Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
First Last Prev Next    This bug is not in your last search results.
Bug 1120601 - (CVE-2014-0118) CVE-2014-0118 httpd: mod_deflate denial of service
CVE-2014-0118 httpd: mod_deflate denial of service
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20140717,repor...
: Security
Depends On: 1120605 1120606 1120607 1120608 1120612 1120613 1120614 1120935 1120936 1120937 1120938 1120939 1120940 1121037 1121038
Blocks: 1064757 1116304 1120610 1120623
  Show dependency tree / graph
 
Reported: 2014-07-17 05:12 EDT by Murray McAllister
Modified: 2015-07-09 22:46 EDT (History)
39 users (show)

See Also:
Fixed In Version: httpd 2.4.10
Doc Type: Bug Fix
Doc Text:
A denial of service flaw was found in the way httpd's mod_deflate module handled request body decompression (configured via the "DEFLATE" input filter). A remote attacker able to send a request whose body would be decompressed could use this flaw to consume an excessive amount of system memory and CPU on the target system.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-07-09 22:46:24 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2014:0920 normal SHIPPED_LIVE Important: httpd security update 2014-07-23 09:19:05 EDT
Red Hat Product Errata RHSA-2014:0921 normal SHIPPED_LIVE Important: httpd security update 2014-07-23 10:00:19 EDT
Red Hat Product Errata RHSA-2014:0922 normal SHIPPED_LIVE Important: httpd24-httpd security update 2014-07-23 10:00:09 EDT
Red Hat Product Errata RHSA-2014:1019 normal SHIPPED_LIVE Important: Red Hat JBoss Enterprise Application Platform 6.3.0 update 2014-08-06 15:06:42 EDT
Red Hat Product Errata RHSA-2014:1020 normal SHIPPED_LIVE Important: Red Hat JBoss Enterprise Application Platform 6.3.0 update 2014-08-06 15:03:06 EDT
Red Hat Product Errata RHSA-2014:1021 normal SHIPPED_LIVE Important: Red Hat JBoss Enterprise Application Platform 6.3.0 update 2014-08-06 14:52:25 EDT
Red Hat Product Errata RHSA-2014:1086 normal SHIPPED_LIVE Important: Red Hat JBoss Web Server 2.1.0 update 2014-08-21 15:30:27 EDT
Red Hat Product Errata RHSA-2014:1087 normal SHIPPED_LIVE Important: Red Hat JBoss Web Server 2.1.0 update 2014-08-21 15:29:44 EDT
Red Hat Product Errata RHSA-2014:1088 normal SHIPPED_LIVE Important: Red Hat JBoss Web Server 2.1.0 update 2014-08-21 15:29:14 EDT

  None (edit)
Description Murray McAllister 2014-07-17 05:12:54 EDT 
The following flaw has been fixed in the Apache HTTP Server:

"A resource consumption flaw was found in mod_deflate. If request body decompression was configured (using the "DEFLATE" input filter), a remote attacker could cause the server to consume significant memory and/or CPU resources. The use of request body decompression is not a common configuration."

External References:

http://httpd.apache.org/security/vulnerabilities_24.html
Comment 2 Murray McAllister 2014-07-17 05:40:23 EDT 
Created httpd tracking bugs for this issue:

Affects: fedora-all [bug 1120614]
Comment 7 Tomas Hoger 2014-07-23 02:50:52 EDT 
Upstream commit:
http://svn.apache.org/viewvc?view=revision&revision=1610501
Comment 8 errata-xmlrpc 2014-07-23 05:19:30 EDT 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5
  Red Hat Enterprise Linux 6

Via RHSA-2014:0920 https://rhn.redhat.com/errata/RHSA-2014-0920.html
Comment 9 errata-xmlrpc 2014-07-23 06:00:55 EDT 
This issue has been addressed in following products:

  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.4 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 7

Via RHSA-2014:0922 https://rhn.redhat.com/errata/RHSA-2014-0922.html
Comment 10 errata-xmlrpc 2014-07-23 06:01:41 EDT 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 7

Via RHSA-2014:0921 https://rhn.redhat.com/errata/RHSA-2014-0921.html
Comment 11 Fedora Update System 2014-07-25 06:03:41 EDT 
httpd-2.4.10-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 12 Martin Prpič 2014-07-28 07:28:34 EDT 
IssueDescription:

A denial of service flaw was found in the way httpd's mod_deflate module handled request body decompression (configured via the "DEFLATE" input filter). A remote attacker able to send a request whose body would be decompressed could use this flaw to consume an excessive amount of system memory and CPU on the target system.
Comment 13 errata-xmlrpc 2014-08-06 10:53:36 EDT 
This issue has been addressed in following products:

  JBoss Enterprise Application Platform 6.3.0

Via RHSA-2014:1021 https://rhn.redhat.com/errata/RHSA-2014-1021.html
Comment 14 errata-xmlrpc 2014-08-06 11:09:25 EDT 
This issue has been addressed in following products:

  JBEAP 6 for RHEL 6

Via RHSA-2014:1020 https://rhn.redhat.com/errata/RHSA-2014-1020.html
Comment 15 errata-xmlrpc 2014-08-06 11:11:40 EDT 
This issue has been addressed in following products:

  JBEAP 6 for RHEL 5

Via RHSA-2014:1019 https://rhn.redhat.com/errata/RHSA-2014-1019.html
Comment 16 Fedora Update System 2014-08-14 22:47:07 EDT 
httpd-2.4.10-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 17 errata-xmlrpc 2014-08-21 11:31:45 EDT 
This issue has been addressed in following products:

  JBEWS 2 for RHEL 5

Via RHSA-2014:1088 https://rhn.redhat.com/errata/RHSA-2014-1088.html
Comment 18 errata-xmlrpc 2014-08-21 11:32:14 EDT 
This issue has been addressed in following products:

  JBEWS 2 for RHEL 6

Via RHSA-2014:1087 https://rhn.redhat.com/errata/RHSA-2014-1087.html
Comment 19 errata-xmlrpc 2014-08-21 11:32:49 EDT 
This issue has been addressed in following products:

  JBoss Web Server 2.1.0

Via RHSA-2014:1086 https://rhn.redhat.com/errata/RHSA-2014-1086.html
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.