Chapter 3. Security Fixes

This update includes fixes for the following security related issues:

Expand

ID	Impact	Summary
CVE-2018-0734	Low	openssl: timing side channel attack in the DSA signature algorithm
CVE-2018-0737	Low	openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to recover private keys
CVE-2018-17189	Low	mod_http2: DoS via slow, unneeded request bodies
CVE-2018-17199	Moderate	mod_session_cookie does not respect expiry time
CVE-2019-0196	Low	httpd: mod_http2: read-after-free on a string compare
CVE-2019-0197	Low	httpd: mod_http2: possible crash on late upgrade
CVE-2019-0217	Moderate	httpd: mod_auth_digest: access control bypass due to race condition [jbcs-httpd-2.4.29]
CVE-2019-9511	Important	large amount of data requests leads to denial of service
CVE-2019-9513	Important	flood using PRIORITY frames results in excessive resource consumption
CVE-2019-9516	Important	HTTP/2: 0-length headers lead to denial of service
CVE-2019-9517	Important	HTTP/2: request for large response leads to denial of service