[gentoo-announce] [ GLSA 201710-32 ] Apache: Multiple vulnerabilities - gentoo-announce

From:	Aaron Bauman <bman@g.o>
To:	gentoo-announce@l.g.o
Subject:	[gentoo-announce] [ GLSA 201710-32 ] Apache: Multiple vulnerabilities
Date:	Sun, 29 Oct 2017 23:05:58
Message-Id:	`4500532.aTp2DHZOJv@localhost.localdomain`

1

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

2

Gentoo Linux Security Advisory                           GLSA 201710-32

3

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

4

                                           https://security.gentoo.org/

5

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

6

7

 Severity: Normal

8

    Title: Apache: Multiple vulnerabilities

9

     Date: October 29, 2017

10

     Bugs: #622240, #624868, #631308

11

       ID: 201710-32

12

13

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

14

15

Synopsis

16

========

17

18

Multiple vulnerabilities have been found in Apache, the worst of which

19

may result in the loss of secrets.

20

21

Background

22

==========

23

24

The Apache HTTP server is one of the most popular web servers on the

25

Internet.

26

27

Affected packages

28

=================

29

30

    -------------------------------------------------------------------

31

     Package              /     Vulnerable     /            Unaffected

32

    -------------------------------------------------------------------

33

  1  www-servers/apache         < 2.4.27-r1              >= 2.4.27-r1 

34

35

Description

36

===========

37

38

Multiple vulnerabilities have been discovered in Apache. Please review

39

the referenced CVE identifiers for details.

40

41

Impact

42

======

43

44

The Optionsbleed vulnerability can leak arbitrary memory from the

45

server process that may contain secrets.  Additionally attackers may

46

cause a Denial of Service condition, bypass authentication, or cause

47

information loss.

48

49

Workaround

50

==========

51

52

There is no known workaround at this time.

53

54

Resolution

55

==========

56

57

All Apache users should upgrade to the latest version:

58

59

  # emerge --sync

60

  # emerge --ask --oneshot --verbose ">=www-servers/apache-2.4.27-r1"

61

62

References

63

==========

64

65

[ 1 ] CVE-2017-3167

66

      https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3167

67

[ 2 ] CVE-2017-3169

68

      https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3169

69

[ 3 ] CVE-2017-7659

70

      https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7659

71

[ 4 ] CVE-2017-7668

72

      https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7668

73

[ 5 ] CVE-2017-7679

74

      https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7679

75

[ 6 ] CVE-2017-9788

76

      https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-9788

77

[ 7 ] CVE-2017-9789

78

      https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-9789

79

[ 8 ] CVE-2017-9798

80

      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9798

81

82

Availability

83

============

84

85

This GLSA and any updates to it are available for viewing at

86

the Gentoo Security Website:

87

88

 https://security.gentoo.org/glsa/201710-32

89

90

Concerns?

91

=========

92

93

Security is a primary focus of Gentoo Linux and ensuring the

94

confidentiality and security of our users' machines is of utmost

95

importance to us. Any security concerns should be addressed to

96

security@g.o or alternatively, you may file a bug at

97

https://bugs.gentoo.org.

98

99

License

100

=======

101

102

Copyright 2017 Gentoo Foundation, Inc; referenced text

103

belongs to its owner(s).

104

105

The contents of this document are licensed under the

106

Creative Commons - Attribution / Share Alike license.

107

108

http://creativecommons.org/licenses/by-sa/2.5

Gentoo Archives: gentoo-announce

Attachments

1	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2	Gentoo Linux Security Advisory GLSA 201710-32
3	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4	https://security.gentoo.org/
5	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7	Severity: Normal
8	Title: Apache: Multiple vulnerabilities
9	Date: October 29, 2017
10	Bugs: #622240, #624868, #631308
11	ID: 201710-32
12
13	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15	Synopsis
16	========
17
18	Multiple vulnerabilities have been found in Apache, the worst of which
19	may result in the loss of secrets.
20
21	Background
22	==========
23
24	The Apache HTTP server is one of the most popular web servers on the
25	Internet.
26
27	Affected packages
28	=================
29
30	-------------------------------------------------------------------
31	Package / Vulnerable / Unaffected
32	-------------------------------------------------------------------
33	1 www-servers/apache < 2.4.27-r1 >= 2.4.27-r1
34
35	Description
36	===========
37
38	Multiple vulnerabilities have been discovered in Apache. Please review
39	the referenced CVE identifiers for details.
40
41	Impact
42	======
43
44	The Optionsbleed vulnerability can leak arbitrary memory from the
45	server process that may contain secrets. Additionally attackers may
46	cause a Denial of Service condition, bypass authentication, or cause
47	information loss.
48
49	Workaround
50	==========
51
52	There is no known workaround at this time.
53
54	Resolution
55	==========
56
57	All Apache users should upgrade to the latest version:
58
59	# emerge --sync
60	# emerge --ask --oneshot --verbose ">=www-servers/apache-2.4.27-r1"
61
62	References
63	==========
64
65	[ 1 ] CVE-2017-3167
66	https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3167
67	[ 2 ] CVE-2017-3169
68	https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-3169
69	[ 3 ] CVE-2017-7659
70	https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7659
71	[ 4 ] CVE-2017-7668
72	https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7668
73	[ 5 ] CVE-2017-7679
74	https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7679
75	[ 6 ] CVE-2017-9788
76	https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-9788
77	[ 7 ] CVE-2017-9789
78	https://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-9789
79	[ 8 ] CVE-2017-9798
80	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9798
81
82	Availability
83	============
84
85	This GLSA and any updates to it are available for viewing at
86	the Gentoo Security Website:
87
88	https://security.gentoo.org/glsa/201710-32
89
90	Concerns?
91	=========
92
93	Security is a primary focus of Gentoo Linux and ensuring the
94	confidentiality and security of our users' machines is of utmost
95	importance to us. Any security concerns should be addressed to
96	security@g.o or alternatively, you may file a bug at
97	https://bugs.gentoo.org.
98
99	License
100	=======
101
102	Copyright 2017 Gentoo Foundation, Inc; referenced text
103	belongs to its owner(s).
104
105	The contents of this document are licensed under the
106	Creative Commons - Attribution / Share Alike license.
107
108	http://creativecommons.org/licenses/by-sa/2.5