Security update for apache2 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:1714-1 Final 1 1 2017-06-28T19:14:29Z current 2017-06-28T19:14:29Z 2017-06-28T19:14:29Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for apache2 This update for apache2 provides the following fixes: Security issues fixed: - CVE-2017-3167: In Apache use of httpd ap_get_basic_auth_pw() outside of the authentication phase could lead to authentication requirements bypass (bsc#1045065) - CVE-2017-3169: In mod_ssl may have a dereference NULL pointer issue which could lead to denial of service (bsc#1045062) - CVE-2017-7679: In mod_mime can buffer over-read by 1 byte, potentially leading to a crash or information disclosure (bsc#1045060) Non-Security issues fixed: - Remove /usr/bin/http2 symlink only during apache2 package uninstall, not upgrade. (bsc#1041830) - In gensslcert, use hostname when fqdn is too long. (bsc#1035829) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-RPI-12-SP2-2017-1062,SUSE-SLE-SDK-12-SP2-2017-1062,SUSE-SLE-SERVER-12-SP2-2017-1062 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20171714-1/ Link for SUSE-SU-2017:1714-1 https://lists.suse.com/pipermail/sle-security-updates/2017-June/002991.html E-Mail link for SUSE-SU-2017:1714-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1035829 SUSE Bug 1035829 https://bugzilla.suse.com/1041830 SUSE Bug 1041830 https://bugzilla.suse.com/1045060 SUSE Bug 1045060 https://bugzilla.suse.com/1045062 SUSE Bug 1045062 https://bugzilla.suse.com/1045065 SUSE Bug 1045065 https://www.suse.com/security/cve/CVE-2017-3167/ SUSE CVE CVE-2017-3167 page https://www.suse.com/security/cve/CVE-2017-3169/ SUSE CVE CVE-2017-3169 page https://www.suse.com/security/cve/CVE-2017-7679/ SUSE CVE CVE-2017-7679 page SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Software Development Kit 12 SP2 apache2-2.4.23-28.1 apache2-doc-2.4.23-28.1 apache2-example-pages-2.4.23-28.1 apache2-prefork-2.4.23-28.1 apache2-utils-2.4.23-28.1 apache2-worker-2.4.23-28.1 apache2-devel-2.4.23-28.1 apache2-2.4.23-28.1 as a component of SUSE Linux Enterprise Server 12 SP2 apache2-doc-2.4.23-28.1 as a component of SUSE Linux Enterprise Server 12 SP2 apache2-example-pages-2.4.23-28.1 as a component of SUSE Linux Enterprise Server 12 SP2 apache2-prefork-2.4.23-28.1 as a component of SUSE Linux Enterprise Server 12 SP2 apache2-utils-2.4.23-28.1 as a component of SUSE Linux Enterprise Server 12 SP2 apache2-worker-2.4.23-28.1 as a component of SUSE Linux Enterprise Server 12 SP2 apache2-2.4.23-28.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 apache2-doc-2.4.23-28.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 apache2-example-pages-2.4.23-28.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 apache2-prefork-2.4.23-28.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 apache2-utils-2.4.23-28.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 apache2-worker-2.4.23-28.1 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 apache2-2.4.23-28.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 apache2-doc-2.4.23-28.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 apache2-example-pages-2.4.23-28.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 apache2-prefork-2.4.23-28.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 apache2-utils-2.4.23-28.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 apache2-worker-2.4.23-28.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 apache2-devel-2.4.23-28.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed. CVE-2017-3167 SUSE Linux Enterprise Server 12 SP2:apache2-2.4.23-28.1 SUSE Linux Enterprise Server 12 SP2:apache2-doc-2.4.23-28.1 SUSE Linux Enterprise Server 12 SP2:apache2-example-pages-2.4.23-28.1 SUSE Linux Enterprise Server 12 SP2:apache2-prefork-2.4.23-28.1 SUSE Linux Enterprise Server 12 SP2:apache2-utils-2.4.23-28.1 SUSE Linux Enterprise Server 12 SP2:apache2-worker-2.4.23-28.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:apache2-2.4.23-28.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:apache2-doc-2.4.23-28.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:apache2-example-pages-2.4.23-28.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:apache2-prefork-2.4.23-28.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:apache2-utils-2.4.23-28.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:apache2-worker-2.4.23-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:apache2-2.4.23-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:apache2-doc-2.4.23-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:apache2-example-pages-2.4.23-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:apache2-prefork-2.4.23-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:apache2-utils-2.4.23-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:apache2-worker-2.4.23-28.1 SUSE Linux Enterprise Software Development Kit 12 SP2:apache2-devel-2.4.23-28.1 moderate 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171714-1/ https://www.suse.com/security/cve/CVE-2017-3167.html CVE-2017-3167 https://bugzilla.suse.com/1045065 SUSE Bug 1045065 https://bugzilla.suse.com/1078450 SUSE Bug 1078450 In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port. CVE-2017-3169 SUSE Linux Enterprise Server 12 SP2:apache2-2.4.23-28.1 SUSE Linux Enterprise Server 12 SP2:apache2-doc-2.4.23-28.1 SUSE Linux Enterprise Server 12 SP2:apache2-example-pages-2.4.23-28.1 SUSE Linux Enterprise Server 12 SP2:apache2-prefork-2.4.23-28.1 SUSE Linux Enterprise Server 12 SP2:apache2-utils-2.4.23-28.1 SUSE Linux Enterprise Server 12 SP2:apache2-worker-2.4.23-28.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:apache2-2.4.23-28.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:apache2-doc-2.4.23-28.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:apache2-example-pages-2.4.23-28.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:apache2-prefork-2.4.23-28.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:apache2-utils-2.4.23-28.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:apache2-worker-2.4.23-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:apache2-2.4.23-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:apache2-doc-2.4.23-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:apache2-example-pages-2.4.23-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:apache2-prefork-2.4.23-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:apache2-utils-2.4.23-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:apache2-worker-2.4.23-28.1 SUSE Linux Enterprise Software Development Kit 12 SP2:apache2-devel-2.4.23-28.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171714-1/ https://www.suse.com/security/cve/CVE-2017-3169.html CVE-2017-3169 https://bugzilla.suse.com/1045062 SUSE Bug 1045062 https://bugzilla.suse.com/1078450 SUSE Bug 1078450 In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header. CVE-2017-7679 SUSE Linux Enterprise Server 12 SP2:apache2-2.4.23-28.1 SUSE Linux Enterprise Server 12 SP2:apache2-doc-2.4.23-28.1 SUSE Linux Enterprise Server 12 SP2:apache2-example-pages-2.4.23-28.1 SUSE Linux Enterprise Server 12 SP2:apache2-prefork-2.4.23-28.1 SUSE Linux Enterprise Server 12 SP2:apache2-utils-2.4.23-28.1 SUSE Linux Enterprise Server 12 SP2:apache2-worker-2.4.23-28.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:apache2-2.4.23-28.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:apache2-doc-2.4.23-28.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:apache2-example-pages-2.4.23-28.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:apache2-prefork-2.4.23-28.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:apache2-utils-2.4.23-28.1 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:apache2-worker-2.4.23-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:apache2-2.4.23-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:apache2-doc-2.4.23-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:apache2-example-pages-2.4.23-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:apache2-prefork-2.4.23-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:apache2-utils-2.4.23-28.1 SUSE Linux Enterprise Server for SAP Applications 12 SP2:apache2-worker-2.4.23-28.1 SUSE Linux Enterprise Software Development Kit 12 SP2:apache2-devel-2.4.23-28.1 moderate 4 AV:N/AC:H/Au:N/C:P/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20171714-1/ https://www.suse.com/security/cve/CVE-2017-7679.html CVE-2017-7679 https://bugzilla.suse.com/1045060 SUSE Bug 1045060 https://bugzilla.suse.com/1057861 SUSE Bug 1057861 https://bugzilla.suse.com/1078450 SUSE Bug 1078450