Bug 18871 - apache new security issue CVE-2016-4979
Summary: apache new security issue CVE-2016-4979
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: Cauldron
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: Thomas Backlund
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/694240/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-07-05 20:15 CEST by David Walser
Modified: 2016-07-12 19:05 CEST (History)
1 user (show)

See Also:
Source RPM: apache-2.4.20-3.mga6.src.rpm
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description David Walser 2016-07-05 20:15:44 CEST 
A security issue in Apache HTTPD has been announced today (July 5):
http://openwall.com/lists/oss-security/2016/07/05/5

This sounds like a serious issue for organizations that are using client certificates to access (usually internal) websites.

The issue has been fixed upstream in 2.4.23, and r1750779 in their SVN.

Mageia 5 is not affected.
Comment 1 Thomas Backlund 2016-07-06 03:40:18 CEST 
I pushed 2.4.23 to cauldron along with fixes for systemd 230 detection

Status: NEW => RESOLVED
CC: (none) => tmb
Resolution: (none) => FIXED
Assignee: bugsquad => tmb

David Walser 2016-07-12 19:05:40 CEST

URL: (none) => http://lwn.net/Vulnerabilities/694240/
Note You need to log in before you can comment on or make changes to this bug.