3.26. httpd

Bug Fix

BZ#1012892

Due to a bug in the mod_proxy_httpd module, the error message "proxy: error reading response" was logged into the global error log file even when there was a specific VirtualHost error log file configured. This bug is now fixed and the aforementioned error message is now logged into the correct log file.

Security Fixes

CVE-2013-6438

It was found that the mod_dav module did not correctly strip leading white space from certain elements in a parsed XML. In certain httpd configurations that use the mod_dav module (for example when using the mod_dav_svn module), a remote attacker could send a specially crafted DAV request that would cause the httpd child process to crash or, possibly, allow the attacker to execute arbitrary code with the privileges of the "apache" user.

CVE-2014-0098

A buffer over-read flaw was found in the httpd mod_log_config module. In configurations where cookie logging is enabled (on Red Hat Enterprise Linux it is disabled by default), a remote attacker could use this flaw to crash the httpd child process via an HTTP request with a malformed cookie header.

Bug Fixes

BZ#976465

Previously, the mod_proxy_connect module did not correctly handle signals while waiting for a backend server to close the connection. With this update, signals are ignored while processing connection closure, thus fixing the bug.

BZ#1003073

Due to a bug in the mod_proxy_http module, the "proxy: error reading response" error message was logged into the global error log even when there was a VirtualHost-specific error log configured. With this update, the aforementioned error message is logged into the correct log file.

BZ#1047319

Previously, a bug in handling the attribute values in the mod_ldap module could lead to a segmentation fault when LDAP dynamic groups were configured. The handling of attribute values has been fixed, and mod_ldap now works as intended.

BZ#1101385

Due to a bug in the lock handling in the mod_ldap module, httpd processes could enter a loop continually consuming CPU time in some LDAP configurations. A patch has been applied to correct the lock handling, and LDAP configurations now work correctly.

Enhancements

BZ#1038276

The mod_authnz_ldap module can set environment variables based on LDAP attributes. However, these variables were only available when LDAP authentication was configured. With this update, environment variables are set for LDAP attributes if LDAP is used for authorization only.

BZ#1058426

A mod_ssl configuration with very large Certificate Revocation Lists (CRLs) could result in excessive memory consumption as the CRLs could be cached in the memory. A new configuration directive, "SSLDisableCRLCaching", which disables CRL caching and allows lower memory use in such configurations, has been added to mod_ssl.