The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-3739:01 advisory.

    * httpd: Improper handling of headers in mod_session can allow a remote user to modify session data for     CGI applications (CVE-2018-1283)
    * httpd: Out of bounds read in mod_cache_socache can allow a remote attacker to cause DoS (CVE-2018-1303)
    * httpd: mod_http2: Too much time allocated to workers, possibly leading to DoS (CVE-2018-1333)
    * httpd: DoS for HTTP/2 connections by continuous SETTINGS frames (CVE-2018-11763)
    * httpd: Out of bounds write in mod_authnz_ldap when using too small Accept-Language values     (CVE-2017-15710)
    * httpd:  bypass with a trailing newline in the file name (CVE-2017-15715)
    * httpd: Out of bounds access after failure in reading the HTTP request (CVE-2018-1301)
    * httpd: Weak Digest auth nonce generation in mod_auth_digest (CVE-2018-1312)
    * curl: Multiple security issues were fixed in httpd24-curl (CVE-2016-5419, CVE-2016-5420, CVE-2016-5421,     CVE-2016-7141, CVE-2016-7167, CVE-2016-8615, CVE-2016-8616, CVE-2016-8617, CVE-2016-8618, CVE-2016-8619,     CVE-2016-8620, CVE-2016-8621, CVE-2016-8622, CVE-2016-8623, CVE-2016-8624, CVE-2016-8625, CVE-2016-9586,     CVE-2017-1000100, CVE-2017-1000101, CVE-2017-1000254, CVE-2017-1000257, CVE-2017-7407, CVE-2017-8816,     CVE-2017-8817, CVE-2018-1000007, CVE-2018-1000120, CVE-2018-1000121, CVE-2018-1000122, CVE-2018-1000301,     CVE-2018-14618)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3558 advisory.

    The Apache HTTP Server is a powerful, efficient, and extensible web server. The httpd24 packages provide a     recent stable release of version 2.4 of the Apache HTTP Server, along with the mod_auth_kerb module.

    The following packages have been upgraded to a later upstream version: httpd24-httpd (2.4.34),     httpd24-curl (7.61.1). (BZ#1590833, BZ#1648928)

    Security Fix(es):

    * httpd: Improper handling of headers in mod_session can allow a remote user to modify session data for     CGI applications (CVE-2018-1283)

    * httpd: Out of bounds read in mod_cache_socache can allow a remote attacker to cause DoS (CVE-2018-1303)

    * httpd: mod_http2: Too much time allocated to workers, possibly leading to DoS (CVE-2018-1333)

    * httpd: DoS for HTTP/2 connections by continuous SETTINGS frames (CVE-2018-11763)

    * httpd: Out of bounds write in mod_authnz_ldap when using too small Accept-Language values     (CVE-2017-15710)

    * httpd: <FilesMatch> bypass with a trailing newline in the file name (CVE-2017-15715)

    * httpd: Out of bounds access after failure in reading the HTTP request (CVE-2018-1301)

    * httpd: Weak Digest auth nonce generation in mod_auth_digest (CVE-2018-1312)

    * curl: Multiple security issues were fixed in httpd24-curl (CVE-2016-5419, CVE-2016-5420, CVE-2016-5421,     CVE-2016-7141, CVE-2016-7167, CVE-2016-8615, CVE-2016-8616, CVE-2016-8617, CVE-2016-8618, CVE-2016-8619,     CVE-2016-8620, CVE-2016-8621, CVE-2016-8622, CVE-2016-8623, CVE-2016-8624, CVE-2016-8625, CVE-2016-9586,     CVE-2017-1000100, CVE-2017-1000101, CVE-2017-1000254, CVE-2017-1000257, CVE-2017-7407, CVE-2017-8816,     CVE-2017-8817, CVE-2018-1000007, CVE-2018-1000120, CVE-2018-1000121, CVE-2018-1000122, CVE-2018-1000301,     CVE-2018-14618)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank the Curl project for reporting CVE-2017-8816, CVE-2017-8817, CVE-2017-1000254,     CVE-2017-1000257, CVE-2018-1000007, CVE-2018-1000120, CVE-2018-1000122, CVE-2018-1000301, CVE-2016-9586,     CVE-2017-1000100, CVE-2017-1000101, CVE-2018-14618, and CVE-2018-1000121. Upstream acknowledges Alex     Nichols as the original reporter of CVE-2017-8816; the OSS-Fuzz project as the original reporter of     CVE-2017-8817 and CVE-2018-1000301; Max Dymond as the original reporter of CVE-2017-1000254 and     CVE-2018-1000122; Brian Carpenter and the OSS-Fuzz project as the original reporters of CVE-2017-1000257;
    Craig de Stigter as the original reporter of CVE-2018-1000007; Duy Phan Thanh as the original reporter of     CVE-2018-1000120; Even Rouault as the original reporter of CVE-2017-1000100; Brian Carpenter as the     original reporter of CVE-2017-1000101; Zhaoyang Wu as the original reporter of CVE-2018-14618; and Dario     Weisser as the original reporter of CVE-2018-1000121.

    Bug Fix(es):

    * Previously, the Apache HTTP Server from the httpd24 Software Collection was unable to handle situations     when static content was repeatedly requested in a browser by refreshing the page. As a consequence, HTTP/2     connections timed out and httpd became unresponsive. This bug has been fixed, and HTTP/2 connections now     work as expected in the described scenario. (BZ#1518737)

    Enhancement(s):

    * This update adds the mod_md module to the httpd24 Software Collection. This module enables managing     domains across virtual hosts and certificate provisioning using the Automatic Certificate Management     Environment (ACME) protocol. The mod_md module is available only for Red Hat Enterprise Linux 7.
    (BZ#1640722)

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Software Collections 3.2 Release     Notes linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:0367 advisory.

    Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This     software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged     under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent     update experience.

    This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.29 Service Pack 1 serves as an update     to Red Hat JBoss Core Services Apache HTTP Server 2.4.29, and includes bug fixes for CVEs which are linked     to in the References section.

    Security Fixes:

    * httpd: DoS for HTTP/2 connections by continuous SETTINGS (CVE-2018-11763)

    * httpd: Weak Digest auth nonce generation in mod_auth_digest     (CVE-2018-1312)

    * httpd: Out of bound access after failure in reading the HTTP request     (CVE-2018-1301)

    * httpd: Use-after-free on HTTP/2 stream shutdown (CVE-2018-1302)

    * httpd: <FilesMatch> bypass with a trailing newline in the file name     (CVE-2017-15715)

    * httpd: Out of bound write in mod_authnz_ldap when using too small     Accept-Language values (CVE-2017-15710)

    * httpd: Out of bounds read in mod_cache_socache can allow a remote     attacker to cause a denial of service (CVE-2018-1303)

    * httpd: Improper handling of headers in mod_session can allow a remote     user to modify session data for CGI applications (CVE-2018-1283)

    * httpd: mod_http2: too much time allocated to workers, possibly leading to     DoS (CVE-2018-1333)

    * mod_jk: connector path traversal due to mishandled HTTP requests in httpd     (CVE-2018-11759)

    * nghttp2: Null pointer dereference when too large ALTSVC frame is received     (CVE-2018-1000168)

    * openssl: Handling of crafted recursive ASN.1 structures can cause a stack     overflow and resulting denial of service (CVE-2018-0739)

    Details around each issue, including information about the CVE, severity of     the issue, and the CVSS score, can be found on the CVE pages listed in the     Reference section below.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
289086	MiracleLinux 7 : httpd24-nghttp2-1.7.1-7.el7, httpd24-curl-7.61.1-1.el7, httpd24-httpd-2.4.34-7.el7 (AXSA:2019-3739:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
194113	RHEL 6 / 7 : httpd24 (RHSA-2018:3558)	Nessus	Red Hat Local Security Checks	2024/4/27	2025/3/16	critical
122292	RHEL 6 / 7 : Red Hat JBoss Core Services Apache HTTP Server 2.4.29 (RHSA-2019:0367)	Nessus	Red Hat Local Security Checks	2019/2/19	2024/11/6	critical

検出

プラグインの検索

critical

critical

critical