Apache HTTP Server allows remote attackers to obtain information via (1)
the ETag header, which reveals the inode number, or (2) multipart MIME
boundary, which reveals child proccess IDs (PID).
Red Hat does not consider this to be a security issue. The information returned poses no threat to the target machine running httpd.
Recent upstream discussion and upstream bug report:
As pointed out there, content of the ETag header can be controlled using the FileETag directive. Its default value is: INode MTime Size
Changing to MTime Size will cause httpd to not use file INode in the ETag headers.