Bug 2217408

Summary:	Missing security updates in httpd
Product:	Red Hat Enterprise Linux 8	Reporter:	Jan ONDREJ <ondrejj>
Component:	httpd	Assignee:	Luboš Uhliarik <luhliari>
Status:	CLOSED CURRENTRELEASE	QA Contact:	rhel-cs-infra-services-qe <rhel-cs-infra-services-qe>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	CentOS Stream	CC:	bstinson, jorton, jwboyer, luhliari
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-06-27 09:36:44 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jan ONDREJ 2023-06-26 08:06:31 UTC

Description of problem:
Security updates have been released for RHEL, but not applied to CentOS Stream. According to web page CentOS Stream is still a supported distribution, so can you please let us know, why updates are not applied automatically? More than year ago same problem, currently 6 CVE's are still not updated in CentOS Stream.

Version-Release number of selected component (if applicable):
httpd-2.4.37-54.module_el8.8.0+1256+e1598b50.x86_64

Additional info:
My old bug with similiar problem:
https://bugzilla.redhat.com/show_bug.cgi?id=2042795

These changes are still waiting to be updated:

* Št apr 27 2023 Luboš Uhliarik <luhliari> - 2.4.37-56.6
- Resolves: #2190133 - mod_rewrite regression with CVE-2023-25690

* So mar 18 2023 Luboš Uhliarik <luhliari> - 2.4.37-56.4
- Resolves: #2177748 - CVE-2023-25690 httpd:2.4/httpd: HTTP request splitting
  with mod_rewrite and mod_proxy

* Ut jan 31 2023 Luboš Uhliarik <luhliari> - 2.4.37-56
- Resolves: #2162499 - CVE-2006-20001 httpd: mod_dav: out-of-bounds read/write
  of zero byte
- Resolves: #2162485 - CVE-2022-37436 httpd: mod_proxy: HTTP response splitting
- Resolves: #2162509 - CVE-2022-36760 httpd: mod_proxy_ajp: Possible request
  smuggling

* Št jan 26 2023 Luboš Uhliarik <luhliari> - 2.4.37-55
- Resolves: #2155961 - prevent sscg creating /dhparams.pem

Comment 1 Joe Orton 2023-06-27 09:23:19 UTC

These fixes are present in https://kojihub.stream.centos.org/koji/buildinfo?buildID=33670 though it looks like that module build is not the latest so it may be stuck in gating or something. Checking.

Comment 2 Joe Orton 2023-06-27 09:36:44 UTC

There were a bunch of test failures when this went through CI so it was blocked in gating while we investigated those. We've waived the last of these so it should show up soon.