+++ This bug was initially created as a clone of Bug #1305629 +++ Description of problem: Depending upon how software analyzes for CVE/Security Issues this may or may not be as important. 1- CVE Secuity vulnerability description: https://access.redhat.com/security/cve/cve-2014-0226 2- Redhat errata patch details: https://rhn.redhat.com/errata/RHSA-2014-0920.html The changelog appears to have a typo CVE-2014-0026 should instead be CVE-2014-0226 [root@acme01 tmp]# rpm -q --changelog httpd |grep 2014 * Fri Jul 18 2014 Weinan Li <weli> - 2.26.35 - Add missing CVE-2014-0231.patch * Fri Jul 18 2014 Weinan Li <weli> - 2.26.34 - CVE-2014-0026 - CVE-2014-0118 - CVE-2014-0231 * Tue Jun 03 2014 Dustin Kut Moy Cheung <dcheung> - 2.26.33 * Wed May 07 2014 Dustin Kut Moy Cheung <dcheung> - 2.26.32 - Apply fix for CVE 2013-6438 and CVE 2014-0098 * Fri Mar 28 2014 Permaine Cheung <pcheung> - 2.2.26.31 * Tue Mar 04 2014 Weinan Li <weli> - 2.2.26.30 * Tue Mar 04 2014 Weinan Li <weli> - 2.2.26.29 * Mon Mar 03 2014 Weinan Li <weli> - 2.2.26-28 * Thu Feb 27 2014 Weinan Li <weli> - 2.2.26-27 * Wed Feb 26 2014 Weinan Li <weli> - 2.2.26-26 Version-Release number of selected component (if applicable): Latest version --- Additional comment from Dave Sullivan on 2016-02-08 14:00:50 EST --- As can been seen from the changelog from the httpd from rhel-6-server-rpms channel ... * Thu Jul 17 2014 Jan Kaluza <jkaluza> - 2.2.15-38 - mod_cgid: add security fix for CVE-2014-0231 - mod_deflate: add security fix for CVE-2014-0118 - mod_status: add security fix for CVE-2014-0226 <----cve is correct here ... --- Additional comment from Dave Sullivan on 2016-02-08 14:03:07 EST --- Not completely sure if the vulnerability scanner is looking at changelogs but is is failing, personally I think the scanner is failing for other reasons. But it doesn't help the cause when the typo is there in the changelogs.
Besides the changelog, the patch has been named CVE-2014-0026.patch as well. To change that in the rpm, we will need a full rebuild on RHEL 5, 6 and 7 and as our regular EAP 6 CP does not include native changes, this will require a one-off effort. For the time being, I've fixed the name of the patch, the patching and the CL entry in distgit: http://pkgs.devel.redhat.com/cgit/rpms/httpd/commit/?h=jb-eap-6.4-rhel-6&id=aa0985f37bee59de1a53b22905b57212a941077f http://pkgs.devel.redhat.com/cgit/rpms/httpd22/commit/?h=jb-eap-6.4-rhel-6&id=85cb4995ccc23fe5412f16813490874fb95c8358 so that any future builds will have the proper CVE number in there. Please also note that after rpms are updated, in order to keep the same MD5sum between the zip and the rpm, we'll need to update the httpd in our RHEL native zips on RHEL 5, 6 and 7 so that they match. Please advise if we're doing this for a one-off.
make sure the http://git.app.eng.bos.redhat.com/git/httpd.git contain the right message.
it's all in lookaside repo now VERIFIED
Retroactively bulk-closing issues from released EAP 6.4 cumulative patches.