[RHSA-2016:1625-02] Important: Red Hat JBoss Core Services Apache HTTP 2.4.6 Service Pack 1 security update

bugzilla at redhat.com bugzilla at redhat.com
Wed Aug 17 19:42:39 UTC 2016

Hash: SHA1

                   Red Hat Security Advisory

Synopsis:          Important: Red Hat JBoss Core Services Apache HTTP 2.4.6 Service Pack 1 security update
Advisory ID:       RHSA-2016:1625-02
Product:           Red Hat JBoss Core Services
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2016-1625.html
Issue date:        2016-08-17
CVE Names:         CVE-2016-5387 

1. Summary:

Red Hat JBoss Core Services Service Pack 1 is now available from the Red
Hat Customer Portal for Solaris and Microsoft Windows systems.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Description:

This release of Red Hat JBoss Core Services Service Pack 1 serves as a
replacement for JBoss Core Services Apache HTTP Server.

Security Fix(es):

* It was discovered that Apache HTTP Server used the value of the Proxy
header from HTTP requests to initialize the HTTP_PROXY environment variable
for CGI scripts, which in turn was incorrectly used by certain HTTP client
implementations to configure the proxy for outgoing HTTP requests. A remote
attacker could possibly use this flaw to redirect HTTP requests performed
by a CGI script to an attacker-controlled proxy via a malicious HTTP
request. (CVE-2016-5387)

Note: After this update, Apache HTTP Server will no longer pass the value
of the Proxy request header to scripts via the HTTP_PROXY environment

Red Hat would like to thank Scott Geary (VendHQ) for reporting this issue.

3. Solution:

The References section of this erratum contains a download link (you must
log in to download the update). Before applying the update, back up your
existing Red Hat JBoss Web Server installation (including all applications
and configuration files).

After installing the updated packages, the httpd daemon will be restarted

4. Bugs fixed (https://bugzilla.redhat.com/):

1353755 - CVE-2016-5387 Apache HTTPD: sets environmental variable based on user supplied Proxy request header

5. References:


6. Contact:

The Red Hat security contact is <secalert at redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2016 Red Hat, Inc.
Version: GnuPG v1


More information about the Jboss-watch-list mailing list