScore: 6.4, integrityImpact: "PARTIAL", obtainAllPrivilege: false, obtainOtherPrivilege: true, obtainUserPrivilege: false, severity: "HIGH", trust: 1, userInteractionRequired: false, vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P", version: "2.0", }, { acInsufInfo: null, accessComplexity: "Low", accessVector: "Network", authentication: "None", author: "NVD", availabilityImpact: "Partial", baseScore: 7.5, confidentialityImpact: "Partial", exploitabilityScore: null, id: "CVE-2004-0488", impactScore: null, integrityImpact: "Partial", obtainAllPrivilege: null, obtainOtherPrivilege: null, obtainUserPrivilege: null, severity: "High", trust: 0.8, userInteractionRequired: null, vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P", version: "2.0", }, { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", author: "VULHUB", availabilityImpact: "PARTIAL", baseScore: 7.5, confidentialityImpact: "PARTIAL", exploitabilityScore: 10, id: "VHN-8918", impactScore: 6.4, integrityImpact: "PARTIAL", severity: "HIGH", trust: 0.1, vectorString: "AV:N/AC:L/AU:N/C:P/I:P/A:P", version: "2.0", }, ], cvssV3: [], severity: [ { author: "NVD", id: "CVE-2004-0488", trust: 1.8, value: "HIGH", }, { author: "CNNVD", id: "CNNVD-200407-016", trust: 0.6, value: "HIGH", }, { author: "VULHUB", id: "VHN-8918", trust: 0.1, value: "HIGH", }, ], }, ], sources: [ { db: "VULHUB", id: "VHN-8918", }, { db: "JVNDB", id: "JVNDB-2004-000199", }, { db: "NVD", id: "CVE-2004-0488", }, { db: "CNNVD", id: "CNNVD-200407-016", }, ], }, description: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN. mod_ssl Is httpd.conf In SSLOptions Is a directive option FakeBasicAuth If enabled, a buffer overflow vulnerability exists.SSL Is enabled Apache HTTP Server Service disruption at (DoS) It may be in a state. Oracle Database Server, Oracle Application Server, Oracle Collaboration Suite, Oracle E-Business and Applications, Oracle Enterprise Manager Grid Control, and Oracle PeopleSoft Applications are reported prone to multiple vulnerabilities. \nOracle has released a Critical Patch Update to address these issues in various supported applications and platforms. Other non-supported versions may be affected, but Symantec has not confirmed this. \nThe issues identified by the vendor affect all security properties of the Oracle products and present local and remote threats. While various levels of authorization are required to leverage some issues, others do not require any authorization. \nThis BID will be divided and updated into separate BIDs when more information is available. A stack-based buffer overflow has been reported in the Apache 'mod_ssl' module. \nThis issue is exposed in utility code for uuencoding binary data. \nThis issue would most likely result in a denial of service if triggered, but could theoretically allow arbitrary code to run. The issue is not believed to be exploitable to execute arbitrary code on x86 architectures, but this may not be the case with other architectures. Mod_SSL is the SSL implementation on the Apache server, used to provide encryption support for the Apache web server. A remote attacker can use the ssl_engine_kernel.c module that uses this function to conduct a denial of service attack or execute arbitrary instructions in the WEB process", sources: [ { db: "NVD", id: "CVE-2004-0488", }, { db: "JVNDB", id: "JVNDB-2004-000199", }, { db: "BID", id: "13139", }, { db: "BID", id: "10355", }, { db: "VULHUB", id: "VHN-8918", }, ], trust: 2.25, }, external_ids: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { db: "NVD", id: "CVE-2004-0488", trust: 3.1, }, { db: "BID", id: "10355", trust: 2.8, }, { db: "JVNDB", id: "JVNDB-2004-000199", trust: 0.8, }, { db: "CNNVD", id: "CNNVD-200407-016", trust: 0.7, }, { db: "BID", id: "13139", trust: 0.3, }, { db: "SEEBUG", id: "SSVID-87504", trust: 0.1, }, { db: "VULHUB", id: "VHN-8918", trust: 0.1, }, ], sources: [ { db: "VULHUB", id: "VHN-8918", }, { db: "BID", id: "13139", }, { db: "BID", id: "10355", }, { db: "JVNDB", id: "JVNDB-2004-000199", }, { db: "NVD", id: "CVE-2004-0488", }, { db: "CNNVD", id: "CNNVD-200407-016", }, ], }, id: "VAR-200407-0075", iot: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: true, sources: [ { db: "VULHUB", id: "VHN-8918", }, ], trust: 0.01, }, last_update_date: "2023-12-18T10:49:55.307000Z", patch: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { title: "2.0 CHANGES", trust: 0.8, url: "http://www.apache.org/dist/httpd/changes_2.0", }, { title: "HPSBUX01068", trust: 0.8, url: "http://www1.itrc.hp.com/service/cki/docdisplay.do?docid=hpsbux01068", }, { title: "HPSBUX01064", trust: 0.8, url: "http://www1.itrc.hp.com/service/cki/docdisplay.do?docid=hpsbux01064", }, { title: "HPSBUX01068", trust: 0.8, url: "http://h50221.www5.hp.com/upassist/itrc_japan/assist2/secbltn/hp-ux/hpsbux01068.html", }, { title: "HPSBUX01064", trust: 0.8, url: "http://h50221.www5.hp.com/upassist/itrc_japan/assist2/secbltn/hp-ux/hpsbux01064.html", }, { title: "mod_ssl", trust: 0.8, url: "http://www.miraclelinux.com/support/update/data/mod_ssl.html", }, { title: "httpd", trust: 0.8, url: "http://www.miraclelinux.com/support/update/data/httpd.html", }, { title: "Top Page", trust: 0.8, url: "http://www.modssl.org/", }, { title: "RHSA-2004:245", trust: 0.8, url: "https://rhn.redhat.com/errata/rhsa-2004-245.html", }, { title: "RHSA-2004:342", trust: 0.8, url: "https://rhn.redhat.com/errata/rhsa-2004-342.html", }, { title: "550 Apache and Openssl Security Update 0.0.1", trust: 0.8, url: "http://sunsolve.sun.com/pub-cgi/show.pl?target=cobalt/raq550.eng", }, { title: "TLSA-2006-32", trust: 0.8, url: "http://www.turbolinux.com/security/2006/tlsa-2006-32.txt", }, { title: "RHSA-2004:245", trust: 0.8, url: "http://www.jp.redhat.com/support/errata/rhsa/rhsa-2004-245j.html", }, { title: "RHSA-2004:342", trust: 0.8, url: "http://www.jp.redhat.com/support/errata/rhsa/rhsa-2004-342j.html", }, { title: "TLSA-2006-32", trust: 0.8, url: "http://www.turbolinux.co.jp/security/2006/tlsa-2006-32j.txt", }, ], sources: [ { db: "JVNDB", id: "JVNDB-2004-000199", }, ], }, problemtype_data: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { problemtype: "CWE-787", trust: 1, }, ], sources: [ { db: "NVD", id: "CVE-2004-0488", }, ], }, references: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { trust: 2.5, url: "http://www.securityfocus.com/bid/10355", }, { trust: 2, url: "http://rhn.redhat.com/errata/rhsa-2004-245.html", }, { trust: 1.7, url: "http://www.debian.org/security/2004/dsa-532", }, { trust: 1.7, url: "https://bugzilla.fedora.us/show_bug.cgi?id=1888", }, { trust: 1.7, url: "http://lists.grok.org.uk/pipermail/full-disclosure/2004-may/021610.html", }, { trust: 1.7, url: "http://security.gentoo.org/glsa/glsa-200406-05.xml", }, { trust: 1.7, url: "http://www.mandriva.com/security/advisories?name=mdksa-2004:054", }, { trust: 1.7, url: "http://www.mandriva.com/security/advisories?name=mdksa-2004:055", }, { trust: 1.7, url: "https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a11458", }, { trust: 1.7, url: "http://www.redhat.com/support/errata/rhsa-2004-342.html", }, { trust: 1.7, url: "http://www.redhat.com/support/errata/rhsa-2004-405.html", }, { trust: 1.7, url: "http://www.redhat.com/support/errata/rhsa-2005-816.html", }, { trust: 1.7, url: "http://www.trustix.net/errata/2004/0031/", }, { trust: 1.7, url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/16214", }, { trust: 1.6, url: "http://marc.info/?l=bugtraq&m=108567431823750&w=2", }, { trust: 1.6, url: "http://marc.info/?l=bugtraq&m=108619129727620&w=2", }, { trust: 1.6, url: "http://marc.info/?l=bugtraq&m=109181600614477&w=2", }, { trust: 1.6, url: "http://marc.info/?l=bugtraq&m=109215056218824&w=2", }, { trust: 1.1, url: "ftp://patches.sgi.com/support/free/security/advisories/20040605-01-u.asc", }, { trust: 1, url: "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3ccvs.httpd.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3ccvs.httpd.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3ccvs.httpd.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3ccvs.httpd.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/r5001ecf3d6b2bdd0b732e527654248abb264f08390045d30709a92f6%40%3ccvs.httpd.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3ccvs.httpd.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3ccvs.httpd.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3ccvs.httpd.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/raa117ef183f0da9b3f46efbeaa66f7622bd68868a450cae4fd8ed594%40%3ccvs.httpd.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/rd65d8ba68ba17e7deedafbf5bb4899f2ae4dad781d21b931c2941ac3%40%3ccvs.httpd.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/re895fc1736d25c8cf57e102c871613b8aeec9ea26fd8a44e7942b5ab%40%3ccvs.httpd.apache.org%3e", }, { trust: 1, url: "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3ccvs.httpd.apache.org%3e", }, { trust: 0.8, url: "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2004-0488", }, { trust: 0.8, url: "http://nvd.nist.gov/nvd.cfm?cvename=cve-2004-0488", }, { trust: 0.6, url: "httpd.apache.org%3e", }, { trust: 0.6, url: "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb@%3ccvs.", }, { trust: 0.6, url: "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79@%3ccvs.", }, { trust: 0.6, url: "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac@%3ccvs.", }, { trust: 0.6, url: "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b@%3ccvs.", }, { trust: 0.6, url: "https://lists.apache.org/thread.html/raa117ef183f0da9b3f46efbeaa66f7622bd68868a450cae4fd8ed594@%3ccvs.", }, { trust: 0.6, url: "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142@%3ccvs.", }, { trust: 0.6, url: "https://lists.apache.org/thread.html/re895fc1736d25c8cf57e102c871613b8aeec9ea26fd8a44e7942b5ab@%3ccvs.", }, { trust: 0.6, url: "https://lists.apache.org/thread.html/rd65d8ba68ba17e7deedafbf5bb4899f2ae4dad781d21b931c2941ac3@%3ccvs.", }, { trust: 0.6, url: "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3ccvs.", }, { trust: 0.6, url: "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc@%3ccvs.", }, { trust: 0.6, url: "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3ccvs.", }, { trust: 0.6, url: "https://lists.apache.org/thread.html/r5001ecf3d6b2bdd0b732e527654248abb264f08390045d30709a92f6@%3ccvs.", }, { trust: 0.3, url: "http://www.oracle.com/technology/deploy/security/pdf/cpuapr2005.pdf", }, { trust: 0.3, url: "http://www.oracle.com/index.html", }, { trust: 0.3, url: "http://www.peoplesoft.com:80/corp/en/support/security_index.jsp", }, { trust: 0.3, url: "/archive/1/395699", }, { trust: 0.3, url: "http://httpd.apache.org/", }, { trust: 0.3, url: "http://www.modssl.org", }, { trust: 0.3, url: "http://www.openbsd.org/errata.html", }, { trust: 0.3, url: "http://rhn.redhat.com/errata/rhsa-2004-342.html", }, { trust: 0.3, url: "http://rhn.redhat.com/errata/rhsa-2004-405.html", }, { trust: 0.3, url: "http://rhn.redhat.com/errata/rhsa-2005-816.html", }, { trust: 0.3, url: "http://www4.itrc.hp.com/service/cki/docdisplay.do?admit=-938907319+1097930936036+28353475&docid=hpsbov01083", }, { trust: 0.3, url: "http://www.tinysofa.org/support/errata/2004/008.html", }, { trust: 0.3, url: "http://support.avaya.com/japple/css/japple?temp.groupid=128450&temp.selectedfamily=128451&temp.selectedproduct=154235&temp.selectedbucket=126655&temp.feedbackstate=askforfeedback&temp.documentid=19466", }, { trust: 0.3, url: "http://rhn.redhat.com/errata/rhsa-2008-0523.html", }, { trust: 0.1, url: "http://marc.info/?l=bugtraq&m=108567431823750&w=2", }, { trust: 0.1, url: "http://marc.info/?l=bugtraq&m=108619129727620&w=2", }, { trust: 0.1, url: "http://marc.info/?l=bugtraq&m=109181600614477&w=2", }, { trust: 0.1, url: "http://marc.info/?l=bugtraq&m=109215056218824&w=2", }, { trust: 0.1, url: "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac@%3ccvs.httpd.apache.org%3e", }, { trust: 0.1, url: "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79@%3ccvs.httpd.apache.org%3e", }, { trust: 0.1, url: "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc@%3ccvs.httpd.apache.org%3e", }, { trust: 0.1, url: "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb@%3ccvs.httpd.apache.org%3e", }, { trust: 0.1, url: "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3ccvs.httpd.apache.org%3e", }, { trust: 0.1, url: "https://lists.apache.org/thread.html/re895fc1736d25c8cf57e102c871613b8aeec9ea26fd8a44e7942b5ab@%3ccvs.httpd.apache.org%3e", }, { trust: 0.1, url: "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b@%3ccvs.httpd.apache.org%3e", }, { trust: 0.1, url: "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142@%3ccvs.httpd.apache.org%3e", }, { trust: 0.1, url: "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3ccvs.httpd.apache.org%3e", }, { trust: 0.1, url: "https://lists.apache.org/thread.html/raa117ef183f0da9b3f46efbeaa66f7622bd68868a450cae4fd8ed594@%3ccvs.httpd.apache.org%3e", }, { trust: 0.1, url: "https://lists.apache.org/thread.html/rd65d8ba68ba17e7deedafbf5bb4899f2ae4dad781d21b931c2941ac3@%3ccvs.httpd.apache.org%3e", }, { trust: 0.1, url: "https://lists.apache.org/thread.html/r5001ecf3d6b2bdd0b732e527654248abb264f08390045d30709a92f6@%3ccvs.httpd.apache.org%3e", }, ], sources: [ { db: "VULHUB", id: "VHN-8918", }, { db: "BID", id: "13139", }, { db: "BID", id: "10355", }, { db: "JVNDB", id: "JVNDB-2004-000199", }, { db: "NVD", id: "CVE-2004-0488", }, { db: "CNNVD", id: "CNNVD-200407-016", }, ], }, sources: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", data: { "@container": "@list", }, }, data: [ { db: "VULHUB", id: "VHN-8918", }, { db: "BID", id: "13139", }, { db: "BID", id: "10355", }, { db: "JVNDB", id: "JVNDB-2004-000199", }, { db: "NVD", id: "CVE-2004-0488", }, { db: "CNNVD", id: "CNNVD-200407-016", }, ], }, sources_release_date: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", data: { "@container": "@list", }, }, data: [ { date: "2004-07-07T00:00:00", db: "VULHUB", id: "VHN-8918", }, { date: "2005-04-12T00:00:00", db: "BID", id: "13139", }, { date: "2004-05-17T00:00:00", db: "BID", id: "10355", }, { date: "2007-04-01T00:00:00", db: "JVNDB", id: "JVNDB-2004-000199", }, { date: "2004-07-07T04:00:00", db: "NVD", id: "CVE-2004-0488", }, { date: "2003-07-18T00:00:00", db: "CNNVD", id: "CNNVD-200407-016", }, ], }, sources_update_date: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", data: { "@container": "@list", }, }, data: [ { date: "2017-10-11T00:00:00", db: "VULHUB", id: "VHN-8918", }, { date: "2006-05-05T23:30:00", db: "BID", id: "13139", }, { date: "2008-07-01T00:40:00", db: "BID", id: "10355", }, { date: "2007-04-01T00:00:00", db: "JVNDB", id: "JVNDB-2004-000199", }, { date: "2023-11-07T01:56:42.070000", db: "NVD", id: "CVE-2004-0488", }, { date: "2022-09-26T00:00:00", db: "CNNVD", id: "CNNVD-200407-016", }, ], }, threat_type: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "network", sources: [ { db: "BID", id: "13139", }, { db: "BID", id: "10355", }, ], trust: 0.6, }, title: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "Apache HTTP Server of mod_ssl Vulnerable to buffer overflow", sources: [ { db: "JVNDB", id: "JVNDB-2004-000199", }, ], trust: 0.8, }, type: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "buffer error", sources: [ { db: "CNNVD", id: "CNNVD-200407-016", }, ], trust: 0.6, }, }
RHSA-2004:405
Vulnerability from csaf_redhat
Published
2004-07-23 09:26
Modified
2024-11-21 23:08
Summary
Red Hat Security Advisory: apache, mod_ssl, php security update for Stronghold
Notes
Topic
Updated versions of cross-platform Stronghold that fix security issues in
mod_ssl, PHP, and the Apache HTTP Server are now available.
Details
Stronghold 4 contains a number of open source technologies, including
PHP, mod_ssl and the Apache HTTP Server.
Stefan Esser discovered a flaw when the memory_limit configuration setting
was enabled in PHP 4 versions prior to 4.3.8. If a remote attacker could
force the PHP interpreter to allocate more memory than the memory_limit
setting before script execution begins, then the attacker may be able to
supply the contents of a PHP hash table remotely. This hash table could
then be used to execute arbitrary code as the 'apache' user. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2004-0594 to this issue.
It may be possible to exploit this issue if using a non-default PHP
configuration with the "register_defaults" setting is changed to "On". Red
Hat does not believe that this flaw is exploitable in the default
configuration of Stronghold 4.
Stefan Esser discovered a flaw in the strip_tags function in versions of
PHP prior to 4.3.8. The strip_tags function is commonly used by PHP scripts
to prevent cross-site scripting attacks by removing HTML tags from
user-supplied form data. By embedding NUL bytes into form data, HTML tags
can in some cases be passed intact through the strip_tags function, which
may allow a cross-site scripting attack. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CAN-2004-0595 to
this issue.
A stack buffer overflow was discovered in mod_ssl which can be triggered if
using the FakeBasicAuth option. If mod_ssl is sent a client certificate
with a subject DN field longer than 6000 characters, a stack overflow can
occur if FakeBasicAuth has been enabled. In order to exploit this issue,
the carefully crafted malicious certificate would have to be signed by a
Certificate Authority which mod_ssl is configured to trust. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2004-0488 to this issue.
A format string issue was discovered in mod_ssl which can be triggered if
mod_ssl is configured to allow a client to proxy to remote SSL sites.
If mod_ssl is forced to connect to a remote SSL server using a
carefully crafted hostname, an attacker may be able to crash an Apache
child process. This issue is not known to allow arbitrary execution of
code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2004-0700 to this issue.
A denial of service issue was discovered which affects versions of the
Apache HTTP Server prior to 1.3.30. On some platforms, when Apache is
configured with multiple listening sockets, a short-lived connection to
one socket may temporarily block new connections to other sockets. This
issue does not affect Stronghold if running on Linux, FreeBSD or HP-UX
platforms. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2004-0174 to this issue.
Users of Stronghold 4 cross-platform are advised to update to these errata
versions, which contain backported security fixes and are not vulnerable to
these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated versions of cross-platform Stronghold that fix security issues in\nmod_ssl, PHP, and the Apache HTTP Server are now available.", title: "Topic", }, { category: "general", text: "Stronghold 4 contains a number of open source technologies, including\nPHP, mod_ssl and the Apache HTTP Server.\n\nStefan Esser discovered a flaw when the memory_limit configuration setting\nwas enabled in PHP 4 versions prior to 4.3.8. If a remote attacker could\nforce the PHP interpreter to allocate more memory than the memory_limit\nsetting before script execution begins, then the attacker may be able to\nsupply the contents of a PHP hash table remotely. This hash table could\nthen be used to execute arbitrary code as the 'apache' user. The Common\nVulnerabilities and Exposures project (cve.mitre.org) has assigned the name\nCAN-2004-0594 to this issue.\n\nIt may be possible to exploit this issue if using a non-default PHP\nconfiguration with the \"register_defaults\" setting is changed to \"On\". Red\nHat does not believe that this flaw is exploitable in the default\nconfiguration of Stronghold 4.\n\nStefan Esser discovered a flaw in the strip_tags function in versions of\nPHP prior to 4.3.8. The strip_tags function is commonly used by PHP scripts\nto prevent cross-site scripting attacks by removing HTML tags from\nuser-supplied form data. By embedding NUL bytes into form data, HTML tags\ncan in some cases be passed intact through the strip_tags function, which\nmay allow a cross-site scripting attack. The Common Vulnerabilities and\nExposures project (cve.mitre.org) has assigned the name CAN-2004-0595 to\nthis issue.\n\nA stack buffer overflow was discovered in mod_ssl which can be triggered if\nusing the FakeBasicAuth option. If mod_ssl is sent a client certificate\nwith a subject DN field longer than 6000 characters, a stack overflow can\noccur if FakeBasicAuth has been enabled. In order to exploit this issue,\nthe carefully crafted malicious certificate would have to be signed by a\nCertificate Authority which mod_ssl is configured to trust. The Common\nVulnerabilities and Exposures project (cve.mitre.org) has assigned the name\nCAN-2004-0488 to this issue.\n\nA format string issue was discovered in mod_ssl which can be triggered if \nmod_ssl is configured to allow a client to proxy to remote SSL sites. \nIf mod_ssl is forced to connect to a remote SSL server using a\ncarefully crafted hostname, an attacker may be able to crash an Apache\nchild process. This issue is not known to allow arbitrary execution of\ncode. The Common Vulnerabilities and Exposures project (cve.mitre.org) has\nassigned the name CAN-2004-0700 to this issue.\n\nA denial of service issue was discovered which affects versions of the\nApache HTTP Server prior to 1.3.30. On some platforms, when Apache is\nconfigured with multiple listening sockets, a short-lived connection to\none socket may temporarily block new connections to other sockets. This\nissue does not affect Stronghold if running on Linux, FreeBSD or HP-UX\nplatforms. The Common Vulnerabilities and Exposures project\n(cve.mitre.org) has assigned the name CAN-2004-0174 to this issue.\n\nUsers of Stronghold 4 cross-platform are advised to update to these errata\nversions, which contain backported security fixes and are not vulnerable to\nthese issues.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2004:405", url: "https://access.redhat.com/errata/RHSA-2004:405", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "127703", url: "https://bugzilla.redhat.com/show_bug.cgi?id=127703", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2004/rhsa-2004_405.json", }, ], title: "Red Hat Security Advisory: apache, mod_ssl, php security update for Stronghold", tracking: { current_release_date: "2024-11-21T23:08:43+00:00", generator: { date: "2024-11-21T23:08:43+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2004:405", initial_release_date: "2004-07-23T09:26:00+00:00", revision_history: [ { date: "2004-07-23T09:26:00+00:00", number: "1", summary: "Initial version", }, { date: "2004-07-23T00:00:00+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-21T23:08:43+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Stronghold 4", product: { name: "Red Hat Stronghold 4", product_id: "Red Hat Stronghold 4", product_identification_helper: { cpe: "cpe:/a:redhat:stronghold:4", }, }, }, ], category: "product_family", name: "Stronghold Cross Platform", }, ], category: "vendor", name: "Red Hat", }, ], }, vulnerabilities: [ { cve: "CVE-2004-0174", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1617165", }, ], notes: [ { category: "description", text: "Apache 1.4.x before 1.3.30, and 2.0.x before 2.0.49, when using multiple listening sockets on certain platforms, allows remote attackers to cause a denial of service (blocked new connections) via a \"short-lived connection on a rarely-accessed listening socket.\"", title: "Vulnerability description", }, { category: "summary", text: "security flaw", title: "Vulnerability summary", }, { category: "other", text: "Not vulnerable. This issue did not affect Linux.", title: "Statement", }, ], product_status: { fixed: [ "Red Hat Stronghold 4", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0174", }, { category: "external", summary: "RHBZ#1617165", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1617165", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0174", url: "https://www.cve.org/CVERecord?id=CVE-2004-0174", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0174", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0174", }, ], release_date: "2004-03-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2004-07-23T09:26:00+00:00", details: "Updated Stronghold 4 packages are now available via the update agent\nservice. Run the following command from the Stronghold 4 install root to\nupgrade an existing Stronghold 4 installation to the new package versions:\n\n$ bin/agent\n\nThe Stronghold 4.0i patch release which contains these updated packages is\nalso available from the download site.\n\nAfter upgrading Stronghold, the server must be completely restarted by\nrunning the following commands from the install root:\n\n$ bin/stop-server\n$ bin/start-server\n\nFor more information on how to upgrade between releases of Stronghold 4,\nrefer to http://stronghold.redhat.com/support/upgrade-sh4", product_ids: [ "Red Hat Stronghold 4", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2004:405", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "security flaw", }, { cve: "CVE-2004-0488", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430867", }, ], notes: [ { category: "description", text: "Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.", title: "Vulnerability description", }, { category: "summary", text: "mod_ssl ssl_util_uuencode_binary CA issue", title: "Vulnerability summary", }, ], product_status: { fixed: [ "Red Hat Stronghold 4", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0488", }, { category: "external", summary: "RHBZ#430867", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430867", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0488", url: "https://www.cve.org/CVERecord?id=CVE-2004-0488", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0488", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0488", }, ], release_date: "2004-05-17T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2004-07-23T09:26:00+00:00", details: "Updated Stronghold 4 packages are now available via the update agent\nservice. Run the following command from the Stronghold 4 install root to\nupgrade an existing Stronghold 4 installation to the new package versions:\n\n$ bin/agent\n\nThe Stronghold 4.0i patch release which contains these updated packages is\nalso available from the download site.\n\nAfter upgrading Stronghold, the server must be completely restarted by\nrunning the following commands from the install root:\n\n$ bin/stop-server\n$ bin/start-server\n\nFor more information on how to upgrade between releases of Stronghold 4,\nrefer to http://stronghold.redhat.com/support/upgrade-sh4", product_ids: [ "Red Hat Stronghold 4", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2004:405", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_ssl ssl_util_uuencode_binary CA issue", }, { cve: "CVE-2004-0594", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1617233", }, ], notes: [ { category: "description", text: "The memory_limit functionality in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, under certain conditions such as when register_globals is enabled, allows remote attackers to execute arbitrary code by triggering a memory_limit abort during execution of the zend_hash_init function and overwriting a HashTable destructor pointer before the initialization of key data structures is complete.", title: "Vulnerability description", }, { category: "summary", text: "security flaw", title: "Vulnerability summary", }, ], product_status: { fixed: [ "Red Hat Stronghold 4", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0594", }, { category: "external", summary: "RHBZ#1617233", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1617233", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0594", url: "https://www.cve.org/CVERecord?id=CVE-2004-0594", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0594", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0594", }, ], release_date: "2004-07-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2004-07-23T09:26:00+00:00", details: "Updated Stronghold 4 packages are now available via the update agent\nservice. Run the following command from the Stronghold 4 install root to\nupgrade an existing Stronghold 4 installation to the new package versions:\n\n$ bin/agent\n\nThe Stronghold 4.0i patch release which contains these updated packages is\nalso available from the download site.\n\nAfter upgrading Stronghold, the server must be completely restarted by\nrunning the following commands from the install root:\n\n$ bin/stop-server\n$ bin/start-server\n\nFor more information on how to upgrade between releases of Stronghold 4,\nrefer to http://stronghold.redhat.com/support/upgrade-sh4", product_ids: [ "Red Hat Stronghold 4", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2004:405", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "security flaw", }, { cve: "CVE-2004-0595", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1617234", }, ], notes: [ { category: "description", text: "The strip_tags function in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, does not filter null (\\0) characters within tag names when restricting input to allowed tags, which allows dangerous tags to be processed by web browsers such as Internet Explorer and Safari, which ignore null characters and facilitate the exploitation of cross-site scripting (XSS) vulnerabilities.", title: "Vulnerability description", }, { category: "summary", text: "security flaw", title: "Vulnerability summary", }, ], product_status: { fixed: [ "Red Hat Stronghold 4", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0595", }, { category: "external", summary: "RHBZ#1617234", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1617234", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0595", url: "https://www.cve.org/CVERecord?id=CVE-2004-0595", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0595", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0595", }, ], release_date: "2004-07-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2004-07-23T09:26:00+00:00", details: "Updated Stronghold 4 packages are now available via the update agent\nservice. Run the following command from the Stronghold 4 install root to\nupgrade an existing Stronghold 4 installation to the new package versions:\n\n$ bin/agent\n\nThe Stronghold 4.0i patch release which contains these updated packages is\nalso available from the download site.\n\nAfter upgrading Stronghold, the server must be completely restarted by\nrunning the following commands from the install root:\n\n$ bin/stop-server\n$ bin/start-server\n\nFor more information on how to upgrade between releases of Stronghold 4,\nrefer to http://stronghold.redhat.com/support/upgrade-sh4", product_ids: [ "Red Hat Stronghold 4", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2004:405", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "security flaw", }, { cve: "CVE-2004-0700", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430866", }, ], notes: [ { category: "description", text: "Format string vulnerability in the mod_proxy hook functions function in ssl_engine_log.c in mod_ssl before 2.8.19 for Apache before 1.3.31 may allow remote attackers to execute arbitrary messages via format string specifiers in certain log messages for HTTPS that are handled by the ssl_log function.", title: "Vulnerability description", }, { category: "summary", text: "mod_proxy hook format string", title: "Vulnerability summary", }, ], product_status: { fixed: [ "Red Hat Stronghold 4", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0700", }, { category: "external", summary: "RHBZ#430866", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430866", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0700", url: "https://www.cve.org/CVERecord?id=CVE-2004-0700", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0700", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0700", }, ], release_date: "2004-07-16T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2004-07-23T09:26:00+00:00", details: "Updated Stronghold 4 packages are now available via the update agent\nservice. Run the following command from the Stronghold 4 install root to\nupgrade an existing Stronghold 4 installation to the new package versions:\n\n$ bin/agent\n\nThe Stronghold 4.0i patch release which contains these updated packages is\nalso available from the download site.\n\nAfter upgrading Stronghold, the server must be completely restarted by\nrunning the following commands from the install root:\n\n$ bin/stop-server\n$ bin/start-server\n\nFor more information on how to upgrade between releases of Stronghold 4,\nrefer to http://stronghold.redhat.com/support/upgrade-sh4", product_ids: [ "Red Hat Stronghold 4", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2004:405", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "mod_proxy hook format string", }, ], }
RHSA-2004:245
Vulnerability from csaf_redhat
Published
2004-06-14 15:46
Modified
2024-11-21 23:05
Summary
Red Hat Security Advisory: apache, mod_ssl security update
Notes
Topic
Updated httpd and mod_ssl packages that fix minor security issues in
the Apache Web server are now available for Red Hat Enterprise Linux 2.1.
Details
The Apache HTTP Server is a powerful, full-featured, efficient, and
freely-available Web server.
A buffer overflow was found in the Apache proxy module, mod_proxy, which
can be triggered by receiving an invalid Content-Length header. In order
to exploit this issue, an attacker would need an Apache installation
that was configured as a proxy to connect to a malicious site. This would
cause the Apache child processing the request to crash. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2004-0492 to this issue.
On Red Hat Enterprise Linux platforms Red Hat believes this issue cannot
lead to remote code execution. This issue also does not represent a Denial
of Service attack as requests will continue to be handled by other Apache
child processes.
A stack buffer overflow was discovered in mod_ssl which can be triggered if
using the FakeBasicAuth option. If mod_ssl is sent a client certificate
with a subject DN field longer than 6000 characters, a stack overflow can
occur if FakeBasicAuth has been enabled. In order to exploit this issue
the carefully crafted malicious certificate would have to be signed by a
Certificate Authority which mod_ssl is configured to trust. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2004-0488 to this issue.
This update also fixes a DNS handling bug in mod_proxy.
The mod_auth_digest module is now included in the Apache package and should
be used instead of mod_digest for sites requiring Digest authentication.
Red Hat Enterprise Linux 2.1 users of the Apache HTTP Server should upgrade
to these erratum packages, which contains Apache version 1.3.27 with
backported patches correcting these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated httpd and mod_ssl packages that fix minor security issues in\nthe Apache Web server are now available for Red Hat Enterprise Linux 2.1.", title: "Topic", }, { category: "general", text: "The Apache HTTP Server is a powerful, full-featured, efficient, and\nfreely-available Web server.\n\nA buffer overflow was found in the Apache proxy module, mod_proxy, which\ncan be triggered by receiving an invalid Content-Length header. In order\nto exploit this issue, an attacker would need an Apache installation\nthat was configured as a proxy to connect to a malicious site. This would\ncause the Apache child processing the request to crash. The Common\nVulnerabilities and Exposures project (cve.mitre.org) has assigned the name\nCAN-2004-0492 to this issue.\n\nOn Red Hat Enterprise Linux platforms Red Hat believes this issue cannot\nlead to remote code execution. This issue also does not represent a Denial\nof Service attack as requests will continue to be handled by other Apache\nchild processes.\n\nA stack buffer overflow was discovered in mod_ssl which can be triggered if\nusing the FakeBasicAuth option. If mod_ssl is sent a client certificate\nwith a subject DN field longer than 6000 characters, a stack overflow can\noccur if FakeBasicAuth has been enabled. In order to exploit this issue\nthe carefully crafted malicious certificate would have to be signed by a\nCertificate Authority which mod_ssl is configured to trust. The Common\nVulnerabilities and Exposures project (cve.mitre.org) has assigned the name\nCAN-2004-0488 to this issue.\n\nThis update also fixes a DNS handling bug in mod_proxy.\n\nThe mod_auth_digest module is now included in the Apache package and should\nbe used instead of mod_digest for sites requiring Digest authentication.\n\nRed Hat Enterprise Linux 2.1 users of the Apache HTTP Server should upgrade\nto these erratum packages, which contains Apache version 1.3.27 with \nbackported patches correcting these issues.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2004:245", url: "https://access.redhat.com/errata/RHSA-2004:245", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "http://www.apacheweek.com/issues/04-06-11#security", url: "http://www.apacheweek.com/issues/04-06-11#security", }, { category: "external", summary: "122637", url: "https://bugzilla.redhat.com/show_bug.cgi?id=122637", }, { category: "external", summary: "125704", url: "https://bugzilla.redhat.com/show_bug.cgi?id=125704", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2004/rhsa-2004_245.json", }, ], title: "Red Hat Security Advisory: apache, mod_ssl security update", tracking: { current_release_date: "2024-11-21T23:05:23+00:00", generator: { date: "2024-11-21T23:05:23+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2004:245", initial_release_date: "2004-06-14T15:46:00+00:00", revision_history: [ { date: "2004-06-14T15:46:00+00:00", number: "1", summary: "Initial version", }, { date: "2004-06-14T00:00:00+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-21T23:05:23+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", product: { name: "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", product_id: "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:2.1::as", }, }, }, { category: "product_name", name: "Red Hat Linux Advanced Workstation 2.1", product: { name: "Red Hat Linux Advanced Workstation 2.1", product_id: "Red Hat Linux Advanced Workstation 2.1", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:2.1::aw", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux ES version 2.1", product: { name: "Red Hat Enterprise Linux ES version 2.1", product_id: "Red Hat Enterprise Linux ES version 2.1", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:2.1::es", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux WS version 2.1", product: { name: "Red Hat Enterprise Linux WS version 2.1", product_id: "Red Hat Enterprise Linux WS version 2.1", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:2.1::ws", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, ], category: "vendor", name: "Red Hat", }, ], }, vulnerabilities: [ { cve: "CVE-2004-0488", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430867", }, ], notes: [ { category: "description", text: "Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.", title: "Vulnerability description", }, { category: "summary", text: "mod_ssl ssl_util_uuencode_binary CA issue", title: "Vulnerability summary", }, ], product_status: { fixed: [ "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", "Red Hat Enterprise Linux ES version 2.1", "Red Hat Enterprise Linux WS version 2.1", "Red Hat Linux Advanced Workstation 2.1", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0488", }, { category: "external", summary: "RHBZ#430867", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430867", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0488", url: "https://www.cve.org/CVERecord?id=CVE-2004-0488", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0488", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0488", }, ], release_date: "2004-05-17T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2004-06-14T15:46:00+00:00", details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains\nthe desired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.\n\nIf up2date fails to connect to Red Hat Network due to SSL\nCertificate Errors, you need to install a version of the\nup2date client with an updated certificate. The latest version of\nup2date is available from the Red Hat FTP site and may also be\ndownloaded directly from the RHN website:\n\nhttps://rhn.redhat.com/help/latest-up2date.pxt", product_ids: [ "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", "Red Hat Enterprise Linux ES version 2.1", "Red Hat Enterprise Linux WS version 2.1", "Red Hat Linux Advanced Workstation 2.1", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2004:245", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_ssl ssl_util_uuencode_binary CA issue", }, { cve: "CVE-2004-0492", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430527", }, ], notes: [ { category: "description", text: "Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a negative Content-Length HTTP header field, which causes a large amount of data to be copied.", title: "Vulnerability description", }, { category: "summary", text: "httpd mod_proxy buffer overflow", title: "Vulnerability summary", }, ], product_status: { fixed: [ "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", "Red Hat Enterprise Linux ES version 2.1", "Red Hat Enterprise Linux WS version 2.1", "Red Hat Linux Advanced Workstation 2.1", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0492", }, { category: "external", summary: "RHBZ#430527", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430527", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0492", url: "https://www.cve.org/CVERecord?id=CVE-2004-0492", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0492", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0492", }, ], release_date: "2004-06-10T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2004-06-14T15:46:00+00:00", details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains\nthe desired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.\n\nIf up2date fails to connect to Red Hat Network due to SSL\nCertificate Errors, you need to install a version of the\nup2date client with an updated certificate. The latest version of\nup2date is available from the Red Hat FTP site and may also be\ndownloaded directly from the RHN website:\n\nhttps://rhn.redhat.com/help/latest-up2date.pxt", product_ids: [ "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", "Red Hat Enterprise Linux ES version 2.1", "Red Hat Enterprise Linux WS version 2.1", "Red Hat Linux Advanced Workstation 2.1", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2004:245", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "httpd mod_proxy buffer overflow", }, ], }
rhsa-2004:405
Vulnerability from csaf_redhat
Published
2004-07-23 09:26
Modified
2024-11-21 23:08
Summary
Red Hat Security Advisory: apache, mod_ssl, php security update for Stronghold
Notes
Topic
Updated versions of cross-platform Stronghold that fix security issues in
mod_ssl, PHP, and the Apache HTTP Server are now available.
Details
Stronghold 4 contains a number of open source technologies, including
PHP, mod_ssl and the Apache HTTP Server.
Stefan Esser discovered a flaw when the memory_limit configuration setting
was enabled in PHP 4 versions prior to 4.3.8. If a remote attacker could
force the PHP interpreter to allocate more memory than the memory_limit
setting before script execution begins, then the attacker may be able to
supply the contents of a PHP hash table remotely. This hash table could
then be used to execute arbitrary code as the 'apache' user. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2004-0594 to this issue.
It may be possible to exploit this issue if using a non-default PHP
configuration with the "register_defaults" setting is changed to "On". Red
Hat does not believe that this flaw is exploitable in the default
configuration of Stronghold 4.
Stefan Esser discovered a flaw in the strip_tags function in versions of
PHP prior to 4.3.8. The strip_tags function is commonly used by PHP scripts
to prevent cross-site scripting attacks by removing HTML tags from
user-supplied form data. By embedding NUL bytes into form data, HTML tags
can in some cases be passed intact through the strip_tags function, which
may allow a cross-site scripting attack. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CAN-2004-0595 to
this issue.
A stack buffer overflow was discovered in mod_ssl which can be triggered if
using the FakeBasicAuth option. If mod_ssl is sent a client certificate
with a subject DN field longer than 6000 characters, a stack overflow can
occur if FakeBasicAuth has been enabled. In order to exploit this issue,
the carefully crafted malicious certificate would have to be signed by a
Certificate Authority which mod_ssl is configured to trust. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2004-0488 to this issue.
A format string issue was discovered in mod_ssl which can be triggered if
mod_ssl is configured to allow a client to proxy to remote SSL sites.
If mod_ssl is forced to connect to a remote SSL server using a
carefully crafted hostname, an attacker may be able to crash an Apache
child process. This issue is not known to allow arbitrary execution of
code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2004-0700 to this issue.
A denial of service issue was discovered which affects versions of the
Apache HTTP Server prior to 1.3.30. On some platforms, when Apache is
configured with multiple listening sockets, a short-lived connection to
one socket may temporarily block new connections to other sockets. This
issue does not affect Stronghold if running on Linux, FreeBSD or HP-UX
platforms. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2004-0174 to this issue.
Users of Stronghold 4 cross-platform are advised to update to these errata
versions, which contain backported security fixes and are not vulnerable to
these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated versions of cross-platform Stronghold that fix security issues in\nmod_ssl, PHP, and the Apache HTTP Server are now available.", title: "Topic", }, { category: "general", text: "Stronghold 4 contains a number of open source technologies, including\nPHP, mod_ssl and the Apache HTTP Server.\n\nStefan Esser discovered a flaw when the memory_limit configuration setting\nwas enabled in PHP 4 versions prior to 4.3.8. If a remote attacker could\nforce the PHP interpreter to allocate more memory than the memory_limit\nsetting before script execution begins, then the attacker may be able to\nsupply the contents of a PHP hash table remotely. This hash table could\nthen be used to execute arbitrary code as the 'apache' user. The Common\nVulnerabilities and Exposures project (cve.mitre.org) has assigned the name\nCAN-2004-0594 to this issue.\n\nIt may be possible to exploit this issue if using a non-default PHP\nconfiguration with the \"register_defaults\" setting is changed to \"On\". Red\nHat does not believe that this flaw is exploitable in the default\nconfiguration of Stronghold 4.\n\nStefan Esser discovered a flaw in the strip_tags function in versions of\nPHP prior to 4.3.8. The strip_tags function is commonly used by PHP scripts\nto prevent cross-site scripting attacks by removing HTML tags from\nuser-supplied form data. By embedding NUL bytes into form data, HTML tags\ncan in some cases be passed intact through the strip_tags function, which\nmay allow a cross-site scripting attack. The Common Vulnerabilities and\nExposures project (cve.mitre.org) has assigned the name CAN-2004-0595 to\nthis issue.\n\nA stack buffer overflow was discovered in mod_ssl which can be triggered if\nusing the FakeBasicAuth option. If mod_ssl is sent a client certificate\nwith a subject DN field longer than 6000 characters, a stack overflow can\noccur if FakeBasicAuth has been enabled. In order to exploit this issue,\nthe carefully crafted malicious certificate would have to be signed by a\nCertificate Authority which mod_ssl is configured to trust. The Common\nVulnerabilities and Exposures project (cve.mitre.org) has assigned the name\nCAN-2004-0488 to this issue.\n\nA format string issue was discovered in mod_ssl which can be triggered if \nmod_ssl is configured to allow a client to proxy to remote SSL sites. \nIf mod_ssl is forced to connect to a remote SSL server using a\ncarefully crafted hostname, an attacker may be able to crash an Apache\nchild process. This issue is not known to allow arbitrary execution of\ncode. The Common Vulnerabilities and Exposures project (cve.mitre.org) has\nassigned the name CAN-2004-0700 to this issue.\n\nA denial of service issue was discovered which affects versions of the\nApache HTTP Server prior to 1.3.30. On some platforms, when Apache is\nconfigured with multiple listening sockets, a short-lived connection to\none socket may temporarily block new connections to other sockets. This\nissue does not affect Stronghold if running on Linux, FreeBSD or HP-UX\nplatforms. The Common Vulnerabilities and Exposures project\n(cve.mitre.org) has assigned the name CAN-2004-0174 to this issue.\n\nUsers of Stronghold 4 cross-platform are advised to update to these errata\nversions, which contain backported security fixes and are not vulnerable to\nthese issues.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2004:405", url: "https://access.redhat.com/errata/RHSA-2004:405", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "127703", url: "https://bugzilla.redhat.com/show_bug.cgi?id=127703", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2004/rhsa-2004_405.json", }, ], title: "Red Hat Security Advisory: apache, mod_ssl, php security update for Stronghold", tracking: { current_release_date: "2024-11-21T23:08:43+00:00", generator: { date: "2024-11-21T23:08:43+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2004:405", initial_release_date: "2004-07-23T09:26:00+00:00", revision_history: [ { date: "2004-07-23T09:26:00+00:00", number: "1", summary: "Initial version", }, { date: "2004-07-23T00:00:00+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-21T23:08:43+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Stronghold 4", product: { name: "Red Hat Stronghold 4", product_id: "Red Hat Stronghold 4", product_identification_helper: { cpe: "cpe:/a:redhat:stronghold:4", }, }, }, ], category: "product_family", name: "Stronghold Cross Platform", }, ], category: "vendor", name: "Red Hat", }, ], }, vulnerabilities: [ { cve: "CVE-2004-0174", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1617165", }, ], notes: [ { category: "description", text: "Apache 1.4.x before 1.3.30, and 2.0.x before 2.0.49, when using multiple listening sockets on certain platforms, allows remote attackers to cause a denial of service (blocked new connections) via a \"short-lived connection on a rarely-accessed listening socket.\"", title: "Vulnerability description", }, { category: "summary", text: "security flaw", title: "Vulnerability summary", }, { category: "other", text: "Not vulnerable. This issue did not affect Linux.", title: "Statement", }, ], product_status: { fixed: [ "Red Hat Stronghold 4", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0174", }, { category: "external", summary: "RHBZ#1617165", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1617165", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0174", url: "https://www.cve.org/CVERecord?id=CVE-2004-0174", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0174", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0174", }, ], release_date: "2004-03-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2004-07-23T09:26:00+00:00", details: "Updated Stronghold 4 packages are now available via the update agent\nservice. Run the following command from the Stronghold 4 install root to\nupgrade an existing Stronghold 4 installation to the new package versions:\n\n$ bin/agent\n\nThe Stronghold 4.0i patch release which contains these updated packages is\nalso available from the download site.\n\nAfter upgrading Stronghold, the server must be completely restarted by\nrunning the following commands from the install root:\n\n$ bin/stop-server\n$ bin/start-server\n\nFor more information on how to upgrade between releases of Stronghold 4,\nrefer to http://stronghold.redhat.com/support/upgrade-sh4", product_ids: [ "Red Hat Stronghold 4", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2004:405", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "security flaw", }, { cve: "CVE-2004-0488", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430867", }, ], notes: [ { category: "description", text: "Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.", title: "Vulnerability description", }, { category: "summary", text: "mod_ssl ssl_util_uuencode_binary CA issue", title: "Vulnerability summary", }, ], product_status: { fixed: [ "Red Hat Stronghold 4", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0488", }, { category: "external", summary: "RHBZ#430867", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430867", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0488", url: "https://www.cve.org/CVERecord?id=CVE-2004-0488", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0488", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0488", }, ], release_date: "2004-05-17T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2004-07-23T09:26:00+00:00", details: "Updated Stronghold 4 packages are now available via the update agent\nservice. Run the following command from the Stronghold 4 install root to\nupgrade an existing Stronghold 4 installation to the new package versions:\n\n$ bin/agent\n\nThe Stronghold 4.0i patch release which contains these updated packages is\nalso available from the download site.\n\nAfter upgrading Stronghold, the server must be completely restarted by\nrunning the following commands from the install root:\n\n$ bin/stop-server\n$ bin/start-server\n\nFor more information on how to upgrade between releases of Stronghold 4,\nrefer to http://stronghold.redhat.com/support/upgrade-sh4", product_ids: [ "Red Hat Stronghold 4", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2004:405", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_ssl ssl_util_uuencode_binary CA issue", }, { cve: "CVE-2004-0594", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1617233", }, ], notes: [ { category: "description", text: "The memory_limit functionality in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, under certain conditions such as when register_globals is enabled, allows remote attackers to execute arbitrary code by triggering a memory_limit abort during execution of the zend_hash_init function and overwriting a HashTable destructor pointer before the initialization of key data structures is complete.", title: "Vulnerability description", }, { category: "summary", text: "security flaw", title: "Vulnerability summary", }, ], product_status: { fixed: [ "Red Hat Stronghold 4", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0594", }, { category: "external", summary: "RHBZ#1617233", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1617233", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0594", url: "https://www.cve.org/CVERecord?id=CVE-2004-0594", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0594", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0594", }, ], release_date: "2004-07-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2004-07-23T09:26:00+00:00", details: "Updated Stronghold 4 packages are now available via the update agent\nservice. Run the following command from the Stronghold 4 install root to\nupgrade an existing Stronghold 4 installation to the new package versions:\n\n$ bin/agent\n\nThe Stronghold 4.0i patch release which contains these updated packages is\nalso available from the download site.\n\nAfter upgrading Stronghold, the server must be completely restarted by\nrunning the following commands from the install root:\n\n$ bin/stop-server\n$ bin/start-server\n\nFor more information on how to upgrade between releases of Stronghold 4,\nrefer to http://stronghold.redhat.com/support/upgrade-sh4", product_ids: [ "Red Hat Stronghold 4", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2004:405", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "security flaw", }, { cve: "CVE-2004-0595", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1617234", }, ], notes: [ { category: "description", text: "The strip_tags function in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, does not filter null (\\0) characters within tag names when restricting input to allowed tags, which allows dangerous tags to be processed by web browsers such as Internet Explorer and Safari, which ignore null characters and facilitate the exploitation of cross-site scripting (XSS) vulnerabilities.", title: "Vulnerability description", }, { category: "summary", text: "security flaw", title: "Vulnerability summary", }, ], product_status: { fixed: [ "Red Hat Stronghold 4", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0595", }, { category: "external", summary: "RHBZ#1617234", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1617234", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0595", url: "https://www.cve.org/CVERecord?id=CVE-2004-0595", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0595", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0595", }, ], release_date: "2004-07-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2004-07-23T09:26:00+00:00", details: "Updated Stronghold 4 packages are now available via the update agent\nservice. Run the following command from the Stronghold 4 install root to\nupgrade an existing Stronghold 4 installation to the new package versions:\n\n$ bin/agent\n\nThe Stronghold 4.0i patch release which contains these updated packages is\nalso available from the download site.\n\nAfter upgrading Stronghold, the server must be completely restarted by\nrunning the following commands from the install root:\n\n$ bin/stop-server\n$ bin/start-server\n\nFor more information on how to upgrade between releases of Stronghold 4,\nrefer to http://stronghold.redhat.com/support/upgrade-sh4", product_ids: [ "Red Hat Stronghold 4", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2004:405", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "security flaw", }, { cve: "CVE-2004-0700", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430866", }, ], notes: [ { category: "description", text: "Format string vulnerability in the mod_proxy hook functions function in ssl_engine_log.c in mod_ssl before 2.8.19 for Apache before 1.3.31 may allow remote attackers to execute arbitrary messages via format string specifiers in certain log messages for HTTPS that are handled by the ssl_log function.", title: "Vulnerability description", }, { category: "summary", text: "mod_proxy hook format string", title: "Vulnerability summary", }, ], product_status: { fixed: [ "Red Hat Stronghold 4", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0700", }, { category: "external", summary: "RHBZ#430866", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430866", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0700", url: "https://www.cve.org/CVERecord?id=CVE-2004-0700", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0700", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0700", }, ], release_date: "2004-07-16T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2004-07-23T09:26:00+00:00", details: "Updated Stronghold 4 packages are now available via the update agent\nservice. Run the following command from the Stronghold 4 install root to\nupgrade an existing Stronghold 4 installation to the new package versions:\n\n$ bin/agent\n\nThe Stronghold 4.0i patch release which contains these updated packages is\nalso available from the download site.\n\nAfter upgrading Stronghold, the server must be completely restarted by\nrunning the following commands from the install root:\n\n$ bin/stop-server\n$ bin/start-server\n\nFor more information on how to upgrade between releases of Stronghold 4,\nrefer to http://stronghold.redhat.com/support/upgrade-sh4", product_ids: [ "Red Hat Stronghold 4", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2004:405", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "mod_proxy hook format string", }, ], }
rhsa-2004_342
Vulnerability from csaf_redhat
Published
2004-07-06 08:35
Modified
2024-11-21 23:06
Summary
Red Hat Security Advisory: httpd security update
Notes
Topic
Updated httpd packages that fix a buffer overflow in mod_ssl and a remotely
triggerable memory leak are now available.
Details
The Apache HTTP server is a powerful, full-featured, efficient, and
freely-available Web server.
A stack buffer overflow was discovered in mod_ssl that could be triggered
if using the FakeBasicAuth option. If mod_ssl was sent a client certificate
with a subject DN field longer than 6000 characters, a stack overflow
occured if FakeBasicAuth had been enabled. In order to exploit this issue
the carefully crafted malicious certificate would have had to be signed by
a Certificate Authority which mod_ssl is configured to trust. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2004-0488 to this issue.
A remotely triggered memory leak in the Apache HTTP Server earlier than
version 2.0.50 was also discovered. This allowed a remote attacker to
perform a denial of service attack against the server by forcing it to
consume large amounts of memory. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CAN-2004-0493 to this issue.
Users of the Apache HTTP server should upgrade to these updated packages,
which contain backported patches that address these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated httpd packages that fix a buffer overflow in mod_ssl and a remotely\ntriggerable memory leak are now available.", title: "Topic", }, { category: "general", text: "The Apache HTTP server is a powerful, full-featured, efficient, and\nfreely-available Web server.\n\nA stack buffer overflow was discovered in mod_ssl that could be triggered\nif using the FakeBasicAuth option. If mod_ssl was sent a client certificate\nwith a subject DN field longer than 6000 characters, a stack overflow\noccured if FakeBasicAuth had been enabled. In order to exploit this issue\nthe carefully crafted malicious certificate would have had to be signed by\na Certificate Authority which mod_ssl is configured to trust. The Common\nVulnerabilities and Exposures project (cve.mitre.org) has assigned the name\nCAN-2004-0488 to this issue.\n\nA remotely triggered memory leak in the Apache HTTP Server earlier than\nversion 2.0.50 was also discovered. This allowed a remote attacker to\nperform a denial of service attack against the server by forcing it to\nconsume large amounts of memory. The Common Vulnerabilities and Exposures\nproject (cve.mitre.org) has assigned the name CAN-2004-0493 to this issue.\n\nUsers of the Apache HTTP server should upgrade to these updated packages,\nwhich contain backported patches that address these issues.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2004:342", url: "https://access.redhat.com/errata/RHSA-2004:342", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "http://www.apacheweek.com/features/security-20", url: "http://www.apacheweek.com/features/security-20", }, { category: "external", summary: "125046", url: "https://bugzilla.redhat.com/show_bug.cgi?id=125046", }, { category: "external", summary: "126863", url: "https://bugzilla.redhat.com/show_bug.cgi?id=126863", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2004/rhsa-2004_342.json", }, ], title: "Red Hat Security Advisory: httpd security update", tracking: { current_release_date: "2024-11-21T23:06:49+00:00", generator: { date: "2024-11-21T23:06:49+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2004:342", initial_release_date: "2004-07-06T08:35:00+00:00", revision_history: [ { date: "2004-07-06T08:35:00+00:00", number: "1", summary: "Initial version", }, { date: "2004-07-06T00:00:00+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-21T23:06:49+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AS version 3", product: { name: "Red Hat Enterprise Linux AS version 3", product_id: "3AS", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:3::as", }, }, }, { category: "product_name", name: "Red Hat Desktop version 3", product: { name: "Red Hat Desktop version 3", product_id: "3Desktop", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:3::desktop", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux ES version 3", product: { name: "Red Hat Enterprise Linux ES version 3", product_id: "3ES", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:3::es", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux WS version 3", product: { name: "Red Hat Enterprise Linux WS version 3", product_id: "3WS", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:3::ws", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "mod_ssl-1:2.0.46-32.ent.3.ia64", product: { name: "mod_ssl-1:2.0.46-32.ent.3.ia64", product_id: "mod_ssl-1:2.0.46-32.ent.3.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.46-32.ent.3?arch=ia64&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.46-32.ent.3.ia64", product: { name: "httpd-devel-0:2.0.46-32.ent.3.ia64", product_id: "httpd-devel-0:2.0.46-32.ent.3.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.46-32.ent.3?arch=ia64", }, }, }, { category: "product_version", name: "httpd-0:2.0.46-32.ent.3.ia64", product: { name: "httpd-0:2.0.46-32.ent.3.ia64", product_id: "httpd-0:2.0.46-32.ent.3.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-32.ent.3?arch=ia64", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.46-32.ent.3.ia64", product: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.ia64", product_id: "httpd-debuginfo-0:2.0.46-32.ent.3.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.46-32.ent.3?arch=ia64", }, }, }, ], category: "architecture", name: "ia64", }, { branches: [ { category: "product_version", name: "mod_ssl-1:2.0.46-32.ent.3.x86_64", product: { name: "mod_ssl-1:2.0.46-32.ent.3.x86_64", product_id: "mod_ssl-1:2.0.46-32.ent.3.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.46-32.ent.3?arch=x86_64&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.46-32.ent.3.x86_64", product: { name: "httpd-devel-0:2.0.46-32.ent.3.x86_64", product_id: "httpd-devel-0:2.0.46-32.ent.3.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.46-32.ent.3?arch=x86_64", }, }, }, { category: "product_version", name: "httpd-0:2.0.46-32.ent.3.x86_64", product: { name: "httpd-0:2.0.46-32.ent.3.x86_64", product_id: "httpd-0:2.0.46-32.ent.3.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-32.ent.3?arch=x86_64", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", product: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", product_id: "httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.46-32.ent.3?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "mod_ssl-1:2.0.46-32.ent.3.i386", product: { name: "mod_ssl-1:2.0.46-32.ent.3.i386", product_id: "mod_ssl-1:2.0.46-32.ent.3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.46-32.ent.3?arch=i386&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.46-32.ent.3.i386", product: { name: "httpd-devel-0:2.0.46-32.ent.3.i386", product_id: "httpd-devel-0:2.0.46-32.ent.3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.46-32.ent.3?arch=i386", }, }, }, { category: "product_version", name: "httpd-0:2.0.46-32.ent.3.i386", product: { name: "httpd-0:2.0.46-32.ent.3.i386", product_id: "httpd-0:2.0.46-32.ent.3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-32.ent.3?arch=i386", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.46-32.ent.3.i386", product: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.i386", product_id: "httpd-debuginfo-0:2.0.46-32.ent.3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.46-32.ent.3?arch=i386", }, }, }, ], category: "architecture", name: "i386", }, { branches: [ { category: "product_version", name: "httpd-0:2.0.46-32.ent.3.src", product: { name: "httpd-0:2.0.46-32.ent.3.src", product_id: "httpd-0:2.0.46-32.ent.3.src", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-32.ent.3?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "mod_ssl-1:2.0.46-32.ent.3.ppc", product: { name: "mod_ssl-1:2.0.46-32.ent.3.ppc", product_id: "mod_ssl-1:2.0.46-32.ent.3.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.46-32.ent.3?arch=ppc&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.46-32.ent.3.ppc", product: { name: "httpd-devel-0:2.0.46-32.ent.3.ppc", product_id: "httpd-devel-0:2.0.46-32.ent.3.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.46-32.ent.3?arch=ppc", }, }, }, { category: "product_version", name: "httpd-0:2.0.46-32.ent.3.ppc", product: { name: "httpd-0:2.0.46-32.ent.3.ppc", product_id: "httpd-0:2.0.46-32.ent.3.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-32.ent.3?arch=ppc", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.46-32.ent.3.ppc", product: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.ppc", product_id: "httpd-debuginfo-0:2.0.46-32.ent.3.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.46-32.ent.3?arch=ppc", }, }, }, ], category: "architecture", name: "ppc", }, { branches: [ { category: "product_version", name: "mod_ssl-1:2.0.46-32.ent.3.s390x", product: { name: "mod_ssl-1:2.0.46-32.ent.3.s390x", product_id: "mod_ssl-1:2.0.46-32.ent.3.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.46-32.ent.3?arch=s390x&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.46-32.ent.3.s390x", product: { name: "httpd-devel-0:2.0.46-32.ent.3.s390x", product_id: "httpd-devel-0:2.0.46-32.ent.3.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.46-32.ent.3?arch=s390x", }, }, }, { category: "product_version", name: "httpd-0:2.0.46-32.ent.3.s390x", product: { name: "httpd-0:2.0.46-32.ent.3.s390x", product_id: "httpd-0:2.0.46-32.ent.3.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-32.ent.3?arch=s390x", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.46-32.ent.3.s390x", product: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.s390x", product_id: "httpd-debuginfo-0:2.0.46-32.ent.3.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.46-32.ent.3?arch=s390x", }, }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "mod_ssl-1:2.0.46-32.ent.3.s390", product: { name: "mod_ssl-1:2.0.46-32.ent.3.s390", product_id: "mod_ssl-1:2.0.46-32.ent.3.s390", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.46-32.ent.3?arch=s390&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.46-32.ent.3.s390", product: { name: "httpd-devel-0:2.0.46-32.ent.3.s390", product_id: "httpd-devel-0:2.0.46-32.ent.3.s390", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.46-32.ent.3?arch=s390", }, }, }, { category: "product_version", name: "httpd-0:2.0.46-32.ent.3.s390", product: { name: "httpd-0:2.0.46-32.ent.3.s390", product_id: "httpd-0:2.0.46-32.ent.3.s390", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-32.ent.3?arch=s390", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.46-32.ent.3.s390", product: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.s390", product_id: "httpd-debuginfo-0:2.0.46-32.ent.3.s390", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.46-32.ent.3?arch=s390", }, }, }, ], category: "architecture", name: "s390", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.i386 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-32.ent.3.i386", }, product_reference: "httpd-0:2.0.46-32.ent.3.i386", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.ia64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-32.ent.3.ia64", }, product_reference: "httpd-0:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.ppc as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-32.ent.3.ppc", }, product_reference: "httpd-0:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.s390 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-32.ent.3.s390", }, product_reference: "httpd-0:2.0.46-32.ent.3.s390", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.s390x as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-32.ent.3.s390x", }, product_reference: "httpd-0:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.src as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-32.ent.3.src", }, product_reference: "httpd-0:2.0.46-32.ent.3.src", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.x86_64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-32.ent.3.x86_64", }, product_reference: "httpd-0:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.i386 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.i386", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.i386", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.ia64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.ppc as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.s390 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.s390", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.s390", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.s390x as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.x86_64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.i386 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-devel-0:2.0.46-32.ent.3.i386", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.i386", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.ia64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-devel-0:2.0.46-32.ent.3.ia64", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.ppc as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-devel-0:2.0.46-32.ent.3.ppc", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.s390 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-devel-0:2.0.46-32.ent.3.s390", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.s390", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.s390x as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-devel-0:2.0.46-32.ent.3.s390x", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.x86_64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-devel-0:2.0.46-32.ent.3.x86_64", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.i386 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:mod_ssl-1:2.0.46-32.ent.3.i386", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.i386", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.ia64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:mod_ssl-1:2.0.46-32.ent.3.ia64", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.ppc as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:mod_ssl-1:2.0.46-32.ent.3.ppc", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.s390 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:mod_ssl-1:2.0.46-32.ent.3.s390", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.s390", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.s390x as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:mod_ssl-1:2.0.46-32.ent.3.s390x", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.x86_64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:mod_ssl-1:2.0.46-32.ent.3.x86_64", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.i386 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-32.ent.3.i386", }, product_reference: "httpd-0:2.0.46-32.ent.3.i386", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.ia64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-32.ent.3.ia64", }, product_reference: "httpd-0:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.ppc as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-32.ent.3.ppc", }, product_reference: "httpd-0:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.s390 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-32.ent.3.s390", }, product_reference: "httpd-0:2.0.46-32.ent.3.s390", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.s390x as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-32.ent.3.s390x", }, product_reference: "httpd-0:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.src as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-32.ent.3.src", }, product_reference: "httpd-0:2.0.46-32.ent.3.src", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.x86_64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-32.ent.3.x86_64", }, product_reference: "httpd-0:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.i386 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.i386", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.i386", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.ia64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.ppc as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.s390 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.s390", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.s390", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.s390x as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.x86_64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.i386 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-devel-0:2.0.46-32.ent.3.i386", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.i386", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.ia64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-devel-0:2.0.46-32.ent.3.ia64", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.ppc as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-devel-0:2.0.46-32.ent.3.ppc", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.s390 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-devel-0:2.0.46-32.ent.3.s390", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.s390", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.s390x as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-devel-0:2.0.46-32.ent.3.s390x", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.x86_64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-devel-0:2.0.46-32.ent.3.x86_64", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.i386 as a component of Red Hat Desktop version 3", product_id: "3Desktop:mod_ssl-1:2.0.46-32.ent.3.i386", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.i386", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.ia64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:mod_ssl-1:2.0.46-32.ent.3.ia64", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.ppc as a component of Red Hat Desktop version 3", product_id: "3Desktop:mod_ssl-1:2.0.46-32.ent.3.ppc", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.s390 as a component of Red Hat Desktop version 3", product_id: "3Desktop:mod_ssl-1:2.0.46-32.ent.3.s390", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.s390", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.s390x as a component of Red Hat Desktop version 3", product_id: "3Desktop:mod_ssl-1:2.0.46-32.ent.3.s390x", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.x86_64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:mod_ssl-1:2.0.46-32.ent.3.x86_64", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.i386 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-32.ent.3.i386", }, product_reference: "httpd-0:2.0.46-32.ent.3.i386", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.ia64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-32.ent.3.ia64", }, product_reference: "httpd-0:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.ppc as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-32.ent.3.ppc", }, product_reference: "httpd-0:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.s390 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-32.ent.3.s390", }, product_reference: "httpd-0:2.0.46-32.ent.3.s390", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.s390x as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-32.ent.3.s390x", }, product_reference: "httpd-0:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.src as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-32.ent.3.src", }, product_reference: "httpd-0:2.0.46-32.ent.3.src", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.x86_64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-32.ent.3.x86_64", }, product_reference: "httpd-0:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.i386 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.i386", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.i386", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.ia64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.ppc as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.s390 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.s390", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.s390", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.s390x as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.x86_64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.i386 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-devel-0:2.0.46-32.ent.3.i386", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.i386", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.ia64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-devel-0:2.0.46-32.ent.3.ia64", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.ppc as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-devel-0:2.0.46-32.ent.3.ppc", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.s390 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-devel-0:2.0.46-32.ent.3.s390", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.s390", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.s390x as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-devel-0:2.0.46-32.ent.3.s390x", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.x86_64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-devel-0:2.0.46-32.ent.3.x86_64", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.i386 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:mod_ssl-1:2.0.46-32.ent.3.i386", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.i386", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.ia64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:mod_ssl-1:2.0.46-32.ent.3.ia64", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.ppc as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:mod_ssl-1:2.0.46-32.ent.3.ppc", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.s390 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:mod_ssl-1:2.0.46-32.ent.3.s390", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.s390", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.s390x as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:mod_ssl-1:2.0.46-32.ent.3.s390x", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.x86_64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:mod_ssl-1:2.0.46-32.ent.3.x86_64", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.i386 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-32.ent.3.i386", }, product_reference: "httpd-0:2.0.46-32.ent.3.i386", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.ia64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-32.ent.3.ia64", }, product_reference: "httpd-0:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.ppc as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-32.ent.3.ppc", }, product_reference: "httpd-0:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.s390 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-32.ent.3.s390", }, product_reference: "httpd-0:2.0.46-32.ent.3.s390", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.s390x as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-32.ent.3.s390x", }, product_reference: "httpd-0:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.src as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-32.ent.3.src", }, product_reference: "httpd-0:2.0.46-32.ent.3.src", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.x86_64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-32.ent.3.x86_64", }, product_reference: "httpd-0:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.i386 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.i386", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.i386", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.ia64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.ppc as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.s390 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.s390", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.s390", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.s390x as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.x86_64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.i386 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-devel-0:2.0.46-32.ent.3.i386", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.i386", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.ia64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-devel-0:2.0.46-32.ent.3.ia64", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.ppc as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-devel-0:2.0.46-32.ent.3.ppc", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.s390 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-devel-0:2.0.46-32.ent.3.s390", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.s390", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.s390x as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-devel-0:2.0.46-32.ent.3.s390x", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.x86_64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-devel-0:2.0.46-32.ent.3.x86_64", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.i386 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:mod_ssl-1:2.0.46-32.ent.3.i386", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.i386", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.ia64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:mod_ssl-1:2.0.46-32.ent.3.ia64", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.ppc as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:mod_ssl-1:2.0.46-32.ent.3.ppc", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.s390 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:mod_ssl-1:2.0.46-32.ent.3.s390", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.s390", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.s390x as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:mod_ssl-1:2.0.46-32.ent.3.s390x", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.x86_64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:mod_ssl-1:2.0.46-32.ent.3.x86_64", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3WS", }, ], }, vulnerabilities: [ { cve: "CVE-2004-0488", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430867", }, ], notes: [ { category: "description", text: "Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.", title: "Vulnerability description", }, { category: "summary", text: "mod_ssl ssl_util_uuencode_binary CA issue", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS:httpd-0:2.0.46-32.ent.3.i386", "3AS:httpd-0:2.0.46-32.ent.3.ia64", "3AS:httpd-0:2.0.46-32.ent.3.ppc", "3AS:httpd-0:2.0.46-32.ent.3.s390", "3AS:httpd-0:2.0.46-32.ent.3.s390x", "3AS:httpd-0:2.0.46-32.ent.3.src", "3AS:httpd-0:2.0.46-32.ent.3.x86_64", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3AS:httpd-devel-0:2.0.46-32.ent.3.i386", "3AS:httpd-devel-0:2.0.46-32.ent.3.ia64", "3AS:httpd-devel-0:2.0.46-32.ent.3.ppc", "3AS:httpd-devel-0:2.0.46-32.ent.3.s390", "3AS:httpd-devel-0:2.0.46-32.ent.3.s390x", "3AS:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3AS:mod_ssl-1:2.0.46-32.ent.3.i386", "3AS:mod_ssl-1:2.0.46-32.ent.3.ia64", "3AS:mod_ssl-1:2.0.46-32.ent.3.ppc", "3AS:mod_ssl-1:2.0.46-32.ent.3.s390", "3AS:mod_ssl-1:2.0.46-32.ent.3.s390x", "3AS:mod_ssl-1:2.0.46-32.ent.3.x86_64", "3Desktop:httpd-0:2.0.46-32.ent.3.i386", "3Desktop:httpd-0:2.0.46-32.ent.3.ia64", "3Desktop:httpd-0:2.0.46-32.ent.3.ppc", "3Desktop:httpd-0:2.0.46-32.ent.3.s390", "3Desktop:httpd-0:2.0.46-32.ent.3.s390x", "3Desktop:httpd-0:2.0.46-32.ent.3.src", "3Desktop:httpd-0:2.0.46-32.ent.3.x86_64", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.i386", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.ia64", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.ppc", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.s390", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.s390x", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.i386", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.ia64", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.ppc", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.s390", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.s390x", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.x86_64", "3ES:httpd-0:2.0.46-32.ent.3.i386", "3ES:httpd-0:2.0.46-32.ent.3.ia64", "3ES:httpd-0:2.0.46-32.ent.3.ppc", "3ES:httpd-0:2.0.46-32.ent.3.s390", "3ES:httpd-0:2.0.46-32.ent.3.s390x", "3ES:httpd-0:2.0.46-32.ent.3.src", "3ES:httpd-0:2.0.46-32.ent.3.x86_64", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3ES:httpd-devel-0:2.0.46-32.ent.3.i386", "3ES:httpd-devel-0:2.0.46-32.ent.3.ia64", "3ES:httpd-devel-0:2.0.46-32.ent.3.ppc", "3ES:httpd-devel-0:2.0.46-32.ent.3.s390", "3ES:httpd-devel-0:2.0.46-32.ent.3.s390x", "3ES:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3ES:mod_ssl-1:2.0.46-32.ent.3.i386", "3ES:mod_ssl-1:2.0.46-32.ent.3.ia64", "3ES:mod_ssl-1:2.0.46-32.ent.3.ppc", "3ES:mod_ssl-1:2.0.46-32.ent.3.s390", "3ES:mod_ssl-1:2.0.46-32.ent.3.s390x", "3ES:mod_ssl-1:2.0.46-32.ent.3.x86_64", "3WS:httpd-0:2.0.46-32.ent.3.i386", "3WS:httpd-0:2.0.46-32.ent.3.ia64", "3WS:httpd-0:2.0.46-32.ent.3.ppc", "3WS:httpd-0:2.0.46-32.ent.3.s390", "3WS:httpd-0:2.0.46-32.ent.3.s390x", "3WS:httpd-0:2.0.46-32.ent.3.src", "3WS:httpd-0:2.0.46-32.ent.3.x86_64", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3WS:httpd-devel-0:2.0.46-32.ent.3.i386", "3WS:httpd-devel-0:2.0.46-32.ent.3.ia64", "3WS:httpd-devel-0:2.0.46-32.ent.3.ppc", "3WS:httpd-devel-0:2.0.46-32.ent.3.s390", "3WS:httpd-devel-0:2.0.46-32.ent.3.s390x", "3WS:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3WS:mod_ssl-1:2.0.46-32.ent.3.i386", "3WS:mod_ssl-1:2.0.46-32.ent.3.ia64", "3WS:mod_ssl-1:2.0.46-32.ent.3.ppc", "3WS:mod_ssl-1:2.0.46-32.ent.3.s390", "3WS:mod_ssl-1:2.0.46-32.ent.3.s390x", "3WS:mod_ssl-1:2.0.46-32.ent.3.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0488", }, { category: "external", summary: "RHBZ#430867", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430867", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0488", url: "https://www.cve.org/CVERecord?id=CVE-2004-0488", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0488", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0488", }, ], release_date: "2004-05-17T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2004-07-06T08:35:00+00:00", details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.", product_ids: [ "3AS:httpd-0:2.0.46-32.ent.3.i386", "3AS:httpd-0:2.0.46-32.ent.3.ia64", "3AS:httpd-0:2.0.46-32.ent.3.ppc", "3AS:httpd-0:2.0.46-32.ent.3.s390", "3AS:httpd-0:2.0.46-32.ent.3.s390x", "3AS:httpd-0:2.0.46-32.ent.3.src", "3AS:httpd-0:2.0.46-32.ent.3.x86_64", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3AS:httpd-devel-0:2.0.46-32.ent.3.i386", "3AS:httpd-devel-0:2.0.46-32.ent.3.ia64", "3AS:httpd-devel-0:2.0.46-32.ent.3.ppc", "3AS:httpd-devel-0:2.0.46-32.ent.3.s390", "3AS:httpd-devel-0:2.0.46-32.ent.3.s390x", "3AS:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3AS:mod_ssl-1:2.0.46-32.ent.3.i386", "3AS:mod_ssl-1:2.0.46-32.ent.3.ia64", "3AS:mod_ssl-1:2.0.46-32.ent.3.ppc", "3AS:mod_ssl-1:2.0.46-32.ent.3.s390", "3AS:mod_ssl-1:2.0.46-32.ent.3.s390x", "3AS:mod_ssl-1:2.0.46-32.ent.3.x86_64", "3Desktop:httpd-0:2.0.46-32.ent.3.i386", "3Desktop:httpd-0:2.0.46-32.ent.3.ia64", "3Desktop:httpd-0:2.0.46-32.ent.3.ppc", "3Desktop:httpd-0:2.0.46-32.ent.3.s390", "3Desktop:httpd-0:2.0.46-32.ent.3.s390x", "3Desktop:httpd-0:2.0.46-32.ent.3.src", "3Desktop:httpd-0:2.0.46-32.ent.3.x86_64", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.i386", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.ia64", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.ppc", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.s390", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.s390x", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.i386", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.ia64", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.ppc", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.s390", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.s390x", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.x86_64", "3ES:httpd-0:2.0.46-32.ent.3.i386", "3ES:httpd-0:2.0.46-32.ent.3.ia64", "3ES:httpd-0:2.0.46-32.ent.3.ppc", "3ES:httpd-0:2.0.46-32.ent.3.s390", "3ES:httpd-0:2.0.46-32.ent.3.s390x", "3ES:httpd-0:2.0.46-32.ent.3.src", "3ES:httpd-0:2.0.46-32.ent.3.x86_64", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3ES:httpd-devel-0:2.0.46-32.ent.3.i386", "3ES:httpd-devel-0:2.0.46-32.ent.3.ia64", "3ES:httpd-devel-0:2.0.46-32.ent.3.ppc", "3ES:httpd-devel-0:2.0.46-32.ent.3.s390", "3ES:httpd-devel-0:2.0.46-32.ent.3.s390x", "3ES:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3ES:mod_ssl-1:2.0.46-32.ent.3.i386", "3ES:mod_ssl-1:2.0.46-32.ent.3.ia64", "3ES:mod_ssl-1:2.0.46-32.ent.3.ppc", "3ES:mod_ssl-1:2.0.46-32.ent.3.s390", "3ES:mod_ssl-1:2.0.46-32.ent.3.s390x", "3ES:mod_ssl-1:2.0.46-32.ent.3.x86_64", "3WS:httpd-0:2.0.46-32.ent.3.i386", "3WS:httpd-0:2.0.46-32.ent.3.ia64", "3WS:httpd-0:2.0.46-32.ent.3.ppc", "3WS:httpd-0:2.0.46-32.ent.3.s390", "3WS:httpd-0:2.0.46-32.ent.3.s390x", "3WS:httpd-0:2.0.46-32.ent.3.src", "3WS:httpd-0:2.0.46-32.ent.3.x86_64", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3WS:httpd-devel-0:2.0.46-32.ent.3.i386", "3WS:httpd-devel-0:2.0.46-32.ent.3.ia64", "3WS:httpd-devel-0:2.0.46-32.ent.3.ppc", "3WS:httpd-devel-0:2.0.46-32.ent.3.s390", "3WS:httpd-devel-0:2.0.46-32.ent.3.s390x", "3WS:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3WS:mod_ssl-1:2.0.46-32.ent.3.i386", "3WS:mod_ssl-1:2.0.46-32.ent.3.ia64", "3WS:mod_ssl-1:2.0.46-32.ent.3.ppc", "3WS:mod_ssl-1:2.0.46-32.ent.3.s390", "3WS:mod_ssl-1:2.0.46-32.ent.3.s390x", "3WS:mod_ssl-1:2.0.46-32.ent.3.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2004:342", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_ssl ssl_util_uuencode_binary CA issue", }, { cve: "CVE-2004-0493", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1617211", }, ], notes: [ { category: "description", text: "The ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote attackers to cause a denial of service (memory exhaustion), and possibly an integer signedness error leading to a heap-based buffer overflow on 64 bit systems, via long header lines with large numbers of space or tab characters.", title: "Vulnerability description", }, { category: "summary", text: "security flaw", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS:httpd-0:2.0.46-32.ent.3.i386", "3AS:httpd-0:2.0.46-32.ent.3.ia64", "3AS:httpd-0:2.0.46-32.ent.3.ppc", "3AS:httpd-0:2.0.46-32.ent.3.s390", "3AS:httpd-0:2.0.46-32.ent.3.s390x", "3AS:httpd-0:2.0.46-32.ent.3.src", "3AS:httpd-0:2.0.46-32.ent.3.x86_64", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3AS:httpd-devel-0:2.0.46-32.ent.3.i386", "3AS:httpd-devel-0:2.0.46-32.ent.3.ia64", "3AS:httpd-devel-0:2.0.46-32.ent.3.ppc", "3AS:httpd-devel-0:2.0.46-32.ent.3.s390", "3AS:httpd-devel-0:2.0.46-32.ent.3.s390x", "3AS:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3AS:mod_ssl-1:2.0.46-32.ent.3.i386", "3AS:mod_ssl-1:2.0.46-32.ent.3.ia64", "3AS:mod_ssl-1:2.0.46-32.ent.3.ppc", "3AS:mod_ssl-1:2.0.46-32.ent.3.s390", "3AS:mod_ssl-1:2.0.46-32.ent.3.s390x", "3AS:mod_ssl-1:2.0.46-32.ent.3.x86_64", "3Desktop:httpd-0:2.0.46-32.ent.3.i386", "3Desktop:httpd-0:2.0.46-32.ent.3.ia64", "3Desktop:httpd-0:2.0.46-32.ent.3.ppc", "3Desktop:httpd-0:2.0.46-32.ent.3.s390", "3Desktop:httpd-0:2.0.46-32.ent.3.s390x", "3Desktop:httpd-0:2.0.46-32.ent.3.src", "3Desktop:httpd-0:2.0.46-32.ent.3.x86_64", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.i386", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.ia64", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.ppc", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.s390", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.s390x", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.i386", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.ia64", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.ppc", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.s390", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.s390x", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.x86_64", "3ES:httpd-0:2.0.46-32.ent.3.i386", "3ES:httpd-0:2.0.46-32.ent.3.ia64", "3ES:httpd-0:2.0.46-32.ent.3.ppc", "3ES:httpd-0:2.0.46-32.ent.3.s390", "3ES:httpd-0:2.0.46-32.ent.3.s390x", "3ES:httpd-0:2.0.46-32.ent.3.src", "3ES:httpd-0:2.0.46-32.ent.3.x86_64", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3ES:httpd-devel-0:2.0.46-32.ent.3.i386", "3ES:httpd-devel-0:2.0.46-32.ent.3.ia64", "3ES:httpd-devel-0:2.0.46-32.ent.3.ppc", "3ES:httpd-devel-0:2.0.46-32.ent.3.s390", "3ES:httpd-devel-0:2.0.46-32.ent.3.s390x", "3ES:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3ES:mod_ssl-1:2.0.46-32.ent.3.i386", "3ES:mod_ssl-1:2.0.46-32.ent.3.ia64", "3ES:mod_ssl-1:2.0.46-32.ent.3.ppc", "3ES:mod_ssl-1:2.0.46-32.ent.3.s390", "3ES:mod_ssl-1:2.0.46-32.ent.3.s390x", "3ES:mod_ssl-1:2.0.46-32.ent.3.x86_64", "3WS:httpd-0:2.0.46-32.ent.3.i386", "3WS:httpd-0:2.0.46-32.ent.3.ia64", "3WS:httpd-0:2.0.46-32.ent.3.ppc", "3WS:httpd-0:2.0.46-32.ent.3.s390", "3WS:httpd-0:2.0.46-32.ent.3.s390x", "3WS:httpd-0:2.0.46-32.ent.3.src", "3WS:httpd-0:2.0.46-32.ent.3.x86_64", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3WS:httpd-devel-0:2.0.46-32.ent.3.i386", "3WS:httpd-devel-0:2.0.46-32.ent.3.ia64", "3WS:httpd-devel-0:2.0.46-32.ent.3.ppc", "3WS:httpd-devel-0:2.0.46-32.ent.3.s390", "3WS:httpd-devel-0:2.0.46-32.ent.3.s390x", "3WS:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3WS:mod_ssl-1:2.0.46-32.ent.3.i386", "3WS:mod_ssl-1:2.0.46-32.ent.3.ia64", "3WS:mod_ssl-1:2.0.46-32.ent.3.ppc", "3WS:mod_ssl-1:2.0.46-32.ent.3.s390", "3WS:mod_ssl-1:2.0.46-32.ent.3.s390x", "3WS:mod_ssl-1:2.0.46-32.ent.3.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0493", }, { category: "external", summary: "RHBZ#1617211", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1617211", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0493", url: "https://www.cve.org/CVERecord?id=CVE-2004-0493", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0493", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0493", }, ], release_date: "2004-06-28T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2004-07-06T08:35:00+00:00", details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.", product_ids: [ "3AS:httpd-0:2.0.46-32.ent.3.i386", "3AS:httpd-0:2.0.46-32.ent.3.ia64", "3AS:httpd-0:2.0.46-32.ent.3.ppc", "3AS:httpd-0:2.0.46-32.ent.3.s390", "3AS:httpd-0:2.0.46-32.ent.3.s390x", "3AS:httpd-0:2.0.46-32.ent.3.src", "3AS:httpd-0:2.0.46-32.ent.3.x86_64", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3AS:httpd-devel-0:2.0.46-32.ent.3.i386", "3AS:httpd-devel-0:2.0.46-32.ent.3.ia64", "3AS:httpd-devel-0:2.0.46-32.ent.3.ppc", "3AS:httpd-devel-0:2.0.46-32.ent.3.s390", "3AS:httpd-devel-0:2.0.46-32.ent.3.s390x", "3AS:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3AS:mod_ssl-1:2.0.46-32.ent.3.i386", "3AS:mod_ssl-1:2.0.46-32.ent.3.ia64", "3AS:mod_ssl-1:2.0.46-32.ent.3.ppc", "3AS:mod_ssl-1:2.0.46-32.ent.3.s390", "3AS:mod_ssl-1:2.0.46-32.ent.3.s390x", "3AS:mod_ssl-1:2.0.46-32.ent.3.x86_64", "3Desktop:httpd-0:2.0.46-32.ent.3.i386", "3Desktop:httpd-0:2.0.46-32.ent.3.ia64", "3Desktop:httpd-0:2.0.46-32.ent.3.ppc", "3Desktop:httpd-0:2.0.46-32.ent.3.s390", "3Desktop:httpd-0:2.0.46-32.ent.3.s390x", "3Desktop:httpd-0:2.0.46-32.ent.3.src", "3Desktop:httpd-0:2.0.46-32.ent.3.x86_64", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.i386", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.ia64", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.ppc", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.s390", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.s390x", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.i386", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.ia64", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.ppc", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.s390", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.s390x", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.x86_64", "3ES:httpd-0:2.0.46-32.ent.3.i386", "3ES:httpd-0:2.0.46-32.ent.3.ia64", "3ES:httpd-0:2.0.46-32.ent.3.ppc", "3ES:httpd-0:2.0.46-32.ent.3.s390", "3ES:httpd-0:2.0.46-32.ent.3.s390x", "3ES:httpd-0:2.0.46-32.ent.3.src", "3ES:httpd-0:2.0.46-32.ent.3.x86_64", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3ES:httpd-devel-0:2.0.46-32.ent.3.i386", "3ES:httpd-devel-0:2.0.46-32.ent.3.ia64", "3ES:httpd-devel-0:2.0.46-32.ent.3.ppc", "3ES:httpd-devel-0:2.0.46-32.ent.3.s390", "3ES:httpd-devel-0:2.0.46-32.ent.3.s390x", "3ES:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3ES:mod_ssl-1:2.0.46-32.ent.3.i386", "3ES:mod_ssl-1:2.0.46-32.ent.3.ia64", "3ES:mod_ssl-1:2.0.46-32.ent.3.ppc", "3ES:mod_ssl-1:2.0.46-32.ent.3.s390", "3ES:mod_ssl-1:2.0.46-32.ent.3.s390x", "3ES:mod_ssl-1:2.0.46-32.ent.3.x86_64", "3WS:httpd-0:2.0.46-32.ent.3.i386", "3WS:httpd-0:2.0.46-32.ent.3.ia64", "3WS:httpd-0:2.0.46-32.ent.3.ppc", "3WS:httpd-0:2.0.46-32.ent.3.s390", "3WS:httpd-0:2.0.46-32.ent.3.s390x", "3WS:httpd-0:2.0.46-32.ent.3.src", "3WS:httpd-0:2.0.46-32.ent.3.x86_64", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3WS:httpd-devel-0:2.0.46-32.ent.3.i386", "3WS:httpd-devel-0:2.0.46-32.ent.3.ia64", "3WS:httpd-devel-0:2.0.46-32.ent.3.ppc", "3WS:httpd-devel-0:2.0.46-32.ent.3.s390", "3WS:httpd-devel-0:2.0.46-32.ent.3.s390x", "3WS:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3WS:mod_ssl-1:2.0.46-32.ent.3.i386", "3WS:mod_ssl-1:2.0.46-32.ent.3.ia64", "3WS:mod_ssl-1:2.0.46-32.ent.3.ppc", "3WS:mod_ssl-1:2.0.46-32.ent.3.s390", "3WS:mod_ssl-1:2.0.46-32.ent.3.s390x", "3WS:mod_ssl-1:2.0.46-32.ent.3.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2004:342", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "security flaw", }, ], }
rhsa-2008_0523
Vulnerability from csaf_redhat
Published
2008-06-30 15:29
Modified
2024-12-08 10:33
Summary
Red Hat Security Advisory: Red Hat Network Proxy Server security update
Notes
Topic
Red Hat Network Proxy Server version 4.2.3 is now available. This update
includes fixes for a number of security issues in Red Hat Network Proxy
Server components.
This update has been rated as having low security impact by the Red
Hat Security Response Team.
Details
The Red Hat Network Proxy Server 4.2.3 release corrects several security
vulnerabilities in several shipped components. In a typical operating
environment, these components are not exposed to users of Proxy Server in a
vulnerable manner. These security updates will reduce risk in unique Proxy
Server environments.
Multiple flaws were fixed in the Apache HTTPD server. These flaws could
result in a cross-site scripting or denial-of-service attack.
(CVE-2007-6388, CVE-2007-5000, CVE-2007-4465, CVE-2007-3304, CVE-2006-5752,
CVE-2006-3918, CVE-2005-3352)
A denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)
Multiple flaws in mod_ssl. (CVE-2004-0488, CVE-2004-0700, CVE-2004-0885)
A denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329)
Users of Red Hat Network Proxy Server 4.2 are advised to upgrade to 4.2.3,
which resolves these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Low", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Red Hat Network Proxy Server version 4.2.3 is now available. This update\nincludes fixes for a number of security issues in Red Hat Network Proxy\nServer components.\n\nThis update has been rated as having low security impact by the Red\nHat Security Response Team.", title: "Topic", }, { category: "general", text: "The Red Hat Network Proxy Server 4.2.3 release corrects several security\nvulnerabilities in several shipped components. In a typical operating\nenvironment, these components are not exposed to users of Proxy Server in a\nvulnerable manner. These security updates will reduce risk in unique Proxy\nServer environments.\n\nMultiple flaws were fixed in the Apache HTTPD server. These flaws could\nresult in a cross-site scripting or denial-of-service attack.\n(CVE-2007-6388, CVE-2007-5000, CVE-2007-4465, CVE-2007-3304, CVE-2006-5752,\nCVE-2006-3918, CVE-2005-3352)\n\nA denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)\n\nMultiple flaws in mod_ssl. (CVE-2004-0488, CVE-2004-0700, CVE-2004-0885)\n\nA denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329)\n\nUsers of Red Hat Network Proxy Server 4.2 are advised to upgrade to 4.2.3,\nwhich resolves these issues.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2008:0523", url: "https://access.redhat.com/errata/RHSA-2008:0523", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#low", url: "https://access.redhat.com/security/updates/classification/#low", }, { category: "external", summary: "449336", url: "https://bugzilla.redhat.com/show_bug.cgi?id=449336", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0523.json", }, ], title: "Red Hat Security Advisory: Red Hat Network Proxy Server security update", tracking: { current_release_date: "2024-12-08T10:33:39+00:00", generator: { date: "2024-12-08T10:33:39+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.3", }, }, id: "RHSA-2008:0523", initial_release_date: "2008-06-30T15:29:00+00:00", revision_history: [ { date: "2008-06-30T15:29:00+00:00", number: "1", summary: "Initial version", }, { date: "2008-06-30T11:32:56+00:00", number: "2", summary: "Last updated version", }, { date: "2024-12-08T10:33:39+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Satellite Proxy v 4.2 (RHEL v.3 AS)", product: { name: "Red Hat Satellite Proxy v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNPROXY4.2", product_identification_helper: { cpe: "cpe:/a:redhat:network_proxy:4.2::el3", }, }, }, { category: "product_name", name: "Red Hat Satellite Proxy v 4.2 (RHEL v.4 AS)", product: { name: "Red Hat Satellite Proxy v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNPROXY4.2", product_identification_helper: { cpe: "cpe:/a:redhat:network_proxy:4.2::el4", }, }, }, ], category: "product_family", name: "Red Hat Satellite Proxy", }, { branches: [ { category: "product_version", name: "jabberd-0:2.0s10-3.37.rhn.i386", product: { name: "jabberd-0:2.0s10-3.37.rhn.i386", product_id: "jabberd-0:2.0s10-3.37.rhn.i386", product_identification_helper: { purl: "pkg:rpm/redhat/jabberd@2.0s10-3.37.rhn?arch=i386", }, }, }, { category: "product_version", name: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386", product: { name: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386", product_id: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-apache@1.3.27-36.rhn.rhel3?arch=i386", }, }, }, { category: "product_version", name: "rhn-modperl-0:1.29-16.rhel3.i386", product: { name: "rhn-modperl-0:1.29-16.rhel3.i386", product_id: "rhn-modperl-0:1.29-16.rhel3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modperl@1.29-16.rhel3?arch=i386", }, }, }, { category: "product_version", name: "jabberd-0:2.0s10-3.38.rhn.i386", product: { name: "jabberd-0:2.0s10-3.38.rhn.i386", product_id: "jabberd-0:2.0s10-3.38.rhn.i386", product_identification_helper: { purl: "pkg:rpm/redhat/jabberd@2.0s10-3.38.rhn?arch=i386", }, }, }, { category: "product_version", name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product: { name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product_id: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-apache@1.3.27-36.rhn.rhel4?arch=i386", }, }, }, { category: "product_version", name: "rhn-modperl-0:1.29-16.rhel4.i386", product: { name: "rhn-modperl-0:1.29-16.rhel4.i386", product_id: "rhn-modperl-0:1.29-16.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modperl@1.29-16.rhel4?arch=i386", }, }, }, ], category: "architecture", name: "i386", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "jabberd-0:2.0s10-3.37.rhn.i386 as a component of Red Hat Satellite Proxy v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", }, product_reference: "jabberd-0:2.0s10-3.37.rhn.i386", relates_to_product_reference: "3AS-RHNPROXY4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386 as a component of Red Hat Satellite Proxy v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", }, product_reference: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386", relates_to_product_reference: "3AS-RHNPROXY4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-modperl-0:1.29-16.rhel3.i386 as a component of Red Hat Satellite Proxy v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", }, product_reference: "rhn-modperl-0:1.29-16.rhel3.i386", relates_to_product_reference: "3AS-RHNPROXY4.2", }, { category: "default_component_of", full_product_name: { name: "jabberd-0:2.0s10-3.38.rhn.i386 as a component of Red Hat Satellite Proxy v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", }, product_reference: "jabberd-0:2.0s10-3.38.rhn.i386", relates_to_product_reference: "4AS-RHNPROXY4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386 as a component of Red Hat Satellite Proxy v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", }, product_reference: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", relates_to_product_reference: "4AS-RHNPROXY4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-modperl-0:1.29-16.rhel4.i386 as a component of Red Hat Satellite Proxy v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", }, product_reference: "rhn-modperl-0:1.29-16.rhel4.i386", relates_to_product_reference: "4AS-RHNPROXY4.2", }, ], }, vulnerabilities: [ { cve: "CVE-2004-0488", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430867", }, ], notes: [ { category: "description", text: "Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.", title: "Vulnerability description", }, { category: "summary", text: "mod_ssl ssl_util_uuencode_binary CA issue", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0488", }, { category: "external", summary: "RHBZ#430867", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430867", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0488", url: "https://www.cve.org/CVERecord?id=CVE-2004-0488", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0488", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0488", }, ], release_date: "2004-05-17T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_ssl ssl_util_uuencode_binary CA issue", }, { cve: "CVE-2004-0700", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430866", }, ], notes: [ { category: "description", text: "Format string vulnerability in the mod_proxy hook functions function in ssl_engine_log.c in mod_ssl before 2.8.19 for Apache before 1.3.31 may allow remote attackers to execute arbitrary messages via format string specifiers in certain log messages for HTTPS that are handled by the ssl_log function.", title: "Vulnerability description", }, { category: "summary", text: "mod_proxy hook format string", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0700", }, { category: "external", summary: "RHBZ#430866", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430866", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0700", url: "https://www.cve.org/CVERecord?id=CVE-2004-0700", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0700", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0700", }, ], release_date: "2004-07-16T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "mod_proxy hook format string", }, { cve: "CVE-2004-0885", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430637", }, ], notes: [ { category: "description", text: "The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the \"SSLCipherSuite\" directive in directory or location context, allows remote clients to bypass intended restrictions by using any cipher suite that is allowed by the virtual host configuration.", title: "Vulnerability description", }, { category: "summary", text: "mod_ssl SSLCipherSuite bypass", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0885", }, { category: "external", summary: "RHBZ#430637", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430637", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0885", url: "https://www.cve.org/CVERecord?id=CVE-2004-0885", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0885", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0885", }, ], release_date: "2004-10-05T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_ssl SSLCipherSuite bypass", }, { cve: "CVE-2005-3352", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2005-12-12T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430524", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in the mod_imap module of Apache httpd before 1.3.35-dev and Apache httpd 2.0.x before 2.0.56-dev allows remote attackers to inject arbitrary web script or HTML via the Referer when using image maps.", title: "Vulnerability description", }, { category: "summary", text: "httpd cross-site scripting flaw in mod_imap", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-3352", }, { category: "external", summary: "RHBZ#430524", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430524", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-3352", url: "https://www.cve.org/CVERecord?id=CVE-2005-3352", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-3352", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-3352", }, ], release_date: "2005-12-12T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd cross-site scripting flaw in mod_imap", }, { cve: "CVE-2006-1329", ids: [ { system_name: "Red Hat Bugzilla ID", text: "429254", }, ], notes: [ { category: "description", text: "The SASL negotiation in Jabber Studio jabberd before 2.0s11 allows remote attackers to cause a denial of service (\"c2s segfault\") by sending a \"response stanza before an auth stanza\".", title: "Vulnerability description", }, { category: "summary", text: "jabberd SASL DoS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-1329", }, { category: "external", summary: "RHBZ#429254", url: "https://bugzilla.redhat.com/show_bug.cgi?id=429254", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-1329", url: "https://www.cve.org/CVERecord?id=CVE-2006-1329", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-1329", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-1329", }, ], release_date: "2006-03-09T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "jabberd SASL DoS", }, { cve: "CVE-2006-3918", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2006-07-31T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "200732", }, ], notes: [ { category: "description", text: "http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.", title: "Vulnerability description", }, { category: "summary", text: "httpd: Expect header XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-3918", }, { category: "external", summary: "RHBZ#200732", url: "https://bugzilla.redhat.com/show_bug.cgi?id=200732", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-3918", url: "https://www.cve.org/CVERecord?id=CVE-2006-3918", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-3918", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-3918", }, ], release_date: "2006-05-08T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd: Expect header XSS", }, { cve: "CVE-2006-5752", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-06-20T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245112", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform \"charset detection\" when the content-type is not specified.", title: "Vulnerability description", }, { category: "summary", text: "httpd mod_status XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-5752", }, { category: "external", summary: "RHBZ#245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-5752", url: "https://www.cve.org/CVERecord?id=CVE-2006-5752", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", }, ], release_date: "2007-06-20T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd mod_status XSS", }, { cve: "CVE-2007-1349", discovery_date: "2007-05-17T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "240423", }, ], notes: [ { category: "description", text: "PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.", title: "Vulnerability description", }, { category: "summary", text: "mod_perl PerlRun denial of service", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1349", }, { category: "external", summary: "RHBZ#240423", url: "https://bugzilla.redhat.com/show_bug.cgi?id=240423", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1349", url: "https://www.cve.org/CVERecord?id=CVE-2007-1349", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1349", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1349", }, ], release_date: "2007-03-22T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_perl PerlRun denial of service", }, { cve: "CVE-2007-3304", discovery_date: "2007-06-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245111", }, ], notes: [ { category: "description", text: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"", title: "Vulnerability description", }, { category: "summary", text: "httpd scoreboard lack of PID protection", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3304", }, { category: "external", summary: "RHBZ#245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3304", url: "https://www.cve.org/CVERecord?id=CVE-2007-3304", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", }, ], release_date: "2007-06-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd scoreboard lack of PID protection", }, { cve: "CVE-2007-4465", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-09-13T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "289511", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that this issue is due to a design limitation of browsers that attempt to perform automatic content type detection.", title: "Vulnerability description", }, { category: "summary", text: "mod_autoindex XSS", title: "Vulnerability summary", }, { category: "other", text: "This is actually a flaw in browsers that do not derive the response character set as required by RFC 2616. This does not affect the default configuration of Apache httpd in Red Hat products and will only affect customers who have removed the \"AddDefaultCharset\" directive and are using directory indexes. The Red Hat Product Security has rated this issue as having low security impact, a future update may address this flaw.", title: "Statement", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-4465", }, { category: "external", summary: "RHBZ#289511", url: "https://bugzilla.redhat.com/show_bug.cgi?id=289511", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-4465", url: "https://www.cve.org/CVERecord?id=CVE-2007-4465", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-4465", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-4465", }, ], release_date: "2007-09-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "mod_autoindex XSS", }, { cve: "CVE-2007-5000", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-12-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "419931", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "httpd: mod_imagemap XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-5000", }, { category: "external", summary: "RHBZ#419931", url: "https://bugzilla.redhat.com/show_bug.cgi?id=419931", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-5000", url: "https://www.cve.org/CVERecord?id=CVE-2007-5000", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-5000", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-5000", }, ], release_date: "2007-12-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "httpd: mod_imagemap XSS", }, { cve: "CVE-2007-6388", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2008-01-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "427228", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "apache mod_status cross-site scripting", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-6388", }, { category: "external", summary: "RHBZ#427228", url: "https://bugzilla.redhat.com/show_bug.cgi?id=427228", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-6388", url: "https://www.cve.org/CVERecord?id=CVE-2007-6388", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-6388", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-6388", }, ], release_date: "2007-12-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "apache mod_status cross-site scripting", }, ], }
rhsa-2004_245
Vulnerability from csaf_redhat
Published
2004-06-14 15:46
Modified
2024-11-21 23:05
Summary
Red Hat Security Advisory: apache, mod_ssl security update
Notes
Topic
Updated httpd and mod_ssl packages that fix minor security issues in
the Apache Web server are now available for Red Hat Enterprise Linux 2.1.
Details
The Apache HTTP Server is a powerful, full-featured, efficient, and
freely-available Web server.
A buffer overflow was found in the Apache proxy module, mod_proxy, which
can be triggered by receiving an invalid Content-Length header. In order
to exploit this issue, an attacker would need an Apache installation
that was configured as a proxy to connect to a malicious site. This would
cause the Apache child processing the request to crash. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2004-0492 to this issue.
On Red Hat Enterprise Linux platforms Red Hat believes this issue cannot
lead to remote code execution. This issue also does not represent a Denial
of Service attack as requests will continue to be handled by other Apache
child processes.
A stack buffer overflow was discovered in mod_ssl which can be triggered if
using the FakeBasicAuth option. If mod_ssl is sent a client certificate
with a subject DN field longer than 6000 characters, a stack overflow can
occur if FakeBasicAuth has been enabled. In order to exploit this issue
the carefully crafted malicious certificate would have to be signed by a
Certificate Authority which mod_ssl is configured to trust. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2004-0488 to this issue.
This update also fixes a DNS handling bug in mod_proxy.
The mod_auth_digest module is now included in the Apache package and should
be used instead of mod_digest for sites requiring Digest authentication.
Red Hat Enterprise Linux 2.1 users of the Apache HTTP Server should upgrade
to these erratum packages, which contains Apache version 1.3.27 with
backported patches correcting these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated httpd and mod_ssl packages that fix minor security issues in\nthe Apache Web server are now available for Red Hat Enterprise Linux 2.1.", title: "Topic", }, { category: "general", text: "The Apache HTTP Server is a powerful, full-featured, efficient, and\nfreely-available Web server.\n\nA buffer overflow was found in the Apache proxy module, mod_proxy, which\ncan be triggered by receiving an invalid Content-Length header. In order\nto exploit this issue, an attacker would need an Apache installation\nthat was configured as a proxy to connect to a malicious site. This would\ncause the Apache child processing the request to crash. The Common\nVulnerabilities and Exposures project (cve.mitre.org) has assigned the name\nCAN-2004-0492 to this issue.\n\nOn Red Hat Enterprise Linux platforms Red Hat believes this issue cannot\nlead to remote code execution. This issue also does not represent a Denial\nof Service attack as requests will continue to be handled by other Apache\nchild processes.\n\nA stack buffer overflow was discovered in mod_ssl which can be triggered if\nusing the FakeBasicAuth option. If mod_ssl is sent a client certificate\nwith a subject DN field longer than 6000 characters, a stack overflow can\noccur if FakeBasicAuth has been enabled. In order to exploit this issue\nthe carefully crafted malicious certificate would have to be signed by a\nCertificate Authority which mod_ssl is configured to trust. The Common\nVulnerabilities and Exposures project (cve.mitre.org) has assigned the name\nCAN-2004-0488 to this issue.\n\nThis update also fixes a DNS handling bug in mod_proxy.\n\nThe mod_auth_digest module is now included in the Apache package and should\nbe used instead of mod_digest for sites requiring Digest authentication.\n\nRed Hat Enterprise Linux 2.1 users of the Apache HTTP Server should upgrade\nto these erratum packages, which contains Apache version 1.3.27 with \nbackported patches correcting these issues.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2004:245", url: "https://access.redhat.com/errata/RHSA-2004:245", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "http://www.apacheweek.com/issues/04-06-11#security", url: "http://www.apacheweek.com/issues/04-06-11#security", }, { category: "external", summary: "122637", url: "https://bugzilla.redhat.com/show_bug.cgi?id=122637", }, { category: "external", summary: "125704", url: "https://bugzilla.redhat.com/show_bug.cgi?id=125704", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2004/rhsa-2004_245.json", }, ], title: "Red Hat Security Advisory: apache, mod_ssl security update", tracking: { current_release_date: "2024-11-21T23:05:23+00:00", generator: { date: "2024-11-21T23:05:23+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2004:245", initial_release_date: "2004-06-14T15:46:00+00:00", revision_history: [ { date: "2004-06-14T15:46:00+00:00", number: "1", summary: "Initial version", }, { date: "2004-06-14T00:00:00+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-21T23:05:23+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", product: { name: "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", product_id: "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:2.1::as", }, }, }, { category: "product_name", name: "Red Hat Linux Advanced Workstation 2.1", product: { name: "Red Hat Linux Advanced Workstation 2.1", product_id: "Red Hat Linux Advanced Workstation 2.1", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:2.1::aw", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux ES version 2.1", product: { name: "Red Hat Enterprise Linux ES version 2.1", product_id: "Red Hat Enterprise Linux ES version 2.1", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:2.1::es", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux WS version 2.1", product: { name: "Red Hat Enterprise Linux WS version 2.1", product_id: "Red Hat Enterprise Linux WS version 2.1", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:2.1::ws", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, ], category: "vendor", name: "Red Hat", }, ], }, vulnerabilities: [ { cve: "CVE-2004-0488", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430867", }, ], notes: [ { category: "description", text: "Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.", title: "Vulnerability description", }, { category: "summary", text: "mod_ssl ssl_util_uuencode_binary CA issue", title: "Vulnerability summary", }, ], product_status: { fixed: [ "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", "Red Hat Enterprise Linux ES version 2.1", "Red Hat Enterprise Linux WS version 2.1", "Red Hat Linux Advanced Workstation 2.1", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0488", }, { category: "external", summary: "RHBZ#430867", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430867", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0488", url: "https://www.cve.org/CVERecord?id=CVE-2004-0488", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0488", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0488", }, ], release_date: "2004-05-17T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2004-06-14T15:46:00+00:00", details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains\nthe desired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.\n\nIf up2date fails to connect to Red Hat Network due to SSL\nCertificate Errors, you need to install a version of the\nup2date client with an updated certificate. The latest version of\nup2date is available from the Red Hat FTP site and may also be\ndownloaded directly from the RHN website:\n\nhttps://rhn.redhat.com/help/latest-up2date.pxt", product_ids: [ "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", "Red Hat Enterprise Linux ES version 2.1", "Red Hat Enterprise Linux WS version 2.1", "Red Hat Linux Advanced Workstation 2.1", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2004:245", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_ssl ssl_util_uuencode_binary CA issue", }, { cve: "CVE-2004-0492", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430527", }, ], notes: [ { category: "description", text: "Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a negative Content-Length HTTP header field, which causes a large amount of data to be copied.", title: "Vulnerability description", }, { category: "summary", text: "httpd mod_proxy buffer overflow", title: "Vulnerability summary", }, ], product_status: { fixed: [ "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", "Red Hat Enterprise Linux ES version 2.1", "Red Hat Enterprise Linux WS version 2.1", "Red Hat Linux Advanced Workstation 2.1", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0492", }, { category: "external", summary: "RHBZ#430527", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430527", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0492", url: "https://www.cve.org/CVERecord?id=CVE-2004-0492", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0492", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0492", }, ], release_date: "2004-06-10T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2004-06-14T15:46:00+00:00", details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains\nthe desired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.\n\nIf up2date fails to connect to Red Hat Network due to SSL\nCertificate Errors, you need to install a version of the\nup2date client with an updated certificate. The latest version of\nup2date is available from the Red Hat FTP site and may also be\ndownloaded directly from the RHN website:\n\nhttps://rhn.redhat.com/help/latest-up2date.pxt", product_ids: [ "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", "Red Hat Enterprise Linux ES version 2.1", "Red Hat Enterprise Linux WS version 2.1", "Red Hat Linux Advanced Workstation 2.1", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2004:245", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "httpd mod_proxy buffer overflow", }, ], }
rhsa-2008:0523
Vulnerability from csaf_redhat
Published
2008-06-30 15:29
Modified
2025-01-26 19:35
Summary
Red Hat Security Advisory: Red Hat Network Proxy Server security update
Notes
Topic
Red Hat Network Proxy Server version 4.2.3 is now available. This update
includes fixes for a number of security issues in Red Hat Network Proxy
Server components.
This update has been rated as having low security impact by the Red
Hat Security Response Team.
Details
The Red Hat Network Proxy Server 4.2.3 release corrects several security
vulnerabilities in several shipped components. In a typical operating
environment, these components are not exposed to users of Proxy Server in a
vulnerable manner. These security updates will reduce risk in unique Proxy
Server environments.
Multiple flaws were fixed in the Apache HTTPD server. These flaws could
result in a cross-site scripting or denial-of-service attack.
(CVE-2007-6388, CVE-2007-5000, CVE-2007-4465, CVE-2007-3304, CVE-2006-5752,
CVE-2006-3918, CVE-2005-3352)
A denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)
Multiple flaws in mod_ssl. (CVE-2004-0488, CVE-2004-0700, CVE-2004-0885)
A denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329)
Users of Red Hat Network Proxy Server 4.2 are advised to upgrade to 4.2.3,
which resolves these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Low", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Red Hat Network Proxy Server version 4.2.3 is now available. This update\nincludes fixes for a number of security issues in Red Hat Network Proxy\nServer components.\n\nThis update has been rated as having low security impact by the Red\nHat Security Response Team.", title: "Topic", }, { category: "general", text: "The Red Hat Network Proxy Server 4.2.3 release corrects several security\nvulnerabilities in several shipped components. In a typical operating\nenvironment, these components are not exposed to users of Proxy Server in a\nvulnerable manner. These security updates will reduce risk in unique Proxy\nServer environments.\n\nMultiple flaws were fixed in the Apache HTTPD server. These flaws could\nresult in a cross-site scripting or denial-of-service attack.\n(CVE-2007-6388, CVE-2007-5000, CVE-2007-4465, CVE-2007-3304, CVE-2006-5752,\nCVE-2006-3918, CVE-2005-3352)\n\nA denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)\n\nMultiple flaws in mod_ssl. (CVE-2004-0488, CVE-2004-0700, CVE-2004-0885)\n\nA denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329)\n\nUsers of Red Hat Network Proxy Server 4.2 are advised to upgrade to 4.2.3,\nwhich resolves these issues.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2008:0523", url: "https://access.redhat.com/errata/RHSA-2008:0523", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#low", url: "https://access.redhat.com/security/updates/classification/#low", }, { category: "external", summary: "449336", url: "https://bugzilla.redhat.com/show_bug.cgi?id=449336", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0523.json", }, ], title: "Red Hat Security Advisory: Red Hat Network Proxy Server security update", tracking: { current_release_date: "2025-01-26T19:35:55+00:00", generator: { date: "2025-01-26T19:35:55+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.6", }, }, id: "RHSA-2008:0523", initial_release_date: "2008-06-30T15:29:00+00:00", revision_history: [ { date: "2008-06-30T15:29:00+00:00", number: "1", summary: "Initial version", }, { date: "2008-06-30T11:32:56+00:00", number: "2", summary: "Last updated version", }, { date: "2025-01-26T19:35:55+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Satellite Proxy v 4.2 (RHEL v.3 AS)", product: { name: "Red Hat Satellite Proxy v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNPROXY4.2", product_identification_helper: { cpe: "cpe:/a:redhat:network_proxy:4.2::el3", }, }, }, { category: "product_name", name: "Red Hat Satellite Proxy v 4.2 (RHEL v.4 AS)", product: { name: "Red Hat Satellite Proxy v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNPROXY4.2", product_identification_helper: { cpe: "cpe:/a:redhat:network_proxy:4.2::el4", }, }, }, ], category: "product_family", name: "Red Hat Satellite Proxy", }, { branches: [ { category: "product_version", name: "jabberd-0:2.0s10-3.37.rhn.i386", product: { name: "jabberd-0:2.0s10-3.37.rhn.i386", product_id: "jabberd-0:2.0s10-3.37.rhn.i386", product_identification_helper: { purl: "pkg:rpm/redhat/jabberd@2.0s10-3.37.rhn?arch=i386", }, }, }, { category: "product_version", name: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386", product: { name: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386", product_id: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-apache@1.3.27-36.rhn.rhel3?arch=i386", }, }, }, { category: "product_version", name: "rhn-modperl-0:1.29-16.rhel3.i386", product: { name: "rhn-modperl-0:1.29-16.rhel3.i386", product_id: "rhn-modperl-0:1.29-16.rhel3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modperl@1.29-16.rhel3?arch=i386", }, }, }, { category: "product_version", name: "jabberd-0:2.0s10-3.38.rhn.i386", product: { name: "jabberd-0:2.0s10-3.38.rhn.i386", product_id: "jabberd-0:2.0s10-3.38.rhn.i386", product_identification_helper: { purl: "pkg:rpm/redhat/jabberd@2.0s10-3.38.rhn?arch=i386", }, }, }, { category: "product_version", name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product: { name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product_id: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-apache@1.3.27-36.rhn.rhel4?arch=i386", }, }, }, { category: "product_version", name: "rhn-modperl-0:1.29-16.rhel4.i386", product: { name: "rhn-modperl-0:1.29-16.rhel4.i386", product_id: "rhn-modperl-0:1.29-16.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modperl@1.29-16.rhel4?arch=i386", }, }, }, ], category: "architecture", name: "i386", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "jabberd-0:2.0s10-3.37.rhn.i386 as a component of Red Hat Satellite Proxy v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", }, product_reference: "jabberd-0:2.0s10-3.37.rhn.i386", relates_to_product_reference: "3AS-RHNPROXY4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386 as a component of Red Hat Satellite Proxy v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", }, product_reference: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386", relates_to_product_reference: "3AS-RHNPROXY4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-modperl-0:1.29-16.rhel3.i386 as a component of Red Hat Satellite Proxy v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", }, product_reference: "rhn-modperl-0:1.29-16.rhel3.i386", relates_to_product_reference: "3AS-RHNPROXY4.2", }, { category: "default_component_of", full_product_name: { name: "jabberd-0:2.0s10-3.38.rhn.i386 as a component of Red Hat Satellite Proxy v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", }, product_reference: "jabberd-0:2.0s10-3.38.rhn.i386", relates_to_product_reference: "4AS-RHNPROXY4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386 as a component of Red Hat Satellite Proxy v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", }, product_reference: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", relates_to_product_reference: "4AS-RHNPROXY4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-modperl-0:1.29-16.rhel4.i386 as a component of Red Hat Satellite Proxy v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", }, product_reference: "rhn-modperl-0:1.29-16.rhel4.i386", relates_to_product_reference: "4AS-RHNPROXY4.2", }, ], }, vulnerabilities: [ { cve: "CVE-2004-0488", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430867", }, ], notes: [ { category: "description", text: "Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.", title: "Vulnerability description", }, { category: "summary", text: "mod_ssl ssl_util_uuencode_binary CA issue", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0488", }, { category: "external", summary: "RHBZ#430867", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430867", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0488", url: "https://www.cve.org/CVERecord?id=CVE-2004-0488", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0488", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0488", }, ], release_date: "2004-05-17T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_ssl ssl_util_uuencode_binary CA issue", }, { cve: "CVE-2004-0700", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430866", }, ], notes: [ { category: "description", text: "Format string vulnerability in the mod_proxy hook functions function in ssl_engine_log.c in mod_ssl before 2.8.19 for Apache before 1.3.31 may allow remote attackers to execute arbitrary messages via format string specifiers in certain log messages for HTTPS that are handled by the ssl_log function.", title: "Vulnerability description", }, { category: "summary", text: "mod_proxy hook format string", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0700", }, { category: "external", summary: "RHBZ#430866", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430866", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0700", url: "https://www.cve.org/CVERecord?id=CVE-2004-0700", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0700", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0700", }, ], release_date: "2004-07-16T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "mod_proxy hook format string", }, { cve: "CVE-2004-0885", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430637", }, ], notes: [ { category: "description", text: "The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the \"SSLCipherSuite\" directive in directory or location context, allows remote clients to bypass intended restrictions by using any cipher suite that is allowed by the virtual host configuration.", title: "Vulnerability description", }, { category: "summary", text: "mod_ssl SSLCipherSuite bypass", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0885", }, { category: "external", summary: "RHBZ#430637", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430637", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0885", url: "https://www.cve.org/CVERecord?id=CVE-2004-0885", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0885", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0885", }, ], release_date: "2004-10-05T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_ssl SSLCipherSuite bypass", }, { cve: "CVE-2005-3352", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2005-12-12T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430524", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in the mod_imap module of Apache httpd before 1.3.35-dev and Apache httpd 2.0.x before 2.0.56-dev allows remote attackers to inject arbitrary web script or HTML via the Referer when using image maps.", title: "Vulnerability description", }, { category: "summary", text: "httpd cross-site scripting flaw in mod_imap", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-3352", }, { category: "external", summary: "RHBZ#430524", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430524", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-3352", url: "https://www.cve.org/CVERecord?id=CVE-2005-3352", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-3352", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-3352", }, ], release_date: "2005-12-12T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd cross-site scripting flaw in mod_imap", }, { cve: "CVE-2006-1329", ids: [ { system_name: "Red Hat Bugzilla ID", text: "429254", }, ], notes: [ { category: "description", text: "The SASL negotiation in Jabber Studio jabberd before 2.0s11 allows remote attackers to cause a denial of service (\"c2s segfault\") by sending a \"response stanza before an auth stanza\".", title: "Vulnerability description", }, { category: "summary", text: "jabberd SASL DoS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-1329", }, { category: "external", summary: "RHBZ#429254", url: "https://bugzilla.redhat.com/show_bug.cgi?id=429254", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-1329", url: "https://www.cve.org/CVERecord?id=CVE-2006-1329", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-1329", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-1329", }, ], release_date: "2006-03-09T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "jabberd SASL DoS", }, { cve: "CVE-2006-3918", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2006-07-31T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "200732", }, ], notes: [ { category: "description", text: "http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.", title: "Vulnerability description", }, { category: "summary", text: "httpd: Expect header XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-3918", }, { category: "external", summary: "RHBZ#200732", url: "https://bugzilla.redhat.com/show_bug.cgi?id=200732", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-3918", url: "https://www.cve.org/CVERecord?id=CVE-2006-3918", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-3918", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-3918", }, ], release_date: "2006-05-08T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd: Expect header XSS", }, { cve: "CVE-2006-5752", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-06-20T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245112", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform \"charset detection\" when the content-type is not specified.", title: "Vulnerability description", }, { category: "summary", text: "httpd mod_status XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-5752", }, { category: "external", summary: "RHBZ#245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-5752", url: "https://www.cve.org/CVERecord?id=CVE-2006-5752", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", }, ], release_date: "2007-06-20T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd mod_status XSS", }, { cve: "CVE-2007-1349", discovery_date: "2007-05-17T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "240423", }, ], notes: [ { category: "description", text: "PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.", title: "Vulnerability description", }, { category: "summary", text: "mod_perl PerlRun denial of service", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1349", }, { category: "external", summary: "RHBZ#240423", url: "https://bugzilla.redhat.com/show_bug.cgi?id=240423", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1349", url: "https://www.cve.org/CVERecord?id=CVE-2007-1349", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1349", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1349", }, ], release_date: "2007-03-22T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_perl PerlRun denial of service", }, { cve: "CVE-2007-3304", discovery_date: "2007-06-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245111", }, ], notes: [ { category: "description", text: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"", title: "Vulnerability description", }, { category: "summary", text: "httpd scoreboard lack of PID protection", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3304", }, { category: "external", summary: "RHBZ#245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3304", url: "https://www.cve.org/CVERecord?id=CVE-2007-3304", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", }, ], release_date: "2007-06-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd scoreboard lack of PID protection", }, { cve: "CVE-2007-4465", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-09-13T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "289511", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that this issue is due to a design limitation of browsers that attempt to perform automatic content type detection.", title: "Vulnerability description", }, { category: "summary", text: "mod_autoindex XSS", title: "Vulnerability summary", }, { category: "other", text: "This is actually a flaw in browsers that do not derive the response character set as required by RFC 2616. This does not affect the default configuration of Apache httpd in Red Hat products and will only affect customers who have removed the \"AddDefaultCharset\" directive and are using directory indexes. The Red Hat Product Security has rated this issue as having low security impact, a future update may address this flaw.", title: "Statement", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-4465", }, { category: "external", summary: "RHBZ#289511", url: "https://bugzilla.redhat.com/show_bug.cgi?id=289511", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-4465", url: "https://www.cve.org/CVERecord?id=CVE-2007-4465", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-4465", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-4465", }, ], release_date: "2007-09-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "mod_autoindex XSS", }, { cve: "CVE-2007-5000", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-12-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "419931", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "httpd: mod_imagemap XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-5000", }, { category: "external", summary: "RHBZ#419931", url: "https://bugzilla.redhat.com/show_bug.cgi?id=419931", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-5000", url: "https://www.cve.org/CVERecord?id=CVE-2007-5000", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-5000", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-5000", }, ], release_date: "2007-12-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "httpd: mod_imagemap XSS", }, { cve: "CVE-2007-6388", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2008-01-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "427228", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "apache mod_status cross-site scripting", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-6388", }, { category: "external", summary: "RHBZ#427228", url: "https://bugzilla.redhat.com/show_bug.cgi?id=427228", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-6388", url: "https://www.cve.org/CVERecord?id=CVE-2007-6388", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-6388", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-6388", }, ], release_date: "2007-12-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "apache mod_status cross-site scripting", }, ], }
rhsa-2004_405
Vulnerability from csaf_redhat
Published
2004-07-23 09:26
Modified
2024-11-21 23:08
Summary
Red Hat Security Advisory: apache, mod_ssl, php security update for Stronghold
Notes
Topic
Updated versions of cross-platform Stronghold that fix security issues in
mod_ssl, PHP, and the Apache HTTP Server are now available.
Details
Stronghold 4 contains a number of open source technologies, including
PHP, mod_ssl and the Apache HTTP Server.
Stefan Esser discovered a flaw when the memory_limit configuration setting
was enabled in PHP 4 versions prior to 4.3.8. If a remote attacker could
force the PHP interpreter to allocate more memory than the memory_limit
setting before script execution begins, then the attacker may be able to
supply the contents of a PHP hash table remotely. This hash table could
then be used to execute arbitrary code as the 'apache' user. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2004-0594 to this issue.
It may be possible to exploit this issue if using a non-default PHP
configuration with the "register_defaults" setting is changed to "On". Red
Hat does not believe that this flaw is exploitable in the default
configuration of Stronghold 4.
Stefan Esser discovered a flaw in the strip_tags function in versions of
PHP prior to 4.3.8. The strip_tags function is commonly used by PHP scripts
to prevent cross-site scripting attacks by removing HTML tags from
user-supplied form data. By embedding NUL bytes into form data, HTML tags
can in some cases be passed intact through the strip_tags function, which
may allow a cross-site scripting attack. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CAN-2004-0595 to
this issue.
A stack buffer overflow was discovered in mod_ssl which can be triggered if
using the FakeBasicAuth option. If mod_ssl is sent a client certificate
with a subject DN field longer than 6000 characters, a stack overflow can
occur if FakeBasicAuth has been enabled. In order to exploit this issue,
the carefully crafted malicious certificate would have to be signed by a
Certificate Authority which mod_ssl is configured to trust. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2004-0488 to this issue.
A format string issue was discovered in mod_ssl which can be triggered if
mod_ssl is configured to allow a client to proxy to remote SSL sites.
If mod_ssl is forced to connect to a remote SSL server using a
carefully crafted hostname, an attacker may be able to crash an Apache
child process. This issue is not known to allow arbitrary execution of
code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2004-0700 to this issue.
A denial of service issue was discovered which affects versions of the
Apache HTTP Server prior to 1.3.30. On some platforms, when Apache is
configured with multiple listening sockets, a short-lived connection to
one socket may temporarily block new connections to other sockets. This
issue does not affect Stronghold if running on Linux, FreeBSD or HP-UX
platforms. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2004-0174 to this issue.
Users of Stronghold 4 cross-platform are advised to update to these errata
versions, which contain backported security fixes and are not vulnerable to
these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated versions of cross-platform Stronghold that fix security issues in\nmod_ssl, PHP, and the Apache HTTP Server are now available.", title: "Topic", }, { category: "general", text: "Stronghold 4 contains a number of open source technologies, including\nPHP, mod_ssl and the Apache HTTP Server.\n\nStefan Esser discovered a flaw when the memory_limit configuration setting\nwas enabled in PHP 4 versions prior to 4.3.8. If a remote attacker could\nforce the PHP interpreter to allocate more memory than the memory_limit\nsetting before script execution begins, then the attacker may be able to\nsupply the contents of a PHP hash table remotely. This hash table could\nthen be used to execute arbitrary code as the 'apache' user. The Common\nVulnerabilities and Exposures project (cve.mitre.org) has assigned the name\nCAN-2004-0594 to this issue.\n\nIt may be possible to exploit this issue if using a non-default PHP\nconfiguration with the \"register_defaults\" setting is changed to \"On\". Red\nHat does not believe that this flaw is exploitable in the default\nconfiguration of Stronghold 4.\n\nStefan Esser discovered a flaw in the strip_tags function in versions of\nPHP prior to 4.3.8. The strip_tags function is commonly used by PHP scripts\nto prevent cross-site scripting attacks by removing HTML tags from\nuser-supplied form data. By embedding NUL bytes into form data, HTML tags\ncan in some cases be passed intact through the strip_tags function, which\nmay allow a cross-site scripting attack. The Common Vulnerabilities and\nExposures project (cve.mitre.org) has assigned the name CAN-2004-0595 to\nthis issue.\n\nA stack buffer overflow was discovered in mod_ssl which can be triggered if\nusing the FakeBasicAuth option. If mod_ssl is sent a client certificate\nwith a subject DN field longer than 6000 characters, a stack overflow can\noccur if FakeBasicAuth has been enabled. In order to exploit this issue,\nthe carefully crafted malicious certificate would have to be signed by a\nCertificate Authority which mod_ssl is configured to trust. The Common\nVulnerabilities and Exposures project (cve.mitre.org) has assigned the name\nCAN-2004-0488 to this issue.\n\nA format string issue was discovered in mod_ssl which can be triggered if \nmod_ssl is configured to allow a client to proxy to remote SSL sites. \nIf mod_ssl is forced to connect to a remote SSL server using a\ncarefully crafted hostname, an attacker may be able to crash an Apache\nchild process. This issue is not known to allow arbitrary execution of\ncode. The Common Vulnerabilities and Exposures project (cve.mitre.org) has\nassigned the name CAN-2004-0700 to this issue.\n\nA denial of service issue was discovered which affects versions of the\nApache HTTP Server prior to 1.3.30. On some platforms, when Apache is\nconfigured with multiple listening sockets, a short-lived connection to\none socket may temporarily block new connections to other sockets. This\nissue does not affect Stronghold if running on Linux, FreeBSD or HP-UX\nplatforms. The Common Vulnerabilities and Exposures project\n(cve.mitre.org) has assigned the name CAN-2004-0174 to this issue.\n\nUsers of Stronghold 4 cross-platform are advised to update to these errata\nversions, which contain backported security fixes and are not vulnerable to\nthese issues.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2004:405", url: "https://access.redhat.com/errata/RHSA-2004:405", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "127703", url: "https://bugzilla.redhat.com/show_bug.cgi?id=127703", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2004/rhsa-2004_405.json", }, ], title: "Red Hat Security Advisory: apache, mod_ssl, php security update for Stronghold", tracking: { current_release_date: "2024-11-21T23:08:43+00:00", generator: { date: "2024-11-21T23:08:43+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2004:405", initial_release_date: "2004-07-23T09:26:00+00:00", revision_history: [ { date: "2004-07-23T09:26:00+00:00", number: "1", summary: "Initial version", }, { date: "2004-07-23T00:00:00+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-21T23:08:43+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Stronghold 4", product: { name: "Red Hat Stronghold 4", product_id: "Red Hat Stronghold 4", product_identification_helper: { cpe: "cpe:/a:redhat:stronghold:4", }, }, }, ], category: "product_family", name: "Stronghold Cross Platform", }, ], category: "vendor", name: "Red Hat", }, ], }, vulnerabilities: [ { cve: "CVE-2004-0174", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1617165", }, ], notes: [ { category: "description", text: "Apache 1.4.x before 1.3.30, and 2.0.x before 2.0.49, when using multiple listening sockets on certain platforms, allows remote attackers to cause a denial of service (blocked new connections) via a \"short-lived connection on a rarely-accessed listening socket.\"", title: "Vulnerability description", }, { category: "summary", text: "security flaw", title: "Vulnerability summary", }, { category: "other", text: "Not vulnerable. This issue did not affect Linux.", title: "Statement", }, ], product_status: { fixed: [ "Red Hat Stronghold 4", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0174", }, { category: "external", summary: "RHBZ#1617165", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1617165", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0174", url: "https://www.cve.org/CVERecord?id=CVE-2004-0174", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0174", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0174", }, ], release_date: "2004-03-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2004-07-23T09:26:00+00:00", details: "Updated Stronghold 4 packages are now available via the update agent\nservice. Run the following command from the Stronghold 4 install root to\nupgrade an existing Stronghold 4 installation to the new package versions:\n\n$ bin/agent\n\nThe Stronghold 4.0i patch release which contains these updated packages is\nalso available from the download site.\n\nAfter upgrading Stronghold, the server must be completely restarted by\nrunning the following commands from the install root:\n\n$ bin/stop-server\n$ bin/start-server\n\nFor more information on how to upgrade between releases of Stronghold 4,\nrefer to http://stronghold.redhat.com/support/upgrade-sh4", product_ids: [ "Red Hat Stronghold 4", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2004:405", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "security flaw", }, { cve: "CVE-2004-0488", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430867", }, ], notes: [ { category: "description", text: "Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.", title: "Vulnerability description", }, { category: "summary", text: "mod_ssl ssl_util_uuencode_binary CA issue", title: "Vulnerability summary", }, ], product_status: { fixed: [ "Red Hat Stronghold 4", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0488", }, { category: "external", summary: "RHBZ#430867", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430867", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0488", url: "https://www.cve.org/CVERecord?id=CVE-2004-0488", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0488", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0488", }, ], release_date: "2004-05-17T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2004-07-23T09:26:00+00:00", details: "Updated Stronghold 4 packages are now available via the update agent\nservice. Run the following command from the Stronghold 4 install root to\nupgrade an existing Stronghold 4 installation to the new package versions:\n\n$ bin/agent\n\nThe Stronghold 4.0i patch release which contains these updated packages is\nalso available from the download site.\n\nAfter upgrading Stronghold, the server must be completely restarted by\nrunning the following commands from the install root:\n\n$ bin/stop-server\n$ bin/start-server\n\nFor more information on how to upgrade between releases of Stronghold 4,\nrefer to http://stronghold.redhat.com/support/upgrade-sh4", product_ids: [ "Red Hat Stronghold 4", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2004:405", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_ssl ssl_util_uuencode_binary CA issue", }, { cve: "CVE-2004-0594", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1617233", }, ], notes: [ { category: "description", text: "The memory_limit functionality in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, under certain conditions such as when register_globals is enabled, allows remote attackers to execute arbitrary code by triggering a memory_limit abort during execution of the zend_hash_init function and overwriting a HashTable destructor pointer before the initialization of key data structures is complete.", title: "Vulnerability description", }, { category: "summary", text: "security flaw", title: "Vulnerability summary", }, ], product_status: { fixed: [ "Red Hat Stronghold 4", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0594", }, { category: "external", summary: "RHBZ#1617233", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1617233", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0594", url: "https://www.cve.org/CVERecord?id=CVE-2004-0594", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0594", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0594", }, ], release_date: "2004-07-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2004-07-23T09:26:00+00:00", details: "Updated Stronghold 4 packages are now available via the update agent\nservice. Run the following command from the Stronghold 4 install root to\nupgrade an existing Stronghold 4 installation to the new package versions:\n\n$ bin/agent\n\nThe Stronghold 4.0i patch release which contains these updated packages is\nalso available from the download site.\n\nAfter upgrading Stronghold, the server must be completely restarted by\nrunning the following commands from the install root:\n\n$ bin/stop-server\n$ bin/start-server\n\nFor more information on how to upgrade between releases of Stronghold 4,\nrefer to http://stronghold.redhat.com/support/upgrade-sh4", product_ids: [ "Red Hat Stronghold 4", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2004:405", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "security flaw", }, { cve: "CVE-2004-0595", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1617234", }, ], notes: [ { category: "description", text: "The strip_tags function in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, does not filter null (\\0) characters within tag names when restricting input to allowed tags, which allows dangerous tags to be processed by web browsers such as Internet Explorer and Safari, which ignore null characters and facilitate the exploitation of cross-site scripting (XSS) vulnerabilities.", title: "Vulnerability description", }, { category: "summary", text: "security flaw", title: "Vulnerability summary", }, ], product_status: { fixed: [ "Red Hat Stronghold 4", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0595", }, { category: "external", summary: "RHBZ#1617234", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1617234", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0595", url: "https://www.cve.org/CVERecord?id=CVE-2004-0595", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0595", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0595", }, ], release_date: "2004-07-14T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2004-07-23T09:26:00+00:00", details: "Updated Stronghold 4 packages are now available via the update agent\nservice. Run the following command from the Stronghold 4 install root to\nupgrade an existing Stronghold 4 installation to the new package versions:\n\n$ bin/agent\n\nThe Stronghold 4.0i patch release which contains these updated packages is\nalso available from the download site.\n\nAfter upgrading Stronghold, the server must be completely restarted by\nrunning the following commands from the install root:\n\n$ bin/stop-server\n$ bin/start-server\n\nFor more information on how to upgrade between releases of Stronghold 4,\nrefer to http://stronghold.redhat.com/support/upgrade-sh4", product_ids: [ "Red Hat Stronghold 4", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2004:405", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "security flaw", }, { cve: "CVE-2004-0700", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430866", }, ], notes: [ { category: "description", text: "Format string vulnerability in the mod_proxy hook functions function in ssl_engine_log.c in mod_ssl before 2.8.19 for Apache before 1.3.31 may allow remote attackers to execute arbitrary messages via format string specifiers in certain log messages for HTTPS that are handled by the ssl_log function.", title: "Vulnerability description", }, { category: "summary", text: "mod_proxy hook format string", title: "Vulnerability summary", }, ], product_status: { fixed: [ "Red Hat Stronghold 4", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0700", }, { category: "external", summary: "RHBZ#430866", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430866", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0700", url: "https://www.cve.org/CVERecord?id=CVE-2004-0700", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0700", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0700", }, ], release_date: "2004-07-16T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2004-07-23T09:26:00+00:00", details: "Updated Stronghold 4 packages are now available via the update agent\nservice. Run the following command from the Stronghold 4 install root to\nupgrade an existing Stronghold 4 installation to the new package versions:\n\n$ bin/agent\n\nThe Stronghold 4.0i patch release which contains these updated packages is\nalso available from the download site.\n\nAfter upgrading Stronghold, the server must be completely restarted by\nrunning the following commands from the install root:\n\n$ bin/stop-server\n$ bin/start-server\n\nFor more information on how to upgrade between releases of Stronghold 4,\nrefer to http://stronghold.redhat.com/support/upgrade-sh4", product_ids: [ "Red Hat Stronghold 4", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2004:405", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "mod_proxy hook format string", }, ], }
RHSA-2008:0523
Vulnerability from csaf_redhat
Published
2008-06-30 15:29
Modified
2025-01-26 19:35
Summary
Red Hat Security Advisory: Red Hat Network Proxy Server security update
Notes
Topic
Red Hat Network Proxy Server version 4.2.3 is now available. This update
includes fixes for a number of security issues in Red Hat Network Proxy
Server components.
This update has been rated as having low security impact by the Red
Hat Security Response Team.
Details
The Red Hat Network Proxy Server 4.2.3 release corrects several security
vulnerabilities in several shipped components. In a typical operating
environment, these components are not exposed to users of Proxy Server in a
vulnerable manner. These security updates will reduce risk in unique Proxy
Server environments.
Multiple flaws were fixed in the Apache HTTPD server. These flaws could
result in a cross-site scripting or denial-of-service attack.
(CVE-2007-6388, CVE-2007-5000, CVE-2007-4465, CVE-2007-3304, CVE-2006-5752,
CVE-2006-3918, CVE-2005-3352)
A denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)
Multiple flaws in mod_ssl. (CVE-2004-0488, CVE-2004-0700, CVE-2004-0885)
A denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329)
Users of Red Hat Network Proxy Server 4.2 are advised to upgrade to 4.2.3,
which resolves these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Low", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Red Hat Network Proxy Server version 4.2.3 is now available. This update\nincludes fixes for a number of security issues in Red Hat Network Proxy\nServer components.\n\nThis update has been rated as having low security impact by the Red\nHat Security Response Team.", title: "Topic", }, { category: "general", text: "The Red Hat Network Proxy Server 4.2.3 release corrects several security\nvulnerabilities in several shipped components. In a typical operating\nenvironment, these components are not exposed to users of Proxy Server in a\nvulnerable manner. These security updates will reduce risk in unique Proxy\nServer environments.\n\nMultiple flaws were fixed in the Apache HTTPD server. These flaws could\nresult in a cross-site scripting or denial-of-service attack.\n(CVE-2007-6388, CVE-2007-5000, CVE-2007-4465, CVE-2007-3304, CVE-2006-5752,\nCVE-2006-3918, CVE-2005-3352)\n\nA denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)\n\nMultiple flaws in mod_ssl. (CVE-2004-0488, CVE-2004-0700, CVE-2004-0885)\n\nA denial-of-service flaw was fixed in the jabberd server. (CVE-2006-1329)\n\nUsers of Red Hat Network Proxy Server 4.2 are advised to upgrade to 4.2.3,\nwhich resolves these issues.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2008:0523", url: "https://access.redhat.com/errata/RHSA-2008:0523", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#low", url: "https://access.redhat.com/security/updates/classification/#low", }, { category: "external", summary: "449336", url: "https://bugzilla.redhat.com/show_bug.cgi?id=449336", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0523.json", }, ], title: "Red Hat Security Advisory: Red Hat Network Proxy Server security update", tracking: { current_release_date: "2025-01-26T19:35:55+00:00", generator: { date: "2025-01-26T19:35:55+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.6", }, }, id: "RHSA-2008:0523", initial_release_date: "2008-06-30T15:29:00+00:00", revision_history: [ { date: "2008-06-30T15:29:00+00:00", number: "1", summary: "Initial version", }, { date: "2008-06-30T11:32:56+00:00", number: "2", summary: "Last updated version", }, { date: "2025-01-26T19:35:55+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Satellite Proxy v 4.2 (RHEL v.3 AS)", product: { name: "Red Hat Satellite Proxy v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNPROXY4.2", product_identification_helper: { cpe: "cpe:/a:redhat:network_proxy:4.2::el3", }, }, }, { category: "product_name", name: "Red Hat Satellite Proxy v 4.2 (RHEL v.4 AS)", product: { name: "Red Hat Satellite Proxy v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNPROXY4.2", product_identification_helper: { cpe: "cpe:/a:redhat:network_proxy:4.2::el4", }, }, }, ], category: "product_family", name: "Red Hat Satellite Proxy", }, { branches: [ { category: "product_version", name: "jabberd-0:2.0s10-3.37.rhn.i386", product: { name: "jabberd-0:2.0s10-3.37.rhn.i386", product_id: "jabberd-0:2.0s10-3.37.rhn.i386", product_identification_helper: { purl: "pkg:rpm/redhat/jabberd@2.0s10-3.37.rhn?arch=i386", }, }, }, { category: "product_version", name: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386", product: { name: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386", product_id: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-apache@1.3.27-36.rhn.rhel3?arch=i386", }, }, }, { category: "product_version", name: "rhn-modperl-0:1.29-16.rhel3.i386", product: { name: "rhn-modperl-0:1.29-16.rhel3.i386", product_id: "rhn-modperl-0:1.29-16.rhel3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modperl@1.29-16.rhel3?arch=i386", }, }, }, { category: "product_version", name: "jabberd-0:2.0s10-3.38.rhn.i386", product: { name: "jabberd-0:2.0s10-3.38.rhn.i386", product_id: "jabberd-0:2.0s10-3.38.rhn.i386", product_identification_helper: { purl: "pkg:rpm/redhat/jabberd@2.0s10-3.38.rhn?arch=i386", }, }, }, { category: "product_version", name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product: { name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product_id: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-apache@1.3.27-36.rhn.rhel4?arch=i386", }, }, }, { category: "product_version", name: "rhn-modperl-0:1.29-16.rhel4.i386", product: { name: "rhn-modperl-0:1.29-16.rhel4.i386", product_id: "rhn-modperl-0:1.29-16.rhel4.i386", product_identification_helper: { purl: "pkg:rpm/redhat/rhn-modperl@1.29-16.rhel4?arch=i386", }, }, }, ], category: "architecture", name: "i386", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "jabberd-0:2.0s10-3.37.rhn.i386 as a component of Red Hat Satellite Proxy v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", }, product_reference: "jabberd-0:2.0s10-3.37.rhn.i386", relates_to_product_reference: "3AS-RHNPROXY4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386 as a component of Red Hat Satellite Proxy v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", }, product_reference: "rhn-apache-0:1.3.27-36.rhn.rhel3.i386", relates_to_product_reference: "3AS-RHNPROXY4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-modperl-0:1.29-16.rhel3.i386 as a component of Red Hat Satellite Proxy v 4.2 (RHEL v.3 AS)", product_id: "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", }, product_reference: "rhn-modperl-0:1.29-16.rhel3.i386", relates_to_product_reference: "3AS-RHNPROXY4.2", }, { category: "default_component_of", full_product_name: { name: "jabberd-0:2.0s10-3.38.rhn.i386 as a component of Red Hat Satellite Proxy v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", }, product_reference: "jabberd-0:2.0s10-3.38.rhn.i386", relates_to_product_reference: "4AS-RHNPROXY4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386 as a component of Red Hat Satellite Proxy v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", }, product_reference: "rhn-apache-0:1.3.27-36.rhn.rhel4.i386", relates_to_product_reference: "4AS-RHNPROXY4.2", }, { category: "default_component_of", full_product_name: { name: "rhn-modperl-0:1.29-16.rhel4.i386 as a component of Red Hat Satellite Proxy v 4.2 (RHEL v.4 AS)", product_id: "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", }, product_reference: "rhn-modperl-0:1.29-16.rhel4.i386", relates_to_product_reference: "4AS-RHNPROXY4.2", }, ], }, vulnerabilities: [ { cve: "CVE-2004-0488", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430867", }, ], notes: [ { category: "description", text: "Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.", title: "Vulnerability description", }, { category: "summary", text: "mod_ssl ssl_util_uuencode_binary CA issue", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0488", }, { category: "external", summary: "RHBZ#430867", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430867", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0488", url: "https://www.cve.org/CVERecord?id=CVE-2004-0488", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0488", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0488", }, ], release_date: "2004-05-17T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_ssl ssl_util_uuencode_binary CA issue", }, { cve: "CVE-2004-0700", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430866", }, ], notes: [ { category: "description", text: "Format string vulnerability in the mod_proxy hook functions function in ssl_engine_log.c in mod_ssl before 2.8.19 for Apache before 1.3.31 may allow remote attackers to execute arbitrary messages via format string specifiers in certain log messages for HTTPS that are handled by the ssl_log function.", title: "Vulnerability description", }, { category: "summary", text: "mod_proxy hook format string", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0700", }, { category: "external", summary: "RHBZ#430866", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430866", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0700", url: "https://www.cve.org/CVERecord?id=CVE-2004-0700", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0700", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0700", }, ], release_date: "2004-07-16T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "mod_proxy hook format string", }, { cve: "CVE-2004-0885", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430637", }, ], notes: [ { category: "description", text: "The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the \"SSLCipherSuite\" directive in directory or location context, allows remote clients to bypass intended restrictions by using any cipher suite that is allowed by the virtual host configuration.", title: "Vulnerability description", }, { category: "summary", text: "mod_ssl SSLCipherSuite bypass", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0885", }, { category: "external", summary: "RHBZ#430637", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430637", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0885", url: "https://www.cve.org/CVERecord?id=CVE-2004-0885", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0885", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0885", }, ], release_date: "2004-10-05T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_ssl SSLCipherSuite bypass", }, { cve: "CVE-2005-3352", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2005-12-12T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430524", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in the mod_imap module of Apache httpd before 1.3.35-dev and Apache httpd 2.0.x before 2.0.56-dev allows remote attackers to inject arbitrary web script or HTML via the Referer when using image maps.", title: "Vulnerability description", }, { category: "summary", text: "httpd cross-site scripting flaw in mod_imap", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2005-3352", }, { category: "external", summary: "RHBZ#430524", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430524", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2005-3352", url: "https://www.cve.org/CVERecord?id=CVE-2005-3352", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2005-3352", url: "https://nvd.nist.gov/vuln/detail/CVE-2005-3352", }, ], release_date: "2005-12-12T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd cross-site scripting flaw in mod_imap", }, { cve: "CVE-2006-1329", ids: [ { system_name: "Red Hat Bugzilla ID", text: "429254", }, ], notes: [ { category: "description", text: "The SASL negotiation in Jabber Studio jabberd before 2.0s11 allows remote attackers to cause a denial of service (\"c2s segfault\") by sending a \"response stanza before an auth stanza\".", title: "Vulnerability description", }, { category: "summary", text: "jabberd SASL DoS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-1329", }, { category: "external", summary: "RHBZ#429254", url: "https://bugzilla.redhat.com/show_bug.cgi?id=429254", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-1329", url: "https://www.cve.org/CVERecord?id=CVE-2006-1329", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-1329", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-1329", }, ], release_date: "2006-03-09T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "jabberd SASL DoS", }, { cve: "CVE-2006-3918", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2006-07-31T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "200732", }, ], notes: [ { category: "description", text: "http_protocol.c in (1) IBM HTTP Server 6.0 before 6.0.2.13 and 6.1 before 6.1.0.1, and (2) Apache HTTP Server 1.3 before 1.3.35, 2.0 before 2.0.58, and 2.2 before 2.2.2, does not sanitize the Expect header from an HTTP request when it is reflected back in an error message, which might allow cross-site scripting (XSS) style attacks using web client components that can send arbitrary headers in requests, as demonstrated using a Flash SWF file.", title: "Vulnerability description", }, { category: "summary", text: "httpd: Expect header XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-3918", }, { category: "external", summary: "RHBZ#200732", url: "https://bugzilla.redhat.com/show_bug.cgi?id=200732", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-3918", url: "https://www.cve.org/CVERecord?id=CVE-2006-3918", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-3918", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-3918", }, ], release_date: "2006-05-08T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd: Expect header XSS", }, { cve: "CVE-2006-5752", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-06-20T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245112", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status.c in the mod_status module in Apache HTTP Server (httpd), when ExtendedStatus is enabled and a public server-status page is used, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving charsets with browsers that perform \"charset detection\" when the content-type is not specified.", title: "Vulnerability description", }, { category: "summary", text: "httpd mod_status XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2006-5752", }, { category: "external", summary: "RHBZ#245112", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245112", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2006-5752", url: "https://www.cve.org/CVERecord?id=CVE-2006-5752", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", url: "https://nvd.nist.gov/vuln/detail/CVE-2006-5752", }, ], release_date: "2007-06-20T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd mod_status XSS", }, { cve: "CVE-2007-1349", discovery_date: "2007-05-17T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "240423", }, ], notes: [ { category: "description", text: "PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.", title: "Vulnerability description", }, { category: "summary", text: "mod_perl PerlRun denial of service", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-1349", }, { category: "external", summary: "RHBZ#240423", url: "https://bugzilla.redhat.com/show_bug.cgi?id=240423", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-1349", url: "https://www.cve.org/CVERecord?id=CVE-2007-1349", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-1349", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-1349", }, ], release_date: "2007-03-22T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_perl PerlRun denial of service", }, { cve: "CVE-2007-3304", discovery_date: "2007-06-19T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "245111", }, ], notes: [ { category: "description", text: "Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka \"SIGUSR1 killer.\"", title: "Vulnerability description", }, { category: "summary", text: "httpd scoreboard lack of PID protection", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-3304", }, { category: "external", summary: "RHBZ#245111", url: "https://bugzilla.redhat.com/show_bug.cgi?id=245111", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-3304", url: "https://www.cve.org/CVERecord?id=CVE-2007-3304", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-3304", }, ], release_date: "2007-06-19T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "httpd scoreboard lack of PID protection", }, { cve: "CVE-2007-4465", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-09-13T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "289511", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_autoindex.c in the Apache HTTP Server before 2.2.6, when the charset on a server-generated page is not defined, allows remote attackers to inject arbitrary web script or HTML via the P parameter using the UTF-7 charset. NOTE: it could be argued that this issue is due to a design limitation of browsers that attempt to perform automatic content type detection.", title: "Vulnerability description", }, { category: "summary", text: "mod_autoindex XSS", title: "Vulnerability summary", }, { category: "other", text: "This is actually a flaw in browsers that do not derive the response character set as required by RFC 2616. This does not affect the default configuration of Apache httpd in Red Hat products and will only affect customers who have removed the \"AddDefaultCharset\" directive and are using directory indexes. The Red Hat Product Security has rated this issue as having low security impact, a future update may address this flaw.", title: "Statement", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-4465", }, { category: "external", summary: "RHBZ#289511", url: "https://bugzilla.redhat.com/show_bug.cgi?id=289511", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-4465", url: "https://www.cve.org/CVERecord?id=CVE-2007-4465", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-4465", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-4465", }, ], release_date: "2007-09-13T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "mod_autoindex XSS", }, { cve: "CVE-2007-5000", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2007-12-11T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "419931", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in the (1) mod_imap module in the Apache HTTP Server 1.3.0 through 1.3.39 and 2.0.35 through 2.0.61 and the (2) mod_imagemap module in the Apache HTTP Server 2.2.0 through 2.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "httpd: mod_imagemap XSS", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-5000", }, { category: "external", summary: "RHBZ#419931", url: "https://bugzilla.redhat.com/show_bug.cgi?id=419931", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-5000", url: "https://www.cve.org/CVERecord?id=CVE-2007-5000", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-5000", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-5000", }, ], release_date: "2007-12-11T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "httpd: mod_imagemap XSS", }, { cve: "CVE-2007-6388", cwe: { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", }, discovery_date: "2008-01-02T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "427228", }, ], notes: [ { category: "description", text: "Cross-site scripting (XSS) vulnerability in mod_status in the Apache HTTP Server 2.2.0 through 2.2.6, 2.0.35 through 2.0.61, and 1.3.2 through 1.3.39, when the server-status page is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", title: "Vulnerability description", }, { category: "summary", text: "apache mod_status cross-site scripting", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2007-6388", }, { category: "external", summary: "RHBZ#427228", url: "https://bugzilla.redhat.com/show_bug.cgi?id=427228", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2007-6388", url: "https://www.cve.org/CVERecord?id=CVE-2007-6388", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2007-6388", url: "https://nvd.nist.gov/vuln/detail/CVE-2007-6388", }, ], release_date: "2007-12-29T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2008-06-30T15:29:00+00:00", details: "Before applying this update, make sure that all previously-released\nerrata relevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use \nthe Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188", product_ids: [ "3AS-RHNPROXY4.2:jabberd-0:2.0s10-3.37.rhn.i386", "3AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel3.i386", "3AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel3.i386", "4AS-RHNPROXY4.2:jabberd-0:2.0s10-3.38.rhn.i386", "4AS-RHNPROXY4.2:rhn-apache-0:1.3.27-36.rhn.rhel4.i386", "4AS-RHNPROXY4.2:rhn-modperl-0:1.29-16.rhel4.i386", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2008:0523", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "apache mod_status cross-site scripting", }, ], }
RHSA-2004:342
Vulnerability from csaf_redhat
Published
2004-07-06 08:35
Modified
2024-11-21 23:06
Summary
Red Hat Security Advisory: httpd security update
Notes
Topic
Updated httpd packages that fix a buffer overflow in mod_ssl and a remotely
triggerable memory leak are now available.
Details
The Apache HTTP server is a powerful, full-featured, efficient, and
freely-available Web server.
A stack buffer overflow was discovered in mod_ssl that could be triggered
if using the FakeBasicAuth option. If mod_ssl was sent a client certificate
with a subject DN field longer than 6000 characters, a stack overflow
occured if FakeBasicAuth had been enabled. In order to exploit this issue
the carefully crafted malicious certificate would have had to be signed by
a Certificate Authority which mod_ssl is configured to trust. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2004-0488 to this issue.
A remotely triggered memory leak in the Apache HTTP Server earlier than
version 2.0.50 was also discovered. This allowed a remote attacker to
perform a denial of service attack against the server by forcing it to
consume large amounts of memory. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CAN-2004-0493 to this issue.
Users of the Apache HTTP server should upgrade to these updated packages,
which contain backported patches that address these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated httpd packages that fix a buffer overflow in mod_ssl and a remotely\ntriggerable memory leak are now available.", title: "Topic", }, { category: "general", text: "The Apache HTTP server is a powerful, full-featured, efficient, and\nfreely-available Web server.\n\nA stack buffer overflow was discovered in mod_ssl that could be triggered\nif using the FakeBasicAuth option. If mod_ssl was sent a client certificate\nwith a subject DN field longer than 6000 characters, a stack overflow\noccured if FakeBasicAuth had been enabled. In order to exploit this issue\nthe carefully crafted malicious certificate would have had to be signed by\na Certificate Authority which mod_ssl is configured to trust. The Common\nVulnerabilities and Exposures project (cve.mitre.org) has assigned the name\nCAN-2004-0488 to this issue.\n\nA remotely triggered memory leak in the Apache HTTP Server earlier than\nversion 2.0.50 was also discovered. This allowed a remote attacker to\nperform a denial of service attack against the server by forcing it to\nconsume large amounts of memory. The Common Vulnerabilities and Exposures\nproject (cve.mitre.org) has assigned the name CAN-2004-0493 to this issue.\n\nUsers of the Apache HTTP server should upgrade to these updated packages,\nwhich contain backported patches that address these issues.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2004:342", url: "https://access.redhat.com/errata/RHSA-2004:342", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "http://www.apacheweek.com/features/security-20", url: "http://www.apacheweek.com/features/security-20", }, { category: "external", summary: "125046", url: "https://bugzilla.redhat.com/show_bug.cgi?id=125046", }, { category: "external", summary: "126863", url: "https://bugzilla.redhat.com/show_bug.cgi?id=126863", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2004/rhsa-2004_342.json", }, ], title: "Red Hat Security Advisory: httpd security update", tracking: { current_release_date: "2024-11-21T23:06:49+00:00", generator: { date: "2024-11-21T23:06:49+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2004:342", initial_release_date: "2004-07-06T08:35:00+00:00", revision_history: [ { date: "2004-07-06T08:35:00+00:00", number: "1", summary: "Initial version", }, { date: "2004-07-06T00:00:00+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-21T23:06:49+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AS version 3", product: { name: "Red Hat Enterprise Linux AS version 3", product_id: "3AS", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:3::as", }, }, }, { category: "product_name", name: "Red Hat Desktop version 3", product: { name: "Red Hat Desktop version 3", product_id: "3Desktop", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:3::desktop", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux ES version 3", product: { name: "Red Hat Enterprise Linux ES version 3", product_id: "3ES", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:3::es", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux WS version 3", product: { name: "Red Hat Enterprise Linux WS version 3", product_id: "3WS", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:3::ws", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "mod_ssl-1:2.0.46-32.ent.3.ia64", product: { name: "mod_ssl-1:2.0.46-32.ent.3.ia64", product_id: "mod_ssl-1:2.0.46-32.ent.3.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.46-32.ent.3?arch=ia64&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.46-32.ent.3.ia64", product: { name: "httpd-devel-0:2.0.46-32.ent.3.ia64", product_id: "httpd-devel-0:2.0.46-32.ent.3.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.46-32.ent.3?arch=ia64", }, }, }, { category: "product_version", name: "httpd-0:2.0.46-32.ent.3.ia64", product: { name: "httpd-0:2.0.46-32.ent.3.ia64", product_id: "httpd-0:2.0.46-32.ent.3.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-32.ent.3?arch=ia64", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.46-32.ent.3.ia64", product: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.ia64", product_id: "httpd-debuginfo-0:2.0.46-32.ent.3.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.46-32.ent.3?arch=ia64", }, }, }, ], category: "architecture", name: "ia64", }, { branches: [ { category: "product_version", name: "mod_ssl-1:2.0.46-32.ent.3.x86_64", product: { name: "mod_ssl-1:2.0.46-32.ent.3.x86_64", product_id: "mod_ssl-1:2.0.46-32.ent.3.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.46-32.ent.3?arch=x86_64&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.46-32.ent.3.x86_64", product: { name: "httpd-devel-0:2.0.46-32.ent.3.x86_64", product_id: "httpd-devel-0:2.0.46-32.ent.3.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.46-32.ent.3?arch=x86_64", }, }, }, { category: "product_version", name: "httpd-0:2.0.46-32.ent.3.x86_64", product: { name: "httpd-0:2.0.46-32.ent.3.x86_64", product_id: "httpd-0:2.0.46-32.ent.3.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-32.ent.3?arch=x86_64", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", product: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", product_id: "httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.46-32.ent.3?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "mod_ssl-1:2.0.46-32.ent.3.i386", product: { name: "mod_ssl-1:2.0.46-32.ent.3.i386", product_id: "mod_ssl-1:2.0.46-32.ent.3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.46-32.ent.3?arch=i386&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.46-32.ent.3.i386", product: { name: "httpd-devel-0:2.0.46-32.ent.3.i386", product_id: "httpd-devel-0:2.0.46-32.ent.3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.46-32.ent.3?arch=i386", }, }, }, { category: "product_version", name: "httpd-0:2.0.46-32.ent.3.i386", product: { name: "httpd-0:2.0.46-32.ent.3.i386", product_id: "httpd-0:2.0.46-32.ent.3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-32.ent.3?arch=i386", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.46-32.ent.3.i386", product: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.i386", product_id: "httpd-debuginfo-0:2.0.46-32.ent.3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.46-32.ent.3?arch=i386", }, }, }, ], category: "architecture", name: "i386", }, { branches: [ { category: "product_version", name: "httpd-0:2.0.46-32.ent.3.src", product: { name: "httpd-0:2.0.46-32.ent.3.src", product_id: "httpd-0:2.0.46-32.ent.3.src", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-32.ent.3?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "mod_ssl-1:2.0.46-32.ent.3.ppc", product: { name: "mod_ssl-1:2.0.46-32.ent.3.ppc", product_id: "mod_ssl-1:2.0.46-32.ent.3.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.46-32.ent.3?arch=ppc&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.46-32.ent.3.ppc", product: { name: "httpd-devel-0:2.0.46-32.ent.3.ppc", product_id: "httpd-devel-0:2.0.46-32.ent.3.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.46-32.ent.3?arch=ppc", }, }, }, { category: "product_version", name: "httpd-0:2.0.46-32.ent.3.ppc", product: { name: "httpd-0:2.0.46-32.ent.3.ppc", product_id: "httpd-0:2.0.46-32.ent.3.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-32.ent.3?arch=ppc", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.46-32.ent.3.ppc", product: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.ppc", product_id: "httpd-debuginfo-0:2.0.46-32.ent.3.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.46-32.ent.3?arch=ppc", }, }, }, ], category: "architecture", name: "ppc", }, { branches: [ { category: "product_version", name: "mod_ssl-1:2.0.46-32.ent.3.s390x", product: { name: "mod_ssl-1:2.0.46-32.ent.3.s390x", product_id: "mod_ssl-1:2.0.46-32.ent.3.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.46-32.ent.3?arch=s390x&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.46-32.ent.3.s390x", product: { name: "httpd-devel-0:2.0.46-32.ent.3.s390x", product_id: "httpd-devel-0:2.0.46-32.ent.3.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.46-32.ent.3?arch=s390x", }, }, }, { category: "product_version", name: "httpd-0:2.0.46-32.ent.3.s390x", product: { name: "httpd-0:2.0.46-32.ent.3.s390x", product_id: "httpd-0:2.0.46-32.ent.3.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-32.ent.3?arch=s390x", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.46-32.ent.3.s390x", product: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.s390x", product_id: "httpd-debuginfo-0:2.0.46-32.ent.3.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.46-32.ent.3?arch=s390x", }, }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "mod_ssl-1:2.0.46-32.ent.3.s390", product: { name: "mod_ssl-1:2.0.46-32.ent.3.s390", product_id: "mod_ssl-1:2.0.46-32.ent.3.s390", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.46-32.ent.3?arch=s390&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.46-32.ent.3.s390", product: { name: "httpd-devel-0:2.0.46-32.ent.3.s390", product_id: "httpd-devel-0:2.0.46-32.ent.3.s390", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.46-32.ent.3?arch=s390", }, }, }, { category: "product_version", name: "httpd-0:2.0.46-32.ent.3.s390", product: { name: "httpd-0:2.0.46-32.ent.3.s390", product_id: "httpd-0:2.0.46-32.ent.3.s390", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-32.ent.3?arch=s390", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.46-32.ent.3.s390", product: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.s390", product_id: "httpd-debuginfo-0:2.0.46-32.ent.3.s390", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.46-32.ent.3?arch=s390", }, }, }, ], category: "architecture", name: "s390", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.i386 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-32.ent.3.i386", }, product_reference: "httpd-0:2.0.46-32.ent.3.i386", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.ia64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-32.ent.3.ia64", }, product_reference: "httpd-0:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.ppc as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-32.ent.3.ppc", }, product_reference: "httpd-0:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.s390 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-32.ent.3.s390", }, product_reference: "httpd-0:2.0.46-32.ent.3.s390", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.s390x as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-32.ent.3.s390x", }, product_reference: "httpd-0:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.src as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-32.ent.3.src", }, product_reference: "httpd-0:2.0.46-32.ent.3.src", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.x86_64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-32.ent.3.x86_64", }, product_reference: "httpd-0:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.i386 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.i386", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.i386", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.ia64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.ppc as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.s390 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.s390", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.s390", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.s390x as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.x86_64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.i386 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-devel-0:2.0.46-32.ent.3.i386", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.i386", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.ia64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-devel-0:2.0.46-32.ent.3.ia64", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.ppc as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-devel-0:2.0.46-32.ent.3.ppc", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.s390 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-devel-0:2.0.46-32.ent.3.s390", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.s390", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.s390x as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-devel-0:2.0.46-32.ent.3.s390x", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.x86_64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-devel-0:2.0.46-32.ent.3.x86_64", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.i386 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:mod_ssl-1:2.0.46-32.ent.3.i386", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.i386", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.ia64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:mod_ssl-1:2.0.46-32.ent.3.ia64", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.ppc as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:mod_ssl-1:2.0.46-32.ent.3.ppc", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.s390 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:mod_ssl-1:2.0.46-32.ent.3.s390", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.s390", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.s390x as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:mod_ssl-1:2.0.46-32.ent.3.s390x", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.x86_64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:mod_ssl-1:2.0.46-32.ent.3.x86_64", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.i386 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-32.ent.3.i386", }, product_reference: "httpd-0:2.0.46-32.ent.3.i386", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.ia64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-32.ent.3.ia64", }, product_reference: "httpd-0:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.ppc as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-32.ent.3.ppc", }, product_reference: "httpd-0:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.s390 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-32.ent.3.s390", }, product_reference: "httpd-0:2.0.46-32.ent.3.s390", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.s390x as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-32.ent.3.s390x", }, product_reference: "httpd-0:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.src as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-32.ent.3.src", }, product_reference: "httpd-0:2.0.46-32.ent.3.src", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.x86_64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-32.ent.3.x86_64", }, product_reference: "httpd-0:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.i386 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.i386", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.i386", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.ia64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.ppc as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.s390 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.s390", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.s390", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.s390x as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.x86_64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.i386 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-devel-0:2.0.46-32.ent.3.i386", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.i386", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.ia64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-devel-0:2.0.46-32.ent.3.ia64", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.ppc as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-devel-0:2.0.46-32.ent.3.ppc", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.s390 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-devel-0:2.0.46-32.ent.3.s390", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.s390", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.s390x as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-devel-0:2.0.46-32.ent.3.s390x", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.x86_64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-devel-0:2.0.46-32.ent.3.x86_64", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.i386 as a component of Red Hat Desktop version 3", product_id: "3Desktop:mod_ssl-1:2.0.46-32.ent.3.i386", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.i386", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.ia64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:mod_ssl-1:2.0.46-32.ent.3.ia64", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.ppc as a component of Red Hat Desktop version 3", product_id: "3Desktop:mod_ssl-1:2.0.46-32.ent.3.ppc", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.s390 as a component of Red Hat Desktop version 3", product_id: "3Desktop:mod_ssl-1:2.0.46-32.ent.3.s390", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.s390", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.s390x as a component of Red Hat Desktop version 3", product_id: "3Desktop:mod_ssl-1:2.0.46-32.ent.3.s390x", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.x86_64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:mod_ssl-1:2.0.46-32.ent.3.x86_64", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.i386 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-32.ent.3.i386", }, product_reference: "httpd-0:2.0.46-32.ent.3.i386", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.ia64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-32.ent.3.ia64", }, product_reference: "httpd-0:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.ppc as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-32.ent.3.ppc", }, product_reference: "httpd-0:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.s390 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-32.ent.3.s390", }, product_reference: "httpd-0:2.0.46-32.ent.3.s390", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.s390x as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-32.ent.3.s390x", }, product_reference: "httpd-0:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.src as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-32.ent.3.src", }, product_reference: "httpd-0:2.0.46-32.ent.3.src", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.x86_64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-32.ent.3.x86_64", }, product_reference: "httpd-0:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.i386 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.i386", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.i386", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.ia64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.ppc as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.s390 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.s390", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.s390", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.s390x as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.x86_64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.i386 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-devel-0:2.0.46-32.ent.3.i386", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.i386", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.ia64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-devel-0:2.0.46-32.ent.3.ia64", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.ppc as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-devel-0:2.0.46-32.ent.3.ppc", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.s390 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-devel-0:2.0.46-32.ent.3.s390", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.s390", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.s390x as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-devel-0:2.0.46-32.ent.3.s390x", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.x86_64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-devel-0:2.0.46-32.ent.3.x86_64", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.i386 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:mod_ssl-1:2.0.46-32.ent.3.i386", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.i386", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.ia64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:mod_ssl-1:2.0.46-32.ent.3.ia64", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.ppc as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:mod_ssl-1:2.0.46-32.ent.3.ppc", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.s390 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:mod_ssl-1:2.0.46-32.ent.3.s390", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.s390", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.s390x as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:mod_ssl-1:2.0.46-32.ent.3.s390x", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.x86_64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:mod_ssl-1:2.0.46-32.ent.3.x86_64", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.i386 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-32.ent.3.i386", }, product_reference: "httpd-0:2.0.46-32.ent.3.i386", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.ia64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-32.ent.3.ia64", }, product_reference: "httpd-0:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.ppc as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-32.ent.3.ppc", }, product_reference: "httpd-0:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.s390 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-32.ent.3.s390", }, product_reference: "httpd-0:2.0.46-32.ent.3.s390", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.s390x as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-32.ent.3.s390x", }, product_reference: "httpd-0:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.src as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-32.ent.3.src", }, product_reference: "httpd-0:2.0.46-32.ent.3.src", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.x86_64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-32.ent.3.x86_64", }, product_reference: "httpd-0:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.i386 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.i386", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.i386", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.ia64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.ppc as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.s390 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.s390", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.s390", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.s390x as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.x86_64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.i386 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-devel-0:2.0.46-32.ent.3.i386", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.i386", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.ia64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-devel-0:2.0.46-32.ent.3.ia64", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.ppc as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-devel-0:2.0.46-32.ent.3.ppc", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.s390 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-devel-0:2.0.46-32.ent.3.s390", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.s390", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.s390x as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-devel-0:2.0.46-32.ent.3.s390x", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.x86_64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-devel-0:2.0.46-32.ent.3.x86_64", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.i386 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:mod_ssl-1:2.0.46-32.ent.3.i386", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.i386", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.ia64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:mod_ssl-1:2.0.46-32.ent.3.ia64", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.ppc as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:mod_ssl-1:2.0.46-32.ent.3.ppc", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.s390 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:mod_ssl-1:2.0.46-32.ent.3.s390", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.s390", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.s390x as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:mod_ssl-1:2.0.46-32.ent.3.s390x", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.x86_64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:mod_ssl-1:2.0.46-32.ent.3.x86_64", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3WS", }, ], }, vulnerabilities: [ { cve: "CVE-2004-0488", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430867", }, ], notes: [ { category: "description", text: "Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.", title: "Vulnerability description", }, { category: "summary", text: "mod_ssl ssl_util_uuencode_binary CA issue", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS:httpd-0:2.0.46-32.ent.3.i386", "3AS:httpd-0:2.0.46-32.ent.3.ia64", "3AS:httpd-0:2.0.46-32.ent.3.ppc", "3AS:httpd-0:2.0.46-32.ent.3.s390", "3AS:httpd-0:2.0.46-32.ent.3.s390x", "3AS:httpd-0:2.0.46-32.ent.3.src", "3AS:httpd-0:2.0.46-32.ent.3.x86_64", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3AS:httpd-devel-0:2.0.46-32.ent.3.i386", "3AS:httpd-devel-0:2.0.46-32.ent.3.ia64", "3AS:httpd-devel-0:2.0.46-32.ent.3.ppc", "3AS:httpd-devel-0:2.0.46-32.ent.3.s390", "3AS:httpd-devel-0:2.0.46-32.ent.3.s390x", "3AS:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3AS:mod_ssl-1:2.0.46-32.ent.3.i386", "3AS:mod_ssl-1:2.0.46-32.ent.3.ia64", "3AS:mod_ssl-1:2.0.46-32.ent.3.ppc", "3AS:mod_ssl-1:2.0.46-32.ent.3.s390", "3AS:mod_ssl-1:2.0.46-32.ent.3.s390x", "3AS:mod_ssl-1:2.0.46-32.ent.3.x86_64", "3Desktop:httpd-0:2.0.46-32.ent.3.i386", "3Desktop:httpd-0:2.0.46-32.ent.3.ia64", "3Desktop:httpd-0:2.0.46-32.ent.3.ppc", "3Desktop:httpd-0:2.0.46-32.ent.3.s390", "3Desktop:httpd-0:2.0.46-32.ent.3.s390x", "3Desktop:httpd-0:2.0.46-32.ent.3.src", "3Desktop:httpd-0:2.0.46-32.ent.3.x86_64", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.i386", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.ia64", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.ppc", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.s390", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.s390x", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.i386", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.ia64", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.ppc", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.s390", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.s390x", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.x86_64", "3ES:httpd-0:2.0.46-32.ent.3.i386", "3ES:httpd-0:2.0.46-32.ent.3.ia64", "3ES:httpd-0:2.0.46-32.ent.3.ppc", "3ES:httpd-0:2.0.46-32.ent.3.s390", "3ES:httpd-0:2.0.46-32.ent.3.s390x", "3ES:httpd-0:2.0.46-32.ent.3.src", "3ES:httpd-0:2.0.46-32.ent.3.x86_64", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3ES:httpd-devel-0:2.0.46-32.ent.3.i386", "3ES:httpd-devel-0:2.0.46-32.ent.3.ia64", "3ES:httpd-devel-0:2.0.46-32.ent.3.ppc", "3ES:httpd-devel-0:2.0.46-32.ent.3.s390", "3ES:httpd-devel-0:2.0.46-32.ent.3.s390x", "3ES:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3ES:mod_ssl-1:2.0.46-32.ent.3.i386", "3ES:mod_ssl-1:2.0.46-32.ent.3.ia64", "3ES:mod_ssl-1:2.0.46-32.ent.3.ppc", "3ES:mod_ssl-1:2.0.46-32.ent.3.s390", "3ES:mod_ssl-1:2.0.46-32.ent.3.s390x", "3ES:mod_ssl-1:2.0.46-32.ent.3.x86_64", "3WS:httpd-0:2.0.46-32.ent.3.i386", "3WS:httpd-0:2.0.46-32.ent.3.ia64", "3WS:httpd-0:2.0.46-32.ent.3.ppc", "3WS:httpd-0:2.0.46-32.ent.3.s390", "3WS:httpd-0:2.0.46-32.ent.3.s390x", "3WS:httpd-0:2.0.46-32.ent.3.src", "3WS:httpd-0:2.0.46-32.ent.3.x86_64", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3WS:httpd-devel-0:2.0.46-32.ent.3.i386", "3WS:httpd-devel-0:2.0.46-32.ent.3.ia64", "3WS:httpd-devel-0:2.0.46-32.ent.3.ppc", "3WS:httpd-devel-0:2.0.46-32.ent.3.s390", "3WS:httpd-devel-0:2.0.46-32.ent.3.s390x", "3WS:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3WS:mod_ssl-1:2.0.46-32.ent.3.i386", "3WS:mod_ssl-1:2.0.46-32.ent.3.ia64", "3WS:mod_ssl-1:2.0.46-32.ent.3.ppc", "3WS:mod_ssl-1:2.0.46-32.ent.3.s390", "3WS:mod_ssl-1:2.0.46-32.ent.3.s390x", "3WS:mod_ssl-1:2.0.46-32.ent.3.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0488", }, { category: "external", summary: "RHBZ#430867", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430867", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0488", url: "https://www.cve.org/CVERecord?id=CVE-2004-0488", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0488", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0488", }, ], release_date: "2004-05-17T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2004-07-06T08:35:00+00:00", details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.", product_ids: [ "3AS:httpd-0:2.0.46-32.ent.3.i386", "3AS:httpd-0:2.0.46-32.ent.3.ia64", "3AS:httpd-0:2.0.46-32.ent.3.ppc", "3AS:httpd-0:2.0.46-32.ent.3.s390", "3AS:httpd-0:2.0.46-32.ent.3.s390x", "3AS:httpd-0:2.0.46-32.ent.3.src", "3AS:httpd-0:2.0.46-32.ent.3.x86_64", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3AS:httpd-devel-0:2.0.46-32.ent.3.i386", "3AS:httpd-devel-0:2.0.46-32.ent.3.ia64", "3AS:httpd-devel-0:2.0.46-32.ent.3.ppc", "3AS:httpd-devel-0:2.0.46-32.ent.3.s390", "3AS:httpd-devel-0:2.0.46-32.ent.3.s390x", "3AS:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3AS:mod_ssl-1:2.0.46-32.ent.3.i386", "3AS:mod_ssl-1:2.0.46-32.ent.3.ia64", "3AS:mod_ssl-1:2.0.46-32.ent.3.ppc", "3AS:mod_ssl-1:2.0.46-32.ent.3.s390", "3AS:mod_ssl-1:2.0.46-32.ent.3.s390x", "3AS:mod_ssl-1:2.0.46-32.ent.3.x86_64", "3Desktop:httpd-0:2.0.46-32.ent.3.i386", "3Desktop:httpd-0:2.0.46-32.ent.3.ia64", "3Desktop:httpd-0:2.0.46-32.ent.3.ppc", "3Desktop:httpd-0:2.0.46-32.ent.3.s390", "3Desktop:httpd-0:2.0.46-32.ent.3.s390x", "3Desktop:httpd-0:2.0.46-32.ent.3.src", "3Desktop:httpd-0:2.0.46-32.ent.3.x86_64", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.i386", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.ia64", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.ppc", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.s390", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.s390x", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.i386", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.ia64", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.ppc", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.s390", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.s390x", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.x86_64", "3ES:httpd-0:2.0.46-32.ent.3.i386", "3ES:httpd-0:2.0.46-32.ent.3.ia64", "3ES:httpd-0:2.0.46-32.ent.3.ppc", "3ES:httpd-0:2.0.46-32.ent.3.s390", "3ES:httpd-0:2.0.46-32.ent.3.s390x", "3ES:httpd-0:2.0.46-32.ent.3.src", "3ES:httpd-0:2.0.46-32.ent.3.x86_64", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3ES:httpd-devel-0:2.0.46-32.ent.3.i386", "3ES:httpd-devel-0:2.0.46-32.ent.3.ia64", "3ES:httpd-devel-0:2.0.46-32.ent.3.ppc", "3ES:httpd-devel-0:2.0.46-32.ent.3.s390", "3ES:httpd-devel-0:2.0.46-32.ent.3.s390x", "3ES:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3ES:mod_ssl-1:2.0.46-32.ent.3.i386", "3ES:mod_ssl-1:2.0.46-32.ent.3.ia64", "3ES:mod_ssl-1:2.0.46-32.ent.3.ppc", "3ES:mod_ssl-1:2.0.46-32.ent.3.s390", "3ES:mod_ssl-1:2.0.46-32.ent.3.s390x", "3ES:mod_ssl-1:2.0.46-32.ent.3.x86_64", "3WS:httpd-0:2.0.46-32.ent.3.i386", "3WS:httpd-0:2.0.46-32.ent.3.ia64", "3WS:httpd-0:2.0.46-32.ent.3.ppc", "3WS:httpd-0:2.0.46-32.ent.3.s390", "3WS:httpd-0:2.0.46-32.ent.3.s390x", "3WS:httpd-0:2.0.46-32.ent.3.src", "3WS:httpd-0:2.0.46-32.ent.3.x86_64", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3WS:httpd-devel-0:2.0.46-32.ent.3.i386", "3WS:httpd-devel-0:2.0.46-32.ent.3.ia64", "3WS:httpd-devel-0:2.0.46-32.ent.3.ppc", "3WS:httpd-devel-0:2.0.46-32.ent.3.s390", "3WS:httpd-devel-0:2.0.46-32.ent.3.s390x", "3WS:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3WS:mod_ssl-1:2.0.46-32.ent.3.i386", "3WS:mod_ssl-1:2.0.46-32.ent.3.ia64", "3WS:mod_ssl-1:2.0.46-32.ent.3.ppc", "3WS:mod_ssl-1:2.0.46-32.ent.3.s390", "3WS:mod_ssl-1:2.0.46-32.ent.3.s390x", "3WS:mod_ssl-1:2.0.46-32.ent.3.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2004:342", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_ssl ssl_util_uuencode_binary CA issue", }, { cve: "CVE-2004-0493", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1617211", }, ], notes: [ { category: "description", text: "The ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote attackers to cause a denial of service (memory exhaustion), and possibly an integer signedness error leading to a heap-based buffer overflow on 64 bit systems, via long header lines with large numbers of space or tab characters.", title: "Vulnerability description", }, { category: "summary", text: "security flaw", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS:httpd-0:2.0.46-32.ent.3.i386", "3AS:httpd-0:2.0.46-32.ent.3.ia64", "3AS:httpd-0:2.0.46-32.ent.3.ppc", "3AS:httpd-0:2.0.46-32.ent.3.s390", "3AS:httpd-0:2.0.46-32.ent.3.s390x", "3AS:httpd-0:2.0.46-32.ent.3.src", "3AS:httpd-0:2.0.46-32.ent.3.x86_64", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3AS:httpd-devel-0:2.0.46-32.ent.3.i386", "3AS:httpd-devel-0:2.0.46-32.ent.3.ia64", "3AS:httpd-devel-0:2.0.46-32.ent.3.ppc", "3AS:httpd-devel-0:2.0.46-32.ent.3.s390", "3AS:httpd-devel-0:2.0.46-32.ent.3.s390x", "3AS:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3AS:mod_ssl-1:2.0.46-32.ent.3.i386", "3AS:mod_ssl-1:2.0.46-32.ent.3.ia64", "3AS:mod_ssl-1:2.0.46-32.ent.3.ppc", "3AS:mod_ssl-1:2.0.46-32.ent.3.s390", "3AS:mod_ssl-1:2.0.46-32.ent.3.s390x", "3AS:mod_ssl-1:2.0.46-32.ent.3.x86_64", "3Desktop:httpd-0:2.0.46-32.ent.3.i386", "3Desktop:httpd-0:2.0.46-32.ent.3.ia64", "3Desktop:httpd-0:2.0.46-32.ent.3.ppc", "3Desktop:httpd-0:2.0.46-32.ent.3.s390", "3Desktop:httpd-0:2.0.46-32.ent.3.s390x", "3Desktop:httpd-0:2.0.46-32.ent.3.src", "3Desktop:httpd-0:2.0.46-32.ent.3.x86_64", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.i386", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.ia64", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.ppc", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.s390", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.s390x", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.i386", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.ia64", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.ppc", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.s390", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.s390x", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.x86_64", "3ES:httpd-0:2.0.46-32.ent.3.i386", "3ES:httpd-0:2.0.46-32.ent.3.ia64", "3ES:httpd-0:2.0.46-32.ent.3.ppc", "3ES:httpd-0:2.0.46-32.ent.3.s390", "3ES:httpd-0:2.0.46-32.ent.3.s390x", "3ES:httpd-0:2.0.46-32.ent.3.src", "3ES:httpd-0:2.0.46-32.ent.3.x86_64", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3ES:httpd-devel-0:2.0.46-32.ent.3.i386", "3ES:httpd-devel-0:2.0.46-32.ent.3.ia64", "3ES:httpd-devel-0:2.0.46-32.ent.3.ppc", "3ES:httpd-devel-0:2.0.46-32.ent.3.s390", "3ES:httpd-devel-0:2.0.46-32.ent.3.s390x", "3ES:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3ES:mod_ssl-1:2.0.46-32.ent.3.i386", "3ES:mod_ssl-1:2.0.46-32.ent.3.ia64", "3ES:mod_ssl-1:2.0.46-32.ent.3.ppc", "3ES:mod_ssl-1:2.0.46-32.ent.3.s390", "3ES:mod_ssl-1:2.0.46-32.ent.3.s390x", "3ES:mod_ssl-1:2.0.46-32.ent.3.x86_64", "3WS:httpd-0:2.0.46-32.ent.3.i386", "3WS:httpd-0:2.0.46-32.ent.3.ia64", "3WS:httpd-0:2.0.46-32.ent.3.ppc", "3WS:httpd-0:2.0.46-32.ent.3.s390", "3WS:httpd-0:2.0.46-32.ent.3.s390x", "3WS:httpd-0:2.0.46-32.ent.3.src", "3WS:httpd-0:2.0.46-32.ent.3.x86_64", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3WS:httpd-devel-0:2.0.46-32.ent.3.i386", "3WS:httpd-devel-0:2.0.46-32.ent.3.ia64", "3WS:httpd-devel-0:2.0.46-32.ent.3.ppc", "3WS:httpd-devel-0:2.0.46-32.ent.3.s390", "3WS:httpd-devel-0:2.0.46-32.ent.3.s390x", "3WS:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3WS:mod_ssl-1:2.0.46-32.ent.3.i386", "3WS:mod_ssl-1:2.0.46-32.ent.3.ia64", "3WS:mod_ssl-1:2.0.46-32.ent.3.ppc", "3WS:mod_ssl-1:2.0.46-32.ent.3.s390", "3WS:mod_ssl-1:2.0.46-32.ent.3.s390x", "3WS:mod_ssl-1:2.0.46-32.ent.3.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0493", }, { category: "external", summary: "RHBZ#1617211", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1617211", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0493", url: "https://www.cve.org/CVERecord?id=CVE-2004-0493", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0493", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0493", }, ], release_date: "2004-06-28T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2004-07-06T08:35:00+00:00", details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.", product_ids: [ "3AS:httpd-0:2.0.46-32.ent.3.i386", "3AS:httpd-0:2.0.46-32.ent.3.ia64", "3AS:httpd-0:2.0.46-32.ent.3.ppc", "3AS:httpd-0:2.0.46-32.ent.3.s390", "3AS:httpd-0:2.0.46-32.ent.3.s390x", "3AS:httpd-0:2.0.46-32.ent.3.src", "3AS:httpd-0:2.0.46-32.ent.3.x86_64", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3AS:httpd-devel-0:2.0.46-32.ent.3.i386", "3AS:httpd-devel-0:2.0.46-32.ent.3.ia64", "3AS:httpd-devel-0:2.0.46-32.ent.3.ppc", "3AS:httpd-devel-0:2.0.46-32.ent.3.s390", "3AS:httpd-devel-0:2.0.46-32.ent.3.s390x", "3AS:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3AS:mod_ssl-1:2.0.46-32.ent.3.i386", "3AS:mod_ssl-1:2.0.46-32.ent.3.ia64", "3AS:mod_ssl-1:2.0.46-32.ent.3.ppc", "3AS:mod_ssl-1:2.0.46-32.ent.3.s390", "3AS:mod_ssl-1:2.0.46-32.ent.3.s390x", "3AS:mod_ssl-1:2.0.46-32.ent.3.x86_64", "3Desktop:httpd-0:2.0.46-32.ent.3.i386", "3Desktop:httpd-0:2.0.46-32.ent.3.ia64", "3Desktop:httpd-0:2.0.46-32.ent.3.ppc", "3Desktop:httpd-0:2.0.46-32.ent.3.s390", "3Desktop:httpd-0:2.0.46-32.ent.3.s390x", "3Desktop:httpd-0:2.0.46-32.ent.3.src", "3Desktop:httpd-0:2.0.46-32.ent.3.x86_64", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.i386", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.ia64", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.ppc", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.s390", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.s390x", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.i386", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.ia64", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.ppc", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.s390", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.s390x", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.x86_64", "3ES:httpd-0:2.0.46-32.ent.3.i386", "3ES:httpd-0:2.0.46-32.ent.3.ia64", "3ES:httpd-0:2.0.46-32.ent.3.ppc", "3ES:httpd-0:2.0.46-32.ent.3.s390", "3ES:httpd-0:2.0.46-32.ent.3.s390x", "3ES:httpd-0:2.0.46-32.ent.3.src", "3ES:httpd-0:2.0.46-32.ent.3.x86_64", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3ES:httpd-devel-0:2.0.46-32.ent.3.i386", "3ES:httpd-devel-0:2.0.46-32.ent.3.ia64", "3ES:httpd-devel-0:2.0.46-32.ent.3.ppc", "3ES:httpd-devel-0:2.0.46-32.ent.3.s390", "3ES:httpd-devel-0:2.0.46-32.ent.3.s390x", "3ES:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3ES:mod_ssl-1:2.0.46-32.ent.3.i386", "3ES:mod_ssl-1:2.0.46-32.ent.3.ia64", "3ES:mod_ssl-1:2.0.46-32.ent.3.ppc", "3ES:mod_ssl-1:2.0.46-32.ent.3.s390", "3ES:mod_ssl-1:2.0.46-32.ent.3.s390x", "3ES:mod_ssl-1:2.0.46-32.ent.3.x86_64", "3WS:httpd-0:2.0.46-32.ent.3.i386", "3WS:httpd-0:2.0.46-32.ent.3.ia64", "3WS:httpd-0:2.0.46-32.ent.3.ppc", "3WS:httpd-0:2.0.46-32.ent.3.s390", "3WS:httpd-0:2.0.46-32.ent.3.s390x", "3WS:httpd-0:2.0.46-32.ent.3.src", "3WS:httpd-0:2.0.46-32.ent.3.x86_64", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3WS:httpd-devel-0:2.0.46-32.ent.3.i386", "3WS:httpd-devel-0:2.0.46-32.ent.3.ia64", "3WS:httpd-devel-0:2.0.46-32.ent.3.ppc", "3WS:httpd-devel-0:2.0.46-32.ent.3.s390", "3WS:httpd-devel-0:2.0.46-32.ent.3.s390x", "3WS:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3WS:mod_ssl-1:2.0.46-32.ent.3.i386", "3WS:mod_ssl-1:2.0.46-32.ent.3.ia64", "3WS:mod_ssl-1:2.0.46-32.ent.3.ppc", "3WS:mod_ssl-1:2.0.46-32.ent.3.s390", "3WS:mod_ssl-1:2.0.46-32.ent.3.s390x", "3WS:mod_ssl-1:2.0.46-32.ent.3.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2004:342", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "security flaw", }, ], }
rhsa-2004:342
Vulnerability from csaf_redhat
Published
2004-07-06 08:35
Modified
2024-11-21 23:06
Summary
Red Hat Security Advisory: httpd security update
Notes
Topic
Updated httpd packages that fix a buffer overflow in mod_ssl and a remotely
triggerable memory leak are now available.
Details
The Apache HTTP server is a powerful, full-featured, efficient, and
freely-available Web server.
A stack buffer overflow was discovered in mod_ssl that could be triggered
if using the FakeBasicAuth option. If mod_ssl was sent a client certificate
with a subject DN field longer than 6000 characters, a stack overflow
occured if FakeBasicAuth had been enabled. In order to exploit this issue
the carefully crafted malicious certificate would have had to be signed by
a Certificate Authority which mod_ssl is configured to trust. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2004-0488 to this issue.
A remotely triggered memory leak in the Apache HTTP Server earlier than
version 2.0.50 was also discovered. This allowed a remote attacker to
perform a denial of service attack against the server by forcing it to
consume large amounts of memory. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CAN-2004-0493 to this issue.
Users of the Apache HTTP server should upgrade to these updated packages,
which contain backported patches that address these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Important", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated httpd packages that fix a buffer overflow in mod_ssl and a remotely\ntriggerable memory leak are now available.", title: "Topic", }, { category: "general", text: "The Apache HTTP server is a powerful, full-featured, efficient, and\nfreely-available Web server.\n\nA stack buffer overflow was discovered in mod_ssl that could be triggered\nif using the FakeBasicAuth option. If mod_ssl was sent a client certificate\nwith a subject DN field longer than 6000 characters, a stack overflow\noccured if FakeBasicAuth had been enabled. In order to exploit this issue\nthe carefully crafted malicious certificate would have had to be signed by\na Certificate Authority which mod_ssl is configured to trust. The Common\nVulnerabilities and Exposures project (cve.mitre.org) has assigned the name\nCAN-2004-0488 to this issue.\n\nA remotely triggered memory leak in the Apache HTTP Server earlier than\nversion 2.0.50 was also discovered. This allowed a remote attacker to\nperform a denial of service attack against the server by forcing it to\nconsume large amounts of memory. The Common Vulnerabilities and Exposures\nproject (cve.mitre.org) has assigned the name CAN-2004-0493 to this issue.\n\nUsers of the Apache HTTP server should upgrade to these updated packages,\nwhich contain backported patches that address these issues.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2004:342", url: "https://access.redhat.com/errata/RHSA-2004:342", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#important", url: "https://access.redhat.com/security/updates/classification/#important", }, { category: "external", summary: "http://www.apacheweek.com/features/security-20", url: "http://www.apacheweek.com/features/security-20", }, { category: "external", summary: "125046", url: "https://bugzilla.redhat.com/show_bug.cgi?id=125046", }, { category: "external", summary: "126863", url: "https://bugzilla.redhat.com/show_bug.cgi?id=126863", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2004/rhsa-2004_342.json", }, ], title: "Red Hat Security Advisory: httpd security update", tracking: { current_release_date: "2024-11-21T23:06:49+00:00", generator: { date: "2024-11-21T23:06:49+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2004:342", initial_release_date: "2004-07-06T08:35:00+00:00", revision_history: [ { date: "2004-07-06T08:35:00+00:00", number: "1", summary: "Initial version", }, { date: "2004-07-06T00:00:00+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-21T23:06:49+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AS version 3", product: { name: "Red Hat Enterprise Linux AS version 3", product_id: "3AS", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:3::as", }, }, }, { category: "product_name", name: "Red Hat Desktop version 3", product: { name: "Red Hat Desktop version 3", product_id: "3Desktop", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:3::desktop", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux ES version 3", product: { name: "Red Hat Enterprise Linux ES version 3", product_id: "3ES", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:3::es", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux WS version 3", product: { name: "Red Hat Enterprise Linux WS version 3", product_id: "3WS", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:3::ws", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, { branches: [ { category: "product_version", name: "mod_ssl-1:2.0.46-32.ent.3.ia64", product: { name: "mod_ssl-1:2.0.46-32.ent.3.ia64", product_id: "mod_ssl-1:2.0.46-32.ent.3.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.46-32.ent.3?arch=ia64&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.46-32.ent.3.ia64", product: { name: "httpd-devel-0:2.0.46-32.ent.3.ia64", product_id: "httpd-devel-0:2.0.46-32.ent.3.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.46-32.ent.3?arch=ia64", }, }, }, { category: "product_version", name: "httpd-0:2.0.46-32.ent.3.ia64", product: { name: "httpd-0:2.0.46-32.ent.3.ia64", product_id: "httpd-0:2.0.46-32.ent.3.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-32.ent.3?arch=ia64", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.46-32.ent.3.ia64", product: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.ia64", product_id: "httpd-debuginfo-0:2.0.46-32.ent.3.ia64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.46-32.ent.3?arch=ia64", }, }, }, ], category: "architecture", name: "ia64", }, { branches: [ { category: "product_version", name: "mod_ssl-1:2.0.46-32.ent.3.x86_64", product: { name: "mod_ssl-1:2.0.46-32.ent.3.x86_64", product_id: "mod_ssl-1:2.0.46-32.ent.3.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.46-32.ent.3?arch=x86_64&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.46-32.ent.3.x86_64", product: { name: "httpd-devel-0:2.0.46-32.ent.3.x86_64", product_id: "httpd-devel-0:2.0.46-32.ent.3.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.46-32.ent.3?arch=x86_64", }, }, }, { category: "product_version", name: "httpd-0:2.0.46-32.ent.3.x86_64", product: { name: "httpd-0:2.0.46-32.ent.3.x86_64", product_id: "httpd-0:2.0.46-32.ent.3.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-32.ent.3?arch=x86_64", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", product: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", product_id: "httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.46-32.ent.3?arch=x86_64", }, }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_version", name: "mod_ssl-1:2.0.46-32.ent.3.i386", product: { name: "mod_ssl-1:2.0.46-32.ent.3.i386", product_id: "mod_ssl-1:2.0.46-32.ent.3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.46-32.ent.3?arch=i386&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.46-32.ent.3.i386", product: { name: "httpd-devel-0:2.0.46-32.ent.3.i386", product_id: "httpd-devel-0:2.0.46-32.ent.3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.46-32.ent.3?arch=i386", }, }, }, { category: "product_version", name: "httpd-0:2.0.46-32.ent.3.i386", product: { name: "httpd-0:2.0.46-32.ent.3.i386", product_id: "httpd-0:2.0.46-32.ent.3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-32.ent.3?arch=i386", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.46-32.ent.3.i386", product: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.i386", product_id: "httpd-debuginfo-0:2.0.46-32.ent.3.i386", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.46-32.ent.3?arch=i386", }, }, }, ], category: "architecture", name: "i386", }, { branches: [ { category: "product_version", name: "httpd-0:2.0.46-32.ent.3.src", product: { name: "httpd-0:2.0.46-32.ent.3.src", product_id: "httpd-0:2.0.46-32.ent.3.src", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-32.ent.3?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "mod_ssl-1:2.0.46-32.ent.3.ppc", product: { name: "mod_ssl-1:2.0.46-32.ent.3.ppc", product_id: "mod_ssl-1:2.0.46-32.ent.3.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.46-32.ent.3?arch=ppc&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.46-32.ent.3.ppc", product: { name: "httpd-devel-0:2.0.46-32.ent.3.ppc", product_id: "httpd-devel-0:2.0.46-32.ent.3.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.46-32.ent.3?arch=ppc", }, }, }, { category: "product_version", name: "httpd-0:2.0.46-32.ent.3.ppc", product: { name: "httpd-0:2.0.46-32.ent.3.ppc", product_id: "httpd-0:2.0.46-32.ent.3.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-32.ent.3?arch=ppc", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.46-32.ent.3.ppc", product: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.ppc", product_id: "httpd-debuginfo-0:2.0.46-32.ent.3.ppc", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.46-32.ent.3?arch=ppc", }, }, }, ], category: "architecture", name: "ppc", }, { branches: [ { category: "product_version", name: "mod_ssl-1:2.0.46-32.ent.3.s390x", product: { name: "mod_ssl-1:2.0.46-32.ent.3.s390x", product_id: "mod_ssl-1:2.0.46-32.ent.3.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.46-32.ent.3?arch=s390x&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.46-32.ent.3.s390x", product: { name: "httpd-devel-0:2.0.46-32.ent.3.s390x", product_id: "httpd-devel-0:2.0.46-32.ent.3.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.46-32.ent.3?arch=s390x", }, }, }, { category: "product_version", name: "httpd-0:2.0.46-32.ent.3.s390x", product: { name: "httpd-0:2.0.46-32.ent.3.s390x", product_id: "httpd-0:2.0.46-32.ent.3.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-32.ent.3?arch=s390x", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.46-32.ent.3.s390x", product: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.s390x", product_id: "httpd-debuginfo-0:2.0.46-32.ent.3.s390x", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.46-32.ent.3?arch=s390x", }, }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "mod_ssl-1:2.0.46-32.ent.3.s390", product: { name: "mod_ssl-1:2.0.46-32.ent.3.s390", product_id: "mod_ssl-1:2.0.46-32.ent.3.s390", product_identification_helper: { purl: "pkg:rpm/redhat/mod_ssl@2.0.46-32.ent.3?arch=s390&epoch=1", }, }, }, { category: "product_version", name: "httpd-devel-0:2.0.46-32.ent.3.s390", product: { name: "httpd-devel-0:2.0.46-32.ent.3.s390", product_id: "httpd-devel-0:2.0.46-32.ent.3.s390", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-devel@2.0.46-32.ent.3?arch=s390", }, }, }, { category: "product_version", name: "httpd-0:2.0.46-32.ent.3.s390", product: { name: "httpd-0:2.0.46-32.ent.3.s390", product_id: "httpd-0:2.0.46-32.ent.3.s390", product_identification_helper: { purl: "pkg:rpm/redhat/httpd@2.0.46-32.ent.3?arch=s390", }, }, }, { category: "product_version", name: "httpd-debuginfo-0:2.0.46-32.ent.3.s390", product: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.s390", product_id: "httpd-debuginfo-0:2.0.46-32.ent.3.s390", product_identification_helper: { purl: "pkg:rpm/redhat/httpd-debuginfo@2.0.46-32.ent.3?arch=s390", }, }, }, ], category: "architecture", name: "s390", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.i386 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-32.ent.3.i386", }, product_reference: "httpd-0:2.0.46-32.ent.3.i386", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.ia64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-32.ent.3.ia64", }, product_reference: "httpd-0:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.ppc as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-32.ent.3.ppc", }, product_reference: "httpd-0:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.s390 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-32.ent.3.s390", }, product_reference: "httpd-0:2.0.46-32.ent.3.s390", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.s390x as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-32.ent.3.s390x", }, product_reference: "httpd-0:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.src as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-32.ent.3.src", }, product_reference: "httpd-0:2.0.46-32.ent.3.src", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.x86_64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-0:2.0.46-32.ent.3.x86_64", }, product_reference: "httpd-0:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.i386 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.i386", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.i386", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.ia64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.ppc as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.s390 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.s390", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.s390", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.s390x as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.x86_64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.i386 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-devel-0:2.0.46-32.ent.3.i386", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.i386", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.ia64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-devel-0:2.0.46-32.ent.3.ia64", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.ppc as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-devel-0:2.0.46-32.ent.3.ppc", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.s390 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-devel-0:2.0.46-32.ent.3.s390", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.s390", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.s390x as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-devel-0:2.0.46-32.ent.3.s390x", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.x86_64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:httpd-devel-0:2.0.46-32.ent.3.x86_64", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.i386 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:mod_ssl-1:2.0.46-32.ent.3.i386", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.i386", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.ia64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:mod_ssl-1:2.0.46-32.ent.3.ia64", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.ppc as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:mod_ssl-1:2.0.46-32.ent.3.ppc", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.s390 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:mod_ssl-1:2.0.46-32.ent.3.s390", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.s390", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.s390x as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:mod_ssl-1:2.0.46-32.ent.3.s390x", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.x86_64 as a component of Red Hat Enterprise Linux AS version 3", product_id: "3AS:mod_ssl-1:2.0.46-32.ent.3.x86_64", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3AS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.i386 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-32.ent.3.i386", }, product_reference: "httpd-0:2.0.46-32.ent.3.i386", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.ia64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-32.ent.3.ia64", }, product_reference: "httpd-0:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.ppc as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-32.ent.3.ppc", }, product_reference: "httpd-0:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.s390 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-32.ent.3.s390", }, product_reference: "httpd-0:2.0.46-32.ent.3.s390", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.s390x as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-32.ent.3.s390x", }, product_reference: "httpd-0:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.src as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-32.ent.3.src", }, product_reference: "httpd-0:2.0.46-32.ent.3.src", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.x86_64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-0:2.0.46-32.ent.3.x86_64", }, product_reference: "httpd-0:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.i386 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.i386", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.i386", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.ia64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.ppc as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.s390 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.s390", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.s390", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.s390x as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.x86_64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.i386 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-devel-0:2.0.46-32.ent.3.i386", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.i386", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.ia64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-devel-0:2.0.46-32.ent.3.ia64", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.ppc as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-devel-0:2.0.46-32.ent.3.ppc", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.s390 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-devel-0:2.0.46-32.ent.3.s390", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.s390", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.s390x as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-devel-0:2.0.46-32.ent.3.s390x", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.x86_64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:httpd-devel-0:2.0.46-32.ent.3.x86_64", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.i386 as a component of Red Hat Desktop version 3", product_id: "3Desktop:mod_ssl-1:2.0.46-32.ent.3.i386", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.i386", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.ia64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:mod_ssl-1:2.0.46-32.ent.3.ia64", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.ppc as a component of Red Hat Desktop version 3", product_id: "3Desktop:mod_ssl-1:2.0.46-32.ent.3.ppc", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.s390 as a component of Red Hat Desktop version 3", product_id: "3Desktop:mod_ssl-1:2.0.46-32.ent.3.s390", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.s390", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.s390x as a component of Red Hat Desktop version 3", product_id: "3Desktop:mod_ssl-1:2.0.46-32.ent.3.s390x", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.x86_64 as a component of Red Hat Desktop version 3", product_id: "3Desktop:mod_ssl-1:2.0.46-32.ent.3.x86_64", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3Desktop", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.i386 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-32.ent.3.i386", }, product_reference: "httpd-0:2.0.46-32.ent.3.i386", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.ia64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-32.ent.3.ia64", }, product_reference: "httpd-0:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.ppc as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-32.ent.3.ppc", }, product_reference: "httpd-0:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.s390 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-32.ent.3.s390", }, product_reference: "httpd-0:2.0.46-32.ent.3.s390", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.s390x as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-32.ent.3.s390x", }, product_reference: "httpd-0:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.src as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-32.ent.3.src", }, product_reference: "httpd-0:2.0.46-32.ent.3.src", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.x86_64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-0:2.0.46-32.ent.3.x86_64", }, product_reference: "httpd-0:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.i386 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.i386", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.i386", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.ia64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.ppc as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.s390 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.s390", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.s390", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.s390x as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.x86_64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.i386 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-devel-0:2.0.46-32.ent.3.i386", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.i386", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.ia64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-devel-0:2.0.46-32.ent.3.ia64", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.ppc as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-devel-0:2.0.46-32.ent.3.ppc", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.s390 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-devel-0:2.0.46-32.ent.3.s390", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.s390", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.s390x as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-devel-0:2.0.46-32.ent.3.s390x", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.x86_64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:httpd-devel-0:2.0.46-32.ent.3.x86_64", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.i386 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:mod_ssl-1:2.0.46-32.ent.3.i386", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.i386", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.ia64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:mod_ssl-1:2.0.46-32.ent.3.ia64", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.ppc as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:mod_ssl-1:2.0.46-32.ent.3.ppc", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.s390 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:mod_ssl-1:2.0.46-32.ent.3.s390", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.s390", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.s390x as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:mod_ssl-1:2.0.46-32.ent.3.s390x", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.x86_64 as a component of Red Hat Enterprise Linux ES version 3", product_id: "3ES:mod_ssl-1:2.0.46-32.ent.3.x86_64", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3ES", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.i386 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-32.ent.3.i386", }, product_reference: "httpd-0:2.0.46-32.ent.3.i386", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.ia64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-32.ent.3.ia64", }, product_reference: "httpd-0:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.ppc as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-32.ent.3.ppc", }, product_reference: "httpd-0:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.s390 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-32.ent.3.s390", }, product_reference: "httpd-0:2.0.46-32.ent.3.s390", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.s390x as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-32.ent.3.s390x", }, product_reference: "httpd-0:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.src as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-32.ent.3.src", }, product_reference: "httpd-0:2.0.46-32.ent.3.src", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-0:2.0.46-32.ent.3.x86_64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-0:2.0.46-32.ent.3.x86_64", }, product_reference: "httpd-0:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.i386 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.i386", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.i386", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.ia64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.ppc as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.s390 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.s390", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.s390", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.s390x as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-debuginfo-0:2.0.46-32.ent.3.x86_64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", }, product_reference: "httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.i386 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-devel-0:2.0.46-32.ent.3.i386", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.i386", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.ia64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-devel-0:2.0.46-32.ent.3.ia64", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.ppc as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-devel-0:2.0.46-32.ent.3.ppc", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.s390 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-devel-0:2.0.46-32.ent.3.s390", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.s390", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.s390x as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-devel-0:2.0.46-32.ent.3.s390x", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "httpd-devel-0:2.0.46-32.ent.3.x86_64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:httpd-devel-0:2.0.46-32.ent.3.x86_64", }, product_reference: "httpd-devel-0:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.i386 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:mod_ssl-1:2.0.46-32.ent.3.i386", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.i386", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.ia64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:mod_ssl-1:2.0.46-32.ent.3.ia64", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.ia64", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.ppc as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:mod_ssl-1:2.0.46-32.ent.3.ppc", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.ppc", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.s390 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:mod_ssl-1:2.0.46-32.ent.3.s390", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.s390", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.s390x as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:mod_ssl-1:2.0.46-32.ent.3.s390x", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.s390x", relates_to_product_reference: "3WS", }, { category: "default_component_of", full_product_name: { name: "mod_ssl-1:2.0.46-32.ent.3.x86_64 as a component of Red Hat Enterprise Linux WS version 3", product_id: "3WS:mod_ssl-1:2.0.46-32.ent.3.x86_64", }, product_reference: "mod_ssl-1:2.0.46-32.ent.3.x86_64", relates_to_product_reference: "3WS", }, ], }, vulnerabilities: [ { cve: "CVE-2004-0488", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430867", }, ], notes: [ { category: "description", text: "Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.", title: "Vulnerability description", }, { category: "summary", text: "mod_ssl ssl_util_uuencode_binary CA issue", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS:httpd-0:2.0.46-32.ent.3.i386", "3AS:httpd-0:2.0.46-32.ent.3.ia64", "3AS:httpd-0:2.0.46-32.ent.3.ppc", "3AS:httpd-0:2.0.46-32.ent.3.s390", "3AS:httpd-0:2.0.46-32.ent.3.s390x", "3AS:httpd-0:2.0.46-32.ent.3.src", "3AS:httpd-0:2.0.46-32.ent.3.x86_64", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3AS:httpd-devel-0:2.0.46-32.ent.3.i386", "3AS:httpd-devel-0:2.0.46-32.ent.3.ia64", "3AS:httpd-devel-0:2.0.46-32.ent.3.ppc", "3AS:httpd-devel-0:2.0.46-32.ent.3.s390", "3AS:httpd-devel-0:2.0.46-32.ent.3.s390x", "3AS:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3AS:mod_ssl-1:2.0.46-32.ent.3.i386", "3AS:mod_ssl-1:2.0.46-32.ent.3.ia64", "3AS:mod_ssl-1:2.0.46-32.ent.3.ppc", "3AS:mod_ssl-1:2.0.46-32.ent.3.s390", "3AS:mod_ssl-1:2.0.46-32.ent.3.s390x", "3AS:mod_ssl-1:2.0.46-32.ent.3.x86_64", "3Desktop:httpd-0:2.0.46-32.ent.3.i386", "3Desktop:httpd-0:2.0.46-32.ent.3.ia64", "3Desktop:httpd-0:2.0.46-32.ent.3.ppc", "3Desktop:httpd-0:2.0.46-32.ent.3.s390", "3Desktop:httpd-0:2.0.46-32.ent.3.s390x", "3Desktop:httpd-0:2.0.46-32.ent.3.src", "3Desktop:httpd-0:2.0.46-32.ent.3.x86_64", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.i386", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.ia64", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.ppc", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.s390", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.s390x", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.i386", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.ia64", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.ppc", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.s390", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.s390x", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.x86_64", "3ES:httpd-0:2.0.46-32.ent.3.i386", "3ES:httpd-0:2.0.46-32.ent.3.ia64", "3ES:httpd-0:2.0.46-32.ent.3.ppc", "3ES:httpd-0:2.0.46-32.ent.3.s390", "3ES:httpd-0:2.0.46-32.ent.3.s390x", "3ES:httpd-0:2.0.46-32.ent.3.src", "3ES:httpd-0:2.0.46-32.ent.3.x86_64", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3ES:httpd-devel-0:2.0.46-32.ent.3.i386", "3ES:httpd-devel-0:2.0.46-32.ent.3.ia64", "3ES:httpd-devel-0:2.0.46-32.ent.3.ppc", "3ES:httpd-devel-0:2.0.46-32.ent.3.s390", "3ES:httpd-devel-0:2.0.46-32.ent.3.s390x", "3ES:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3ES:mod_ssl-1:2.0.46-32.ent.3.i386", "3ES:mod_ssl-1:2.0.46-32.ent.3.ia64", "3ES:mod_ssl-1:2.0.46-32.ent.3.ppc", "3ES:mod_ssl-1:2.0.46-32.ent.3.s390", "3ES:mod_ssl-1:2.0.46-32.ent.3.s390x", "3ES:mod_ssl-1:2.0.46-32.ent.3.x86_64", "3WS:httpd-0:2.0.46-32.ent.3.i386", "3WS:httpd-0:2.0.46-32.ent.3.ia64", "3WS:httpd-0:2.0.46-32.ent.3.ppc", "3WS:httpd-0:2.0.46-32.ent.3.s390", "3WS:httpd-0:2.0.46-32.ent.3.s390x", "3WS:httpd-0:2.0.46-32.ent.3.src", "3WS:httpd-0:2.0.46-32.ent.3.x86_64", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3WS:httpd-devel-0:2.0.46-32.ent.3.i386", "3WS:httpd-devel-0:2.0.46-32.ent.3.ia64", "3WS:httpd-devel-0:2.0.46-32.ent.3.ppc", "3WS:httpd-devel-0:2.0.46-32.ent.3.s390", "3WS:httpd-devel-0:2.0.46-32.ent.3.s390x", "3WS:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3WS:mod_ssl-1:2.0.46-32.ent.3.i386", "3WS:mod_ssl-1:2.0.46-32.ent.3.ia64", "3WS:mod_ssl-1:2.0.46-32.ent.3.ppc", "3WS:mod_ssl-1:2.0.46-32.ent.3.s390", "3WS:mod_ssl-1:2.0.46-32.ent.3.s390x", "3WS:mod_ssl-1:2.0.46-32.ent.3.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0488", }, { category: "external", summary: "RHBZ#430867", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430867", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0488", url: "https://www.cve.org/CVERecord?id=CVE-2004-0488", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0488", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0488", }, ], release_date: "2004-05-17T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2004-07-06T08:35:00+00:00", details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.", product_ids: [ "3AS:httpd-0:2.0.46-32.ent.3.i386", "3AS:httpd-0:2.0.46-32.ent.3.ia64", "3AS:httpd-0:2.0.46-32.ent.3.ppc", "3AS:httpd-0:2.0.46-32.ent.3.s390", "3AS:httpd-0:2.0.46-32.ent.3.s390x", "3AS:httpd-0:2.0.46-32.ent.3.src", "3AS:httpd-0:2.0.46-32.ent.3.x86_64", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3AS:httpd-devel-0:2.0.46-32.ent.3.i386", "3AS:httpd-devel-0:2.0.46-32.ent.3.ia64", "3AS:httpd-devel-0:2.0.46-32.ent.3.ppc", "3AS:httpd-devel-0:2.0.46-32.ent.3.s390", "3AS:httpd-devel-0:2.0.46-32.ent.3.s390x", "3AS:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3AS:mod_ssl-1:2.0.46-32.ent.3.i386", "3AS:mod_ssl-1:2.0.46-32.ent.3.ia64", "3AS:mod_ssl-1:2.0.46-32.ent.3.ppc", "3AS:mod_ssl-1:2.0.46-32.ent.3.s390", "3AS:mod_ssl-1:2.0.46-32.ent.3.s390x", "3AS:mod_ssl-1:2.0.46-32.ent.3.x86_64", "3Desktop:httpd-0:2.0.46-32.ent.3.i386", "3Desktop:httpd-0:2.0.46-32.ent.3.ia64", "3Desktop:httpd-0:2.0.46-32.ent.3.ppc", "3Desktop:httpd-0:2.0.46-32.ent.3.s390", "3Desktop:httpd-0:2.0.46-32.ent.3.s390x", "3Desktop:httpd-0:2.0.46-32.ent.3.src", "3Desktop:httpd-0:2.0.46-32.ent.3.x86_64", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.i386", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.ia64", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.ppc", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.s390", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.s390x", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.i386", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.ia64", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.ppc", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.s390", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.s390x", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.x86_64", "3ES:httpd-0:2.0.46-32.ent.3.i386", "3ES:httpd-0:2.0.46-32.ent.3.ia64", "3ES:httpd-0:2.0.46-32.ent.3.ppc", "3ES:httpd-0:2.0.46-32.ent.3.s390", "3ES:httpd-0:2.0.46-32.ent.3.s390x", "3ES:httpd-0:2.0.46-32.ent.3.src", "3ES:httpd-0:2.0.46-32.ent.3.x86_64", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3ES:httpd-devel-0:2.0.46-32.ent.3.i386", "3ES:httpd-devel-0:2.0.46-32.ent.3.ia64", "3ES:httpd-devel-0:2.0.46-32.ent.3.ppc", "3ES:httpd-devel-0:2.0.46-32.ent.3.s390", "3ES:httpd-devel-0:2.0.46-32.ent.3.s390x", "3ES:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3ES:mod_ssl-1:2.0.46-32.ent.3.i386", "3ES:mod_ssl-1:2.0.46-32.ent.3.ia64", "3ES:mod_ssl-1:2.0.46-32.ent.3.ppc", "3ES:mod_ssl-1:2.0.46-32.ent.3.s390", "3ES:mod_ssl-1:2.0.46-32.ent.3.s390x", "3ES:mod_ssl-1:2.0.46-32.ent.3.x86_64", "3WS:httpd-0:2.0.46-32.ent.3.i386", "3WS:httpd-0:2.0.46-32.ent.3.ia64", "3WS:httpd-0:2.0.46-32.ent.3.ppc", "3WS:httpd-0:2.0.46-32.ent.3.s390", "3WS:httpd-0:2.0.46-32.ent.3.s390x", "3WS:httpd-0:2.0.46-32.ent.3.src", "3WS:httpd-0:2.0.46-32.ent.3.x86_64", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3WS:httpd-devel-0:2.0.46-32.ent.3.i386", "3WS:httpd-devel-0:2.0.46-32.ent.3.ia64", "3WS:httpd-devel-0:2.0.46-32.ent.3.ppc", "3WS:httpd-devel-0:2.0.46-32.ent.3.s390", "3WS:httpd-devel-0:2.0.46-32.ent.3.s390x", "3WS:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3WS:mod_ssl-1:2.0.46-32.ent.3.i386", "3WS:mod_ssl-1:2.0.46-32.ent.3.ia64", "3WS:mod_ssl-1:2.0.46-32.ent.3.ppc", "3WS:mod_ssl-1:2.0.46-32.ent.3.s390", "3WS:mod_ssl-1:2.0.46-32.ent.3.s390x", "3WS:mod_ssl-1:2.0.46-32.ent.3.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2004:342", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_ssl ssl_util_uuencode_binary CA issue", }, { cve: "CVE-2004-0493", ids: [ { system_name: "Red Hat Bugzilla ID", text: "1617211", }, ], notes: [ { category: "description", text: "The ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote attackers to cause a denial of service (memory exhaustion), and possibly an integer signedness error leading to a heap-based buffer overflow on 64 bit systems, via long header lines with large numbers of space or tab characters.", title: "Vulnerability description", }, { category: "summary", text: "security flaw", title: "Vulnerability summary", }, ], product_status: { fixed: [ "3AS:httpd-0:2.0.46-32.ent.3.i386", "3AS:httpd-0:2.0.46-32.ent.3.ia64", "3AS:httpd-0:2.0.46-32.ent.3.ppc", "3AS:httpd-0:2.0.46-32.ent.3.s390", "3AS:httpd-0:2.0.46-32.ent.3.s390x", "3AS:httpd-0:2.0.46-32.ent.3.src", "3AS:httpd-0:2.0.46-32.ent.3.x86_64", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3AS:httpd-devel-0:2.0.46-32.ent.3.i386", "3AS:httpd-devel-0:2.0.46-32.ent.3.ia64", "3AS:httpd-devel-0:2.0.46-32.ent.3.ppc", "3AS:httpd-devel-0:2.0.46-32.ent.3.s390", "3AS:httpd-devel-0:2.0.46-32.ent.3.s390x", "3AS:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3AS:mod_ssl-1:2.0.46-32.ent.3.i386", "3AS:mod_ssl-1:2.0.46-32.ent.3.ia64", "3AS:mod_ssl-1:2.0.46-32.ent.3.ppc", "3AS:mod_ssl-1:2.0.46-32.ent.3.s390", "3AS:mod_ssl-1:2.0.46-32.ent.3.s390x", "3AS:mod_ssl-1:2.0.46-32.ent.3.x86_64", "3Desktop:httpd-0:2.0.46-32.ent.3.i386", "3Desktop:httpd-0:2.0.46-32.ent.3.ia64", "3Desktop:httpd-0:2.0.46-32.ent.3.ppc", "3Desktop:httpd-0:2.0.46-32.ent.3.s390", "3Desktop:httpd-0:2.0.46-32.ent.3.s390x", "3Desktop:httpd-0:2.0.46-32.ent.3.src", "3Desktop:httpd-0:2.0.46-32.ent.3.x86_64", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.i386", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.ia64", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.ppc", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.s390", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.s390x", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.i386", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.ia64", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.ppc", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.s390", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.s390x", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.x86_64", "3ES:httpd-0:2.0.46-32.ent.3.i386", "3ES:httpd-0:2.0.46-32.ent.3.ia64", "3ES:httpd-0:2.0.46-32.ent.3.ppc", "3ES:httpd-0:2.0.46-32.ent.3.s390", "3ES:httpd-0:2.0.46-32.ent.3.s390x", "3ES:httpd-0:2.0.46-32.ent.3.src", "3ES:httpd-0:2.0.46-32.ent.3.x86_64", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3ES:httpd-devel-0:2.0.46-32.ent.3.i386", "3ES:httpd-devel-0:2.0.46-32.ent.3.ia64", "3ES:httpd-devel-0:2.0.46-32.ent.3.ppc", "3ES:httpd-devel-0:2.0.46-32.ent.3.s390", "3ES:httpd-devel-0:2.0.46-32.ent.3.s390x", "3ES:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3ES:mod_ssl-1:2.0.46-32.ent.3.i386", "3ES:mod_ssl-1:2.0.46-32.ent.3.ia64", "3ES:mod_ssl-1:2.0.46-32.ent.3.ppc", "3ES:mod_ssl-1:2.0.46-32.ent.3.s390", "3ES:mod_ssl-1:2.0.46-32.ent.3.s390x", "3ES:mod_ssl-1:2.0.46-32.ent.3.x86_64", "3WS:httpd-0:2.0.46-32.ent.3.i386", "3WS:httpd-0:2.0.46-32.ent.3.ia64", "3WS:httpd-0:2.0.46-32.ent.3.ppc", "3WS:httpd-0:2.0.46-32.ent.3.s390", "3WS:httpd-0:2.0.46-32.ent.3.s390x", "3WS:httpd-0:2.0.46-32.ent.3.src", "3WS:httpd-0:2.0.46-32.ent.3.x86_64", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3WS:httpd-devel-0:2.0.46-32.ent.3.i386", "3WS:httpd-devel-0:2.0.46-32.ent.3.ia64", "3WS:httpd-devel-0:2.0.46-32.ent.3.ppc", "3WS:httpd-devel-0:2.0.46-32.ent.3.s390", "3WS:httpd-devel-0:2.0.46-32.ent.3.s390x", "3WS:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3WS:mod_ssl-1:2.0.46-32.ent.3.i386", "3WS:mod_ssl-1:2.0.46-32.ent.3.ia64", "3WS:mod_ssl-1:2.0.46-32.ent.3.ppc", "3WS:mod_ssl-1:2.0.46-32.ent.3.s390", "3WS:mod_ssl-1:2.0.46-32.ent.3.s390x", "3WS:mod_ssl-1:2.0.46-32.ent.3.x86_64", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0493", }, { category: "external", summary: "RHBZ#1617211", url: "https://bugzilla.redhat.com/show_bug.cgi?id=1617211", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0493", url: "https://www.cve.org/CVERecord?id=CVE-2004-0493", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0493", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0493", }, ], release_date: "2004-06-28T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2004-07-06T08:35:00+00:00", details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains the\ndesired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.", product_ids: [ "3AS:httpd-0:2.0.46-32.ent.3.i386", "3AS:httpd-0:2.0.46-32.ent.3.ia64", "3AS:httpd-0:2.0.46-32.ent.3.ppc", "3AS:httpd-0:2.0.46-32.ent.3.s390", "3AS:httpd-0:2.0.46-32.ent.3.s390x", "3AS:httpd-0:2.0.46-32.ent.3.src", "3AS:httpd-0:2.0.46-32.ent.3.x86_64", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3AS:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3AS:httpd-devel-0:2.0.46-32.ent.3.i386", "3AS:httpd-devel-0:2.0.46-32.ent.3.ia64", "3AS:httpd-devel-0:2.0.46-32.ent.3.ppc", "3AS:httpd-devel-0:2.0.46-32.ent.3.s390", "3AS:httpd-devel-0:2.0.46-32.ent.3.s390x", "3AS:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3AS:mod_ssl-1:2.0.46-32.ent.3.i386", "3AS:mod_ssl-1:2.0.46-32.ent.3.ia64", "3AS:mod_ssl-1:2.0.46-32.ent.3.ppc", "3AS:mod_ssl-1:2.0.46-32.ent.3.s390", "3AS:mod_ssl-1:2.0.46-32.ent.3.s390x", "3AS:mod_ssl-1:2.0.46-32.ent.3.x86_64", "3Desktop:httpd-0:2.0.46-32.ent.3.i386", "3Desktop:httpd-0:2.0.46-32.ent.3.ia64", "3Desktop:httpd-0:2.0.46-32.ent.3.ppc", "3Desktop:httpd-0:2.0.46-32.ent.3.s390", "3Desktop:httpd-0:2.0.46-32.ent.3.s390x", "3Desktop:httpd-0:2.0.46-32.ent.3.src", "3Desktop:httpd-0:2.0.46-32.ent.3.x86_64", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3Desktop:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.i386", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.ia64", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.ppc", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.s390", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.s390x", "3Desktop:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.i386", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.ia64", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.ppc", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.s390", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.s390x", "3Desktop:mod_ssl-1:2.0.46-32.ent.3.x86_64", "3ES:httpd-0:2.0.46-32.ent.3.i386", "3ES:httpd-0:2.0.46-32.ent.3.ia64", "3ES:httpd-0:2.0.46-32.ent.3.ppc", "3ES:httpd-0:2.0.46-32.ent.3.s390", "3ES:httpd-0:2.0.46-32.ent.3.s390x", "3ES:httpd-0:2.0.46-32.ent.3.src", "3ES:httpd-0:2.0.46-32.ent.3.x86_64", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3ES:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3ES:httpd-devel-0:2.0.46-32.ent.3.i386", "3ES:httpd-devel-0:2.0.46-32.ent.3.ia64", "3ES:httpd-devel-0:2.0.46-32.ent.3.ppc", "3ES:httpd-devel-0:2.0.46-32.ent.3.s390", "3ES:httpd-devel-0:2.0.46-32.ent.3.s390x", "3ES:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3ES:mod_ssl-1:2.0.46-32.ent.3.i386", "3ES:mod_ssl-1:2.0.46-32.ent.3.ia64", "3ES:mod_ssl-1:2.0.46-32.ent.3.ppc", "3ES:mod_ssl-1:2.0.46-32.ent.3.s390", "3ES:mod_ssl-1:2.0.46-32.ent.3.s390x", "3ES:mod_ssl-1:2.0.46-32.ent.3.x86_64", "3WS:httpd-0:2.0.46-32.ent.3.i386", "3WS:httpd-0:2.0.46-32.ent.3.ia64", "3WS:httpd-0:2.0.46-32.ent.3.ppc", "3WS:httpd-0:2.0.46-32.ent.3.s390", "3WS:httpd-0:2.0.46-32.ent.3.s390x", "3WS:httpd-0:2.0.46-32.ent.3.src", "3WS:httpd-0:2.0.46-32.ent.3.x86_64", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.i386", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.ia64", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.ppc", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.s390", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.s390x", "3WS:httpd-debuginfo-0:2.0.46-32.ent.3.x86_64", "3WS:httpd-devel-0:2.0.46-32.ent.3.i386", "3WS:httpd-devel-0:2.0.46-32.ent.3.ia64", "3WS:httpd-devel-0:2.0.46-32.ent.3.ppc", "3WS:httpd-devel-0:2.0.46-32.ent.3.s390", "3WS:httpd-devel-0:2.0.46-32.ent.3.s390x", "3WS:httpd-devel-0:2.0.46-32.ent.3.x86_64", "3WS:mod_ssl-1:2.0.46-32.ent.3.i386", "3WS:mod_ssl-1:2.0.46-32.ent.3.ia64", "3WS:mod_ssl-1:2.0.46-32.ent.3.ppc", "3WS:mod_ssl-1:2.0.46-32.ent.3.s390", "3WS:mod_ssl-1:2.0.46-32.ent.3.s390x", "3WS:mod_ssl-1:2.0.46-32.ent.3.x86_64", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2004:342", }, ], threats: [ { category: "impact", details: "Important", }, ], title: "security flaw", }, ], }
rhsa-2004:245
Vulnerability from csaf_redhat
Published
2004-06-14 15:46
Modified
2024-11-21 23:05
Summary
Red Hat Security Advisory: apache, mod_ssl security update
Notes
Topic
Updated httpd and mod_ssl packages that fix minor security issues in
the Apache Web server are now available for Red Hat Enterprise Linux 2.1.
Details
The Apache HTTP Server is a powerful, full-featured, efficient, and
freely-available Web server.
A buffer overflow was found in the Apache proxy module, mod_proxy, which
can be triggered by receiving an invalid Content-Length header. In order
to exploit this issue, an attacker would need an Apache installation
that was configured as a proxy to connect to a malicious site. This would
cause the Apache child processing the request to crash. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2004-0492 to this issue.
On Red Hat Enterprise Linux platforms Red Hat believes this issue cannot
lead to remote code execution. This issue also does not represent a Denial
of Service attack as requests will continue to be handled by other Apache
child processes.
A stack buffer overflow was discovered in mod_ssl which can be triggered if
using the FakeBasicAuth option. If mod_ssl is sent a client certificate
with a subject DN field longer than 6000 characters, a stack overflow can
occur if FakeBasicAuth has been enabled. In order to exploit this issue
the carefully crafted malicious certificate would have to be signed by a
Certificate Authority which mod_ssl is configured to trust. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2004-0488 to this issue.
This update also fixes a DNS handling bug in mod_proxy.
The mod_auth_digest module is now included in the Apache package and should
be used instead of mod_digest for sites requiring Digest authentication.
Red Hat Enterprise Linux 2.1 users of the Apache HTTP Server should upgrade
to these erratum packages, which contains Apache version 1.3.27 with
backported patches correcting these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated httpd and mod_ssl packages that fix minor security issues in\nthe Apache Web server are now available for Red Hat Enterprise Linux 2.1.", title: "Topic", }, { category: "general", text: "The Apache HTTP Server is a powerful, full-featured, efficient, and\nfreely-available Web server.\n\nA buffer overflow was found in the Apache proxy module, mod_proxy, which\ncan be triggered by receiving an invalid Content-Length header. In order\nto exploit this issue, an attacker would need an Apache installation\nthat was configured as a proxy to connect to a malicious site. This would\ncause the Apache child processing the request to crash. The Common\nVulnerabilities and Exposures project (cve.mitre.org) has assigned the name\nCAN-2004-0492 to this issue.\n\nOn Red Hat Enterprise Linux platforms Red Hat believes this issue cannot\nlead to remote code execution. This issue also does not represent a Denial\nof Service attack as requests will continue to be handled by other Apache\nchild processes.\n\nA stack buffer overflow was discovered in mod_ssl which can be triggered if\nusing the FakeBasicAuth option. If mod_ssl is sent a client certificate\nwith a subject DN field longer than 6000 characters, a stack overflow can\noccur if FakeBasicAuth has been enabled. In order to exploit this issue\nthe carefully crafted malicious certificate would have to be signed by a\nCertificate Authority which mod_ssl is configured to trust. The Common\nVulnerabilities and Exposures project (cve.mitre.org) has assigned the name\nCAN-2004-0488 to this issue.\n\nThis update also fixes a DNS handling bug in mod_proxy.\n\nThe mod_auth_digest module is now included in the Apache package and should\nbe used instead of mod_digest for sites requiring Digest authentication.\n\nRed Hat Enterprise Linux 2.1 users of the Apache HTTP Server should upgrade\nto these erratum packages, which contains Apache version 1.3.27 with \nbackported patches correcting these issues.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2004:245", url: "https://access.redhat.com/errata/RHSA-2004:245", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "http://www.apacheweek.com/issues/04-06-11#security", url: "http://www.apacheweek.com/issues/04-06-11#security", }, { category: "external", summary: "122637", url: "https://bugzilla.redhat.com/show_bug.cgi?id=122637", }, { category: "external", summary: "125704", url: "https://bugzilla.redhat.com/show_bug.cgi?id=125704", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2004/rhsa-2004_245.json", }, ], title: "Red Hat Security Advisory: apache, mod_ssl security update", tracking: { current_release_date: "2024-11-21T23:05:23+00:00", generator: { date: "2024-11-21T23:05:23+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2004:245", initial_release_date: "2004-06-14T15:46:00+00:00", revision_history: [ { date: "2004-06-14T15:46:00+00:00", number: "1", summary: "Initial version", }, { date: "2004-06-14T00:00:00+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-21T23:05:23+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", product: { name: "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", product_id: "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:2.1::as", }, }, }, { category: "product_name", name: "Red Hat Linux Advanced Workstation 2.1", product: { name: "Red Hat Linux Advanced Workstation 2.1", product_id: "Red Hat Linux Advanced Workstation 2.1", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:2.1::aw", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux ES version 2.1", product: { name: "Red Hat Enterprise Linux ES version 2.1", product_id: "Red Hat Enterprise Linux ES version 2.1", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:2.1::es", }, }, }, { category: "product_name", name: "Red Hat Enterprise Linux WS version 2.1", product: { name: "Red Hat Enterprise Linux WS version 2.1", product_id: "Red Hat Enterprise Linux WS version 2.1", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:2.1::ws", }, }, }, ], category: "product_family", name: "Red Hat Enterprise Linux", }, ], category: "vendor", name: "Red Hat", }, ], }, vulnerabilities: [ { cve: "CVE-2004-0488", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430867", }, ], notes: [ { category: "description", text: "Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.", title: "Vulnerability description", }, { category: "summary", text: "mod_ssl ssl_util_uuencode_binary CA issue", title: "Vulnerability summary", }, ], product_status: { fixed: [ "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", "Red Hat Enterprise Linux ES version 2.1", "Red Hat Enterprise Linux WS version 2.1", "Red Hat Linux Advanced Workstation 2.1", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0488", }, { category: "external", summary: "RHBZ#430867", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430867", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0488", url: "https://www.cve.org/CVERecord?id=CVE-2004-0488", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0488", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0488", }, ], release_date: "2004-05-17T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2004-06-14T15:46:00+00:00", details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains\nthe desired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.\n\nIf up2date fails to connect to Red Hat Network due to SSL\nCertificate Errors, you need to install a version of the\nup2date client with an updated certificate. The latest version of\nup2date is available from the Red Hat FTP site and may also be\ndownloaded directly from the RHN website:\n\nhttps://rhn.redhat.com/help/latest-up2date.pxt", product_ids: [ "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", "Red Hat Enterprise Linux ES version 2.1", "Red Hat Enterprise Linux WS version 2.1", "Red Hat Linux Advanced Workstation 2.1", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2004:245", }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "mod_ssl ssl_util_uuencode_binary CA issue", }, { cve: "CVE-2004-0492", ids: [ { system_name: "Red Hat Bugzilla ID", text: "430527", }, ], notes: [ { category: "description", text: "Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31 allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via a negative Content-Length HTTP header field, which causes a large amount of data to be copied.", title: "Vulnerability description", }, { category: "summary", text: "httpd mod_proxy buffer overflow", title: "Vulnerability summary", }, ], product_status: { fixed: [ "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", "Red Hat Enterprise Linux ES version 2.1", "Red Hat Enterprise Linux WS version 2.1", "Red Hat Linux Advanced Workstation 2.1", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-0492", }, { category: "external", summary: "RHBZ#430527", url: "https://bugzilla.redhat.com/show_bug.cgi?id=430527", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-0492", url: "https://www.cve.org/CVERecord?id=CVE-2004-0492", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-0492", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0492", }, ], release_date: "2004-06-10T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2004-06-14T15:46:00+00:00", details: "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nTo update all RPMs for your particular architecture, run:\n\nrpm -Fvh [filenames]\n\nwhere [filenames] is a list of the RPMs you wish to upgrade. Only those\nRPMs which are currently installed will be updated. Those RPMs which are\nnot installed but included in the list will not be updated. Note that you\ncan also use wildcards (*.rpm) if your current directory *only* contains\nthe desired RPMs.\n\nPlease note that this update is also available via Red Hat Network. Many\npeople find this an easier way to apply updates. To use Red Hat Network,\nlaunch the Red Hat Update Agent with the following command:\n\nup2date\n\nThis will start an interactive process that will result in the appropriate\nRPMs being upgraded on your system.\n\nIf up2date fails to connect to Red Hat Network due to SSL\nCertificate Errors, you need to install a version of the\nup2date client with an updated certificate. The latest version of\nup2date is available from the Red Hat FTP site and may also be\ndownloaded directly from the RHN website:\n\nhttps://rhn.redhat.com/help/latest-up2date.pxt", product_ids: [ "Red Hat Enterprise Linux AS (Advanced Server) version 2.1 ", "Red Hat Enterprise Linux ES version 2.1", "Red Hat Enterprise Linux WS version 2.1", "Red Hat Linux Advanced Workstation 2.1", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2004:245", }, ], threats: [ { category: "impact", details: "Low", }, ], title: "httpd mod_proxy buffer overflow", }, ], }
fkie_cve-2004-0488
Vulnerability from fkie_nvd
Published
2004-07-07 04:00
Modified
2025-04-03 01:03
Severity ?
Summary
Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| apache | http_server | * | |
| debian | debian_linux | 3.0 | |
| redhat | enterprise_linux_server | 2.0 | |
| redhat | enterprise_linux_workstation | 2.0 |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*", matchCriteriaId: "B71C49F3-0F7C-4B25-AB0D-BBB2A0C5144F", versionEndExcluding: "2.0.50", versionStartIncluding: "2.0.35", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:debian:debian_linux:3.0:*:*:*:*:*:*:*", matchCriteriaId: "2CAE037F-111C-4A76-8FFE-716B74D65EF3", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:o:redhat:enterprise_linux_server:2.0:*:*:*:*:*:*:*", matchCriteriaId: "0F9EF63F-DDA3-448B-92D7-27ED92C51FED", vulnerable: true, }, { criteria: "cpe:2.3:o:redhat:enterprise_linux_workstation:2.0:*:*:*:*:*:*:*", matchCriteriaId: "53A61204-33CE-422F-8285-20A5E98ADF3F", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.", }, { lang: "es", value: "Desbordamiento de búfer basado en la pila en la función ssl_util_uuencode_binary en ssl_util.c de mod_ssl de Apache cuando se configura mod_ssl para que confie en la Autoridad Certificadora emisora, puede permitir a atacantes remotos ejecutar código arbitrario mediante un certificado de cliente con un DN de asunto grande.", }, ], id: "CVE-2004-0488", lastModified: "2025-04-03T01:03:51.193", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "HIGH", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 7.5, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P", version: "2.0", }, exploitabilityScore: 10, impactScore: 6.4, obtainAllPrivilege: false, obtainOtherPrivilege: true, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], }, published: "2004-07-07T04:00:00.000", references: [ { source: "cve@mitre.org", tags: [ "Broken Link", ], url: "ftp://patches.sgi.com/support/free/security/advisories/20040605-01-U.asc", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", ], url: "http://lists.grok.org.uk/pipermail/full-disclosure/2004-May/021610.html", }, { source: "cve@mitre.org", tags: [ "Issue Tracking", "Mailing List", "Third Party Advisory", ], url: "http://marc.info/?l=bugtraq&m=108567431823750&w=2", }, { source: "cve@mitre.org", tags: [ "Issue Tracking", "Mailing List", "Third Party Advisory", ], url: "http://marc.info/?l=bugtraq&m=108619129727620&w=2", }, { source: "cve@mitre.org", tags: [ "Issue Tracking", "Mailing List", "Third Party Advisory", ], url: "http://marc.info/?l=bugtraq&m=109181600614477&w=2", }, { source: "cve@mitre.org", tags: [ "Issue Tracking", "Mailing List", "Third Party Advisory", ], url: "http://marc.info/?l=bugtraq&m=109215056218824&w=2", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", ], url: "http://rhn.redhat.com/errata/RHSA-2004-245.html", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", ], url: "http://security.gentoo.org/glsa/glsa-200406-05.xml", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", ], url: "http://www.debian.org/security/2004/dsa-532", }, { source: "cve@mitre.org", tags: [ "Broken Link", ], url: "http://www.mandriva.com/security/advisories?name=MDKSA-2004:054", }, { source: "cve@mitre.org", tags: [ "Broken Link", ], url: "http://www.mandriva.com/security/advisories?name=MDKSA-2004:055", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", ], url: "http://www.redhat.com/support/errata/RHSA-2004-342.html", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", ], url: "http://www.redhat.com/support/errata/RHSA-2004-405.html", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", ], url: "http://www.redhat.com/support/errata/RHSA-2005-816.html", }, { source: "cve@mitre.org", tags: [ "Patch", "Third Party Advisory", "VDB Entry", "Vendor Advisory", ], url: "http://www.securityfocus.com/bid/10355", }, { source: "cve@mitre.org", tags: [ "Broken Link", ], url: "http://www.trustix.net/errata/2004/0031/", }, { source: "cve@mitre.org", tags: [ "Broken Link", "Issue Tracking", ], url: "https://bugzilla.fedora.us/show_bug.cgi?id=1888", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", "VDB Entry", ], url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/16214", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/r5001ecf3d6b2bdd0b732e527654248abb264f08390045d30709a92f6%40%3Ccvs.httpd.apache.org%3E", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/raa117ef183f0da9b3f46efbeaa66f7622bd68868a450cae4fd8ed594%40%3Ccvs.httpd.apache.org%3E", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/rd65d8ba68ba17e7deedafbf5bb4899f2ae4dad781d21b931c2941ac3%40%3Ccvs.httpd.apache.org%3E", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/re895fc1736d25c8cf57e102c871613b8aeec9ea26fd8a44e7942b5ab%40%3Ccvs.httpd.apache.org%3E", }, { source: "cve@mitre.org", url: "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E", }, { source: "cve@mitre.org", tags: [ "Third Party Advisory", ], url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11458", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Broken Link", ], url: "ftp://patches.sgi.com/support/free/security/advisories/20040605-01-U.asc", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "http://lists.grok.org.uk/pipermail/full-disclosure/2004-May/021610.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Mailing List", "Third Party Advisory", ], url: "http://marc.info/?l=bugtraq&m=108567431823750&w=2", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Mailing List", "Third Party Advisory", ], url: "http://marc.info/?l=bugtraq&m=108619129727620&w=2", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Mailing List", "Third Party Advisory", ], url: "http://marc.info/?l=bugtraq&m=109181600614477&w=2", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Issue Tracking", "Mailing List", "Third Party Advisory", ], url: "http://marc.info/?l=bugtraq&m=109215056218824&w=2", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "http://rhn.redhat.com/errata/RHSA-2004-245.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "http://security.gentoo.org/glsa/glsa-200406-05.xml", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "http://www.debian.org/security/2004/dsa-532", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Broken Link", ], url: "http://www.mandriva.com/security/advisories?name=MDKSA-2004:054", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Broken Link", ], url: "http://www.mandriva.com/security/advisories?name=MDKSA-2004:055", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "http://www.redhat.com/support/errata/RHSA-2004-342.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "http://www.redhat.com/support/errata/RHSA-2004-405.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "http://www.redhat.com/support/errata/RHSA-2005-816.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Patch", "Third Party Advisory", "VDB Entry", "Vendor Advisory", ], url: "http://www.securityfocus.com/bid/10355", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Broken Link", ], url: "http://www.trustix.net/errata/2004/0031/", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Broken Link", "Issue Tracking", ], url: "https://bugzilla.fedora.us/show_bug.cgi?id=1888", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", "VDB Entry", ], url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/16214", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79%40%3Ccvs.httpd.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc%40%3Ccvs.httpd.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b%40%3Ccvs.httpd.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/r5001ecf3d6b2bdd0b732e527654248abb264f08390045d30709a92f6%40%3Ccvs.httpd.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb%40%3Ccvs.httpd.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142%40%3Ccvs.httpd.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/raa117ef183f0da9b3f46efbeaa66f7622bd68868a450cae4fd8ed594%40%3Ccvs.httpd.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/rd65d8ba68ba17e7deedafbf5bb4899f2ae4dad781d21b931c2941ac3%40%3Ccvs.httpd.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/re895fc1736d25c8cf57e102c871613b8aeec9ea26fd8a44e7942b5ab%40%3Ccvs.httpd.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Third Party Advisory", ], url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11458", }, ], sourceIdentifier: "cve@mitre.org", vendorComments: [ { comment: "Fixed in Apache HTTP Server 2.0.50:\nhttp://httpd.apache.org/security/vulnerabilities_20.html", lastModified: "2008-07-02T00:00:00", organization: "Apache", }, ], vulnStatus: "Deferred", weaknesses: [ { description: [ { lang: "en", value: "CWE-787", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
gsd-2004-0488
Vulnerability from gsd
Modified
2023-12-13 01:22
Details
Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.
Aliases
Aliases
{ GSD: { alias: "CVE-2004-0488", description: "Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.", id: "GSD-2004-0488", references: [ "https://www.suse.com/security/cve/CVE-2004-0488.html", "https://www.debian.org/security/2004/dsa-532", "https://access.redhat.com/errata/RHSA-2008:0523", "https://access.redhat.com/errata/RHSA-2005:816", "https://access.redhat.com/errata/RHSA-2004:405", "https://access.redhat.com/errata/RHSA-2004:342", "https://access.redhat.com/errata/RHSA-2004:245", ], }, gsd: { metadata: { exploitCode: "unknown", remediation: "unknown", reportConfidence: "confirmed", type: "vulnerability", }, osvSchema: { aliases: [ "CVE-2004-0488", ], details: "Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.", id: "GSD-2004-0488", modified: "2023-12-13T01:22:54.483654Z", schema_version: "1.4.0", }, }, namespaces: { "cve.org": { CVE_data_meta: { ASSIGNER: "cve@mitre.org", ID: "CVE-2004-0488", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "n/a", version: { version_data: [ { version_value: "n/a", }, ], }, }, ], }, vendor_name: "n/a", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "n/a", }, ], }, ], }, references: { reference_data: [ { name: "2004-0031", refsource: "TRUSTIX", url: "http://www.trustix.net/errata/2004/0031/", }, { name: "oval:org.mitre.oval:def:11458", refsource: "OVAL", url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11458", }, { name: "MDKSA-2004:054", refsource: "MANDRAKE", url: "http://www.mandriva.com/security/advisories?name=MDKSA-2004:054", }, { name: "RHSA-2004:342", refsource: "REDHAT", url: "http://www.redhat.com/support/errata/RHSA-2004-342.html", }, { name: "RHSA-2004:245", refsource: "REDHAT", url: "http://rhn.redhat.com/errata/RHSA-2004-245.html", }, { name: "GLSA-200406-05", refsource: "GENTOO", url: "http://security.gentoo.org/glsa/glsa-200406-05.xml", }, { name: "20040527 [OpenPKG-SA-2004.026] OpenPKG Security Advisory (apache)", refsource: "BUGTRAQ", url: "http://marc.info/?l=bugtraq&m=108567431823750&w=2", }, { name: "RHSA-2004:405", refsource: "REDHAT", url: "http://www.redhat.com/support/errata/RHSA-2004-405.html", }, { name: "SSRT4788", refsource: "HP", url: "http://marc.info/?l=bugtraq&m=109215056218824&w=2", }, { name: "20040605-01-U", refsource: "SGI", url: "ftp://patches.sgi.com/support/free/security/advisories/20040605-01-U.asc", }, { name: "RHSA-2005:816", refsource: "REDHAT", url: "http://www.redhat.com/support/errata/RHSA-2005-816.html", }, { name: "SSRT4777", refsource: "HP", url: "http://marc.info/?l=bugtraq&m=109181600614477&w=2", }, { name: "20040517 mod_ssl ssl_util_uuencode_binary potential problem", refsource: "FULLDISC", url: "http://lists.grok.org.uk/pipermail/full-disclosure/2004-May/021610.html", }, { name: "10355", refsource: "BID", url: "http://www.securityfocus.com/bid/10355", }, { name: "DSA-532", refsource: "DEBIAN", url: "http://www.debian.org/security/2004/dsa-532", }, { name: "FLSA:1888", refsource: "FEDORA", url: "https://bugzilla.fedora.us/show_bug.cgi?id=1888", }, { name: "MDKSA-2004:055", refsource: "MANDRAKE", url: "http://www.mandriva.com/security/advisories?name=MDKSA-2004:055", }, { name: "apache-modssl-uuencode-bo(16214)", refsource: "XF", url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/16214", }, { name: "20040601 TSSA-2004-008 - apache", refsource: "BUGTRAQ", url: "http://marc.info/?l=bugtraq&m=108619129727620&w=2", }, { name: "[httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20200401 svn commit: r1058586 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20200401 svn commit: r1058587 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073139 [3/13] - in /websites/staging/httpd/trunk/content: ./ security/json/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/re895fc1736d25c8cf57e102c871613b8aeec9ea26fd8a44e7942b5ab@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1888194 [3/13] - /httpd/site/trunk/content/security/json/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/rd65d8ba68ba17e7deedafbf5bb4899f2ae4dad781d21b931c2941ac3@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073140 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073143 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073149 [3/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/raa117ef183f0da9b3f46efbeaa66f7622bd68868a450cae4fd8ed594@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210606 svn commit: r1075470 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", url: "https://lists.apache.org/thread.html/r5001ecf3d6b2bdd0b732e527654248abb264f08390045d30709a92f6@%3Ccvs.httpd.apache.org%3E", }, ], }, }, "nvd.nist.gov": { configurations: { CVE_data_version: "4.0", nodes: [ { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*", cpe_name: [], versionEndExcluding: "2.0.50", versionStartIncluding: "2.0.35", vulnerable: true, }, ], operator: "OR", }, { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:o:debian:debian_linux:3.0:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, ], operator: "OR", }, { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:o:redhat:enterprise_linux_server:2.0:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:o:redhat:enterprise_linux_workstation:2.0:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, ], operator: "OR", }, ], }, cve: { CVE_data_meta: { ASSIGNER: "cve@mitre.org", ID: "CVE-2004-0488", }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "en", value: "Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "en", value: "CWE-787", }, ], }, ], }, references: { reference_data: [ { name: "10355", refsource: "BID", tags: [ "Patch", "Third Party Advisory", "VDB Entry", "Vendor Advisory", ], url: "http://www.securityfocus.com/bid/10355", }, { name: "20040517 mod_ssl ssl_util_uuencode_binary potential problem", refsource: "FULLDISC", tags: [ "Third Party Advisory", ], url: "http://lists.grok.org.uk/pipermail/full-disclosure/2004-May/021610.html", }, { name: "DSA-532", refsource: "DEBIAN", tags: [ "Third Party Advisory", ], url: "http://www.debian.org/security/2004/dsa-532", }, { name: "FLSA:1888", refsource: "FEDORA", tags: [ "Broken Link", "Issue Tracking", ], url: "https://bugzilla.fedora.us/show_bug.cgi?id=1888", }, { name: "2004-0031", refsource: "TRUSTIX", tags: [ "Broken Link", ], url: "http://www.trustix.net/errata/2004/0031/", }, { name: "GLSA-200406-05", refsource: "GENTOO", tags: [ "Third Party Advisory", ], url: "http://security.gentoo.org/glsa/glsa-200406-05.xml", }, { name: "RHSA-2004:245", refsource: "REDHAT", tags: [ "Third Party Advisory", ], url: "http://rhn.redhat.com/errata/RHSA-2004-245.html", }, { name: "RHSA-2004:342", refsource: "REDHAT", tags: [ "Third Party Advisory", ], url: "http://www.redhat.com/support/errata/RHSA-2004-342.html", }, { name: "RHSA-2004:405", refsource: "REDHAT", tags: [ "Third Party Advisory", ], url: "http://www.redhat.com/support/errata/RHSA-2004-405.html", }, { name: "20040605-01-U", refsource: "SGI", tags: [ "Broken Link", ], url: "ftp://patches.sgi.com/support/free/security/advisories/20040605-01-U.asc", }, { name: "RHSA-2005:816", refsource: "REDHAT", tags: [ "Third Party Advisory", ], url: "http://www.redhat.com/support/errata/RHSA-2005-816.html", }, { name: "MDKSA-2004:054", refsource: "MANDRAKE", tags: [ "Broken Link", ], url: "http://www.mandriva.com/security/advisories?name=MDKSA-2004:054", }, { name: "MDKSA-2004:055", refsource: "MANDRAKE", tags: [ "Broken Link", ], url: "http://www.mandriva.com/security/advisories?name=MDKSA-2004:055", }, { name: "20040527 [OpenPKG-SA-2004.026] OpenPKG Security Advisory (apache)", refsource: "BUGTRAQ", tags: [ "Issue Tracking", "Mailing List", "Third Party Advisory", ], url: "http://marc.info/?l=bugtraq&m=108567431823750&w=2", }, { name: "SSRT4788", refsource: "HP", tags: [ "Issue Tracking", "Mailing List", "Third Party Advisory", ], url: "http://marc.info/?l=bugtraq&m=109215056218824&w=2", }, { name: "SSRT4777", refsource: "HP", tags: [ "Issue Tracking", "Mailing List", "Third Party Advisory", ], url: "http://marc.info/?l=bugtraq&m=109181600614477&w=2", }, { name: "20040601 TSSA-2004-008 - apache", refsource: "BUGTRAQ", tags: [ "Issue Tracking", "Mailing List", "Third Party Advisory", ], url: "http://marc.info/?l=bugtraq&m=108619129727620&w=2", }, { name: "apache-modssl-uuencode-bo(16214)", refsource: "XF", tags: [ "Third Party Advisory", "VDB Entry", ], url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/16214", }, { name: "oval:org.mitre.oval:def:11458", refsource: "OVAL", tags: [ "Third Party Advisory", ], url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11458", }, { name: "[httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", tags: [ "Mailing List", "Vendor Advisory", ], url: "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", tags: [ "Mailing List", "Vendor Advisory", ], url: "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20200401 svn commit: r1058586 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", tags: [ "Mailing List", "Vendor Advisory", ], url: "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20200401 svn commit: r1058587 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", tags: [ "Mailing List", "Vendor Advisory", ], url: "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/", refsource: "MLIST", tags: [ "Mailing List", "Vendor Advisory", ], url: "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1888194 [3/13] - /httpd/site/trunk/content/security/json/", refsource: "MLIST", tags: [ "Mailing List", "Vendor Advisory", ], url: "https://lists.apache.org/thread.html/rd65d8ba68ba17e7deedafbf5bb4899f2ae4dad781d21b931c2941ac3@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073140 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", tags: [ "Mailing List", "Vendor Advisory", ], url: "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073149 [3/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/", refsource: "MLIST", tags: [ "Mailing List", "Vendor Advisory", ], url: "https://lists.apache.org/thread.html/raa117ef183f0da9b3f46efbeaa66f7622bd68868a450cae4fd8ed594@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073143 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/", refsource: "MLIST", tags: [ "Mailing List", "Vendor Advisory", ], url: "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073139 [3/13] - in /websites/staging/httpd/trunk/content: ./ security/json/", refsource: "MLIST", tags: [ "Mailing List", "Vendor Advisory", ], url: "https://lists.apache.org/thread.html/re895fc1736d25c8cf57e102c871613b8aeec9ea26fd8a44e7942b5ab@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210606 svn commit: r1075470 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html", refsource: "MLIST", tags: [ "Mailing List", "Vendor Advisory", ], url: "https://lists.apache.org/thread.html/r5001ecf3d6b2bdd0b732e527654248abb264f08390045d30709a92f6@%3Ccvs.httpd.apache.org%3E", }, { name: "[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/", refsource: "MLIST", tags: [ "Mailing List", "Vendor Advisory", ], url: "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E", }, ], }, }, impact: { baseMetricV2: { cvssV2: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "PARTIAL", baseScore: 7.5, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P", version: "2.0", }, exploitabilityScore: 10, impactScore: 6.4, obtainAllPrivilege: false, obtainOtherPrivilege: true, obtainUserPrivilege: false, severity: "HIGH", userInteractionRequired: false, }, }, lastModifiedDate: "2022-09-23T15:23Z", publishedDate: "2004-07-07T04:00Z", }, }, }
ghsa-cwr4-7j4w-3vv9
Vulnerability from github
Published
2022-05-03 03:13
Modified
2022-05-03 03:13
Details
Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.
{ affected: [], aliases: [ "CVE-2004-0488", ], database_specific: { cwe_ids: [], github_reviewed: false, github_reviewed_at: null, nvd_published_at: "2004-07-07T04:00:00Z", severity: "HIGH", }, details: "Stack-based buffer overflow in the ssl_util_uuencode_binary function in ssl_util.c for Apache mod_ssl, when mod_ssl is configured to trust the issuing CA, may allow remote attackers to execute arbitrary code via a client certificate with a long subject DN.", id: "GHSA-cwr4-7j4w-3vv9", modified: "2022-05-03T03:13:03Z", published: "2022-05-03T03:13:03Z", references: [ { type: "ADVISORY", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-0488", }, { type: "WEB", url: "https://bugzilla.fedora.us/show_bug.cgi?id=1888", }, { type: "WEB", url: "https://exchange.xforce.ibmcloud.com/vulnerabilities/16214", }, { type: "WEB", url: "https://lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac@%3Ccvs.httpd.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/5df9bfb86a3b054bb985a45ff9250b0332c9ecc181eec232489e7f79@%3Ccvs.httpd.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/r0276683d8e1e07153fc8642618830ac0ade85b9ae0dc7b07f63bb8fc@%3Ccvs.httpd.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/r2cb985de917e7da0848c440535f65a247754db8b2154a10089e4247b@%3Ccvs.httpd.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/r5001ecf3d6b2bdd0b732e527654248abb264f08390045d30709a92f6@%3Ccvs.httpd.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/r8828e649175df56f1f9e3919938ac7826128525426e2748f0ab62feb@%3Ccvs.httpd.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/r9e8622254184645bc963a1d47c5d47f6d5a36d6f080d8d2c43b2b142@%3Ccvs.httpd.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/raa117ef183f0da9b3f46efbeaa66f7622bd68868a450cae4fd8ed594@%3Ccvs.httpd.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/rd65d8ba68ba17e7deedafbf5bb4899f2ae4dad781d21b931c2941ac3@%3Ccvs.httpd.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/re895fc1736d25c8cf57e102c871613b8aeec9ea26fd8a44e7942b5ab@%3Ccvs.httpd.apache.org%3E", }, { type: "WEB", url: "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E", }, { type: "WEB", url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11458", }, { type: "WEB", url: "http://lists.grok.org.uk/pipermail/full-disclosure/2004-May/021610.html", }, { type: "WEB", url: "http://marc.info/?l=bugtraq&m=108567431823750&w=2", }, { type: "WEB", url: "http://marc.info/?l=bugtraq&m=108619129727620&w=2", }, { type: "WEB", url: "http://marc.info/?l=bugtraq&m=109181600614477&w=2", }, { type: "WEB", url: "http://marc.info/?l=bugtraq&m=109215056218824&w=2", }, { type: "WEB", url: "http://rhn.redhat.com/errata/RHSA-2004-245.html", }, { type: "WEB", url: "http://security.gentoo.org/glsa/glsa-200406-05.xml", }, { type: "WEB", url: "http://www.debian.org/security/2004/dsa-532", }, { type: "WEB", url: "http://www.mandriva.com/security/advisories?name=MDKSA-2004:054", }, { type: "WEB", url: "http://www.mandriva.com/security/advisories?name=MDKSA-2004:055", }, { type: "WEB", url: "http://www.redhat.com/support/errata/RHSA-2004-342.html", }, { type: "WEB", url: "http://www.redhat.com/support/errata/RHSA-2004-405.html", }, { type: "WEB", url: "http://www.redhat.com/support/errata/RHSA-2005-816.html", }, { type: "WEB", url: "http://www.securityfocus.com/bid/10355", }, { type: "WEB", url: "http://www.trustix.net/errata/2004/0031", }, ], schema_version: "1.4.0", severity: [], }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).
Loading…
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.