RHSA-2022:1136: Red Hat Security Advisory: httpd security update

Skip to navigation Skip to main content

Utilities

• Subscriptions
• Downloads
• Containers
• Support Cases

Infrastructure and Management

• Red Hat Enterprise Linux
• Red Hat Virtualization
• Red Hat Identity Management
• Red Hat Directory Server
• Red Hat Certificate System
• Red Hat Satellite
• Red Hat Subscription Management
• Red Hat Update Infrastructure
• Red Hat Insights
• Red Hat Ansible Automation Platform

Cloud Computing

• Red Hat OpenShift
• Red Hat CloudForms
• Red Hat OpenStack Platform
• Red Hat OpenShift Container Platform
• Red Hat OpenShift Data Science
• Red Hat OpenShift Online
• Red Hat OpenShift Dedicated
• Red Hat Advanced Cluster Security for Kubernetes
• Red Hat Advanced Cluster Management for Kubernetes
• Red Hat Quay
• Red Hat CodeReady Workspaces
• Red Hat OpenShift Service on AWS

Storage

• Red Hat Gluster Storage
• Red Hat Hyperconverged Infrastructure
• Red Hat Ceph Storage
• Red Hat OpenShift Data Foundation

Runtimes

• Red Hat Runtimes
• Red Hat JBoss Enterprise Application Platform
• Red Hat Data Grid
• Red Hat JBoss Web Server
• Red Hat Single Sign On
• Red Hat support for Spring Boot
• Red Hat build of Node.js
• Red Hat build of Thorntail
• Red Hat build of Eclipse Vert.x
• Red Hat build of OpenJDK
• Red Hat build of Quarkus
• Red Hat CodeReady Studio

Integration and Automation

• Red Hat Process Automation
• Red Hat Process Automation Manager
• Red Hat Decision Manager

All Products

Issued:

2022-03-30

Updated:

2022-03-30

RHSA-2022:1136 - Security Advisory

• Overview
• Updated Packages

Synopsis

Important: httpd security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for httpd is now available for Red Hat Enterprise Linux 7.6 Advanced Update Support, Red Hat Enterprise Linux 7.6 Telco Extended Update Support, and Red Hat Enterprise Linux 7.6 Update Services for SAP Solutions.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

• httpd: mod_lua: Possible buffer overflow when parsing multipart content (CVE-2021-44790)
• httpd: Errors encountered during the discarding of request body lead to HTTP request smuggling (CVE-2022-22720)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, the httpd daemon will be restarted automatically.

Affected Products

• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux Server - Update Services for SAP Solutions 7.6 x86_64

Fixes

• BZ - 2034674 - CVE-2021-44790 httpd: mod_lua: Possible buffer overflow when parsing multipart content
• BZ - 2064321 - CVE-2022-22720 httpd: Errors encountered during the discarding of request body lead to HTTP request smuggling

Red Hat Enterprise Linux Server - AUS 7.6

SRPM

httpd-2.4.6-89.el7_6.4.src.rpm

SHA-256: 32cdfde3700621973162cf27f0ccfa6998caf5b0cf7378057f6e9bbc571d3356

x86_64

httpd-2.4.6-89.el7_6.4.x86_64.rpm

SHA-256: a839d814a8a021ea01d6a89224deb4190074487c9f81a1f1190ac8072251cbc8

httpd-debuginfo-2.4.6-89.el7_6.4.x86_64.rpm

SHA-256: bdb0396fd582bf3054e4ef87a336a5a6b1a9798bd4e65ed27e13c1cadcd9a790

httpd-debuginfo-2.4.6-89.el7_6.4.x86_64.rpm

SHA-256: bdb0396fd582bf3054e4ef87a336a5a6b1a9798bd4e65ed27e13c1cadcd9a790

httpd-devel-2.4.6-89.el7_6.4.x86_64.rpm

SHA-256: bb8331cb32d545380bf78a658b48ef12d695c72662a87407982d9c0bc4e409ec

httpd-manual-2.4.6-89.el7_6.4.noarch.rpm

SHA-256: 3871b51b5d4a4b0d568a818b0c778d16048cb3838f4593288a75e88b865820b2

httpd-tools-2.4.6-89.el7_6.4.x86_64.rpm

SHA-256: 6ef4f1c7b98af77e7963f160cc5eb9c59edeb55b66fc92211318d7fffa7f5cf3

mod_ldap-2.4.6-89.el7_6.4.x86_64.rpm

SHA-256: 45bf199514a64f7693b22f7f30da1f374272cfdb00ee2bd4f31dc0778b70058c

mod_proxy_html-2.4.6-89.el7_6.4.x86_64.rpm

SHA-256: 5c82fb90525d63910583dda154ee069e30c9e79dfbdcb438a3a1d524f08885f2

mod_session-2.4.6-89.el7_6.4.x86_64.rpm

SHA-256: 71dcadef0c1c2828fbb45a0913959738b9d1fb3d3d7d94094858ac12dbef28d8

mod_ssl-2.4.6-89.el7_6.4.x86_64.rpm

SHA-256: d3349053f035de4164953d2f1be38eb6d61302c440163c42d8ec2d870c2e29c0

Red Hat Enterprise Linux Server - TUS 7.6

SRPM

httpd-2.4.6-89.el7_6.4.src.rpm

SHA-256: 32cdfde3700621973162cf27f0ccfa6998caf5b0cf7378057f6e9bbc571d3356

x86_64

httpd-2.4.6-89.el7_6.4.x86_64.rpm

SHA-256: a839d814a8a021ea01d6a89224deb4190074487c9f81a1f1190ac8072251cbc8

httpd-debuginfo-2.4.6-89.el7_6.4.x86_64.rpm

SHA-256: bdb0396fd582bf3054e4ef87a336a5a6b1a9798bd4e65ed27e13c1cadcd9a790

httpd-debuginfo-2.4.6-89.el7_6.4.x86_64.rpm

SHA-256: bdb0396fd582bf3054e4ef87a336a5a6b1a9798bd4e65ed27e13c1cadcd9a790

httpd-devel-2.4.6-89.el7_6.4.x86_64.rpm

SHA-256: bb8331cb32d545380bf78a658b48ef12d695c72662a87407982d9c0bc4e409ec

httpd-manual-2.4.6-89.el7_6.4.noarch.rpm

SHA-256: 3871b51b5d4a4b0d568a818b0c778d16048cb3838f4593288a75e88b865820b2

httpd-tools-2.4.6-89.el7_6.4.x86_64.rpm

SHA-256: 6ef4f1c7b98af77e7963f160cc5eb9c59edeb55b66fc92211318d7fffa7f5cf3

mod_ldap-2.4.6-89.el7_6.4.x86_64.rpm

SHA-256: 45bf199514a64f7693b22f7f30da1f374272cfdb00ee2bd4f31dc0778b70058c

mod_proxy_html-2.4.6-89.el7_6.4.x86_64.rpm

SHA-256: 5c82fb90525d63910583dda154ee069e30c9e79dfbdcb438a3a1d524f08885f2

mod_session-2.4.6-89.el7_6.4.x86_64.rpm

SHA-256: 71dcadef0c1c2828fbb45a0913959738b9d1fb3d3d7d94094858ac12dbef28d8

mod_ssl-2.4.6-89.el7_6.4.x86_64.rpm

SHA-256: d3349053f035de4164953d2f1be38eb6d61302c440163c42d8ec2d870c2e29c0

Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 7.6

SRPM

httpd-2.4.6-89.el7_6.4.src.rpm

SHA-256: 32cdfde3700621973162cf27f0ccfa6998caf5b0cf7378057f6e9bbc571d3356

ppc64le

httpd-2.4.6-89.el7_6.4.ppc64le.rpm

SHA-256: 6d3a27d96a658bdcbbd96bac7a0ed826ce368085008a328e11b817be1d2ae2df

httpd-debuginfo-2.4.6-89.el7_6.4.ppc64le.rpm

SHA-256: 2bcfbe5a4f21be48c14d68303bc3a6e4b72dfd811056dba0d7ee84a91f5090e3

httpd-debuginfo-2.4.6-89.el7_6.4.ppc64le.rpm

SHA-256: 2bcfbe5a4f21be48c14d68303bc3a6e4b72dfd811056dba0d7ee84a91f5090e3

httpd-devel-2.4.6-89.el7_6.4.ppc64le.rpm

SHA-256: cf87895b86766c9ec2bba3ae2efe9464a43a30d10756244f164c4642b1c37685

httpd-manual-2.4.6-89.el7_6.4.noarch.rpm

SHA-256: 3871b51b5d4a4b0d568a818b0c778d16048cb3838f4593288a75e88b865820b2

httpd-tools-2.4.6-89.el7_6.4.ppc64le.rpm

SHA-256: b59bb73a40e4038f7ecb85390d0c2e8f19593287eb3fdec39a75e5dff0fc996e

mod_ldap-2.4.6-89.el7_6.4.ppc64le.rpm

SHA-256: c2223d2248cf98855c41139093b6d35bd288b3f1b831997c1d0e6313cead43bc

mod_proxy_html-2.4.6-89.el7_6.4.ppc64le.rpm

SHA-256: d2e66c52ad224b771e3b9d6e8f6f0bff1d443f551e4fa54a4e01c44b6f95e31e

mod_session-2.4.6-89.el7_6.4.ppc64le.rpm

SHA-256: 03af336b0d99f929e752559339e66c9218e69eb789c77f3695f6615edbd08c79

mod_ssl-2.4.6-89.el7_6.4.ppc64le.rpm

SHA-256: 389eb9522de5de3d4c5a0bfb9737d0d3efaad67250cb56b47e7d7f0ed2de8ba0

Red Hat Enterprise Linux Server - Update Services for SAP Solutions 7.6

SRPM

httpd-2.4.6-89.el7_6.4.src.rpm

SHA-256: 32cdfde3700621973162cf27f0ccfa6998caf5b0cf7378057f6e9bbc571d3356

x86_64

httpd-2.4.6-89.el7_6.4.x86_64.rpm

SHA-256: a839d814a8a021ea01d6a89224deb4190074487c9f81a1f1190ac8072251cbc8

httpd-debuginfo-2.4.6-89.el7_6.4.x86_64.rpm

SHA-256: bdb0396fd582bf3054e4ef87a336a5a6b1a9798bd4e65ed27e13c1cadcd9a790

httpd-debuginfo-2.4.6-89.el7_6.4.x86_64.rpm

SHA-256: bdb0396fd582bf3054e4ef87a336a5a6b1a9798bd4e65ed27e13c1cadcd9a790

httpd-devel-2.4.6-89.el7_6.4.x86_64.rpm

SHA-256: bb8331cb32d545380bf78a658b48ef12d695c72662a87407982d9c0bc4e409ec

httpd-manual-2.4.6-89.el7_6.4.noarch.rpm

SHA-256: 3871b51b5d4a4b0d568a818b0c778d16048cb3838f4593288a75e88b865820b2

httpd-tools-2.4.6-89.el7_6.4.x86_64.rpm

SHA-256: 6ef4f1c7b98af77e7963f160cc5eb9c59edeb55b66fc92211318d7fffa7f5cf3

mod_ldap-2.4.6-89.el7_6.4.x86_64.rpm

SHA-256: 45bf199514a64f7693b22f7f30da1f374272cfdb00ee2bd4f31dc0778b70058c

mod_proxy_html-2.4.6-89.el7_6.4.x86_64.rpm

SHA-256: 5c82fb90525d63910583dda154ee069e30c9e79dfbdcb438a3a1d524f08885f2

mod_session-2.4.6-89.el7_6.4.x86_64.rpm

SHA-256: 71dcadef0c1c2828fbb45a0913959738b9d1fb3d3d7d94094858ac12dbef28d8

mod_ssl-2.4.6-89.el7_6.4.x86_64.rpm

SHA-256: d3349053f035de4164953d2f1be38eb6d61302c440163c42d8ec2d870c2e29c0

The Red Hat security contact is [email protected]. More contact details at https://access.redhat.com/security/team/contact/.