Security update for apache2 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:0779-1 Final 1 1 2021-03-12T16:43:05Z current 2021-03-12T16:43:05Z 2021-03-12T16:43:05Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for apache2 This update for apache2 fixes the following issues: - Fixed potential content spoofing with default error pages(bsc#118270) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2021-779,SUSE-SLE-SDK-12-SP5-2021-779,SUSE-SLE-SERVER-12-SP5-2021-779 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20210779-1/ Link for SUSE-SU-2021:0779-1 https://lists.suse.com/pipermail/sle-security-updates/2021-March/008488.html E-Mail link for SUSE-SU-2021:0779-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1145740 SUSE Bug 1145740 https://bugzilla.suse.com/1182703 SUSE Bug 1182703 https://www.suse.com/security/cve/CVE-2019-10092/ SUSE CVE CVE-2019-10092 page SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Software Development Kit 12 SP5 apache2-2.4.23-29.69.1 apache2-devel-2.4.23-29.69.1 apache2-doc-2.4.23-29.69.1 apache2-event-2.4.23-29.69.1 apache2-example-pages-2.4.23-29.69.1 apache2-prefork-2.4.23-29.69.1 apache2-utils-2.4.23-29.69.1 apache2-worker-2.4.23-29.69.1 apache2-2.4.23-29.69.1 as a component of SUSE Linux Enterprise Server 12 SP5 apache2-doc-2.4.23-29.69.1 as a component of SUSE Linux Enterprise Server 12 SP5 apache2-example-pages-2.4.23-29.69.1 as a component of SUSE Linux Enterprise Server 12 SP5 apache2-prefork-2.4.23-29.69.1 as a component of SUSE Linux Enterprise Server 12 SP5 apache2-utils-2.4.23-29.69.1 as a component of SUSE Linux Enterprise Server 12 SP5 apache2-worker-2.4.23-29.69.1 as a component of SUSE Linux Enterprise Server 12 SP5 apache2-2.4.23-29.69.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 apache2-doc-2.4.23-29.69.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 apache2-example-pages-2.4.23-29.69.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 apache2-prefork-2.4.23-29.69.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 apache2-utils-2.4.23-29.69.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 apache2-worker-2.4.23-29.69.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 apache2-devel-2.4.23-29.69.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5 In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed. CVE-2019-10092 SUSE Linux Enterprise Server 12 SP5:apache2-2.4.23-29.69.1 SUSE Linux Enterprise Server 12 SP5:apache2-doc-2.4.23-29.69.1 SUSE Linux Enterprise Server 12 SP5:apache2-example-pages-2.4.23-29.69.1 SUSE Linux Enterprise Server 12 SP5:apache2-prefork-2.4.23-29.69.1 SUSE Linux Enterprise Server 12 SP5:apache2-utils-2.4.23-29.69.1 SUSE Linux Enterprise Server 12 SP5:apache2-worker-2.4.23-29.69.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:apache2-2.4.23-29.69.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:apache2-doc-2.4.23-29.69.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:apache2-example-pages-2.4.23-29.69.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:apache2-prefork-2.4.23-29.69.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:apache2-utils-2.4.23-29.69.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:apache2-worker-2.4.23-29.69.1 SUSE Linux Enterprise Software Development Kit 12 SP5:apache2-devel-2.4.23-29.69.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20210779-1/ https://www.suse.com/security/cve/CVE-2019-10092.html CVE-2019-10092 https://bugzilla.suse.com/1145740 SUSE Bug 1145740 https://bugzilla.suse.com/1182703 SUSE Bug 1182703