Security update for apache2 SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2015:1684-1 Final 1 1 2015-09-25T09:29:47Z current 2015-09-25T09:29:47Z 2015-09-25T09:29:47Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for apache2 Apache2 was updated to fix security issues. - CVE-2015-3185: The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x did not consider that a Require directive may be associated with an authorization setting rather than an authentication setting, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging the presence of a module that relies on the 2.2 API behavior. [bnc#938723] - CVE-2015-3183: The chunked transfer coding implementation in the Apache HTTP Server did not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension characters in modules/http/http_filters.c. [bnc#938728] On openSUSE 13.1: - CVE-2015-4000: Fix Logjam vulnerability: change the default SSLCipherSuite cipherstring to disable export cipher suites and deploy Ephemeral Elliptic-Curve Diffie-Hellman (ECDHE) ciphers. Adjust 'gensslcert' script to generate a strong and unique Diffie Hellman Group and append it to the server certificate file [bnc#931723]. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-updates/2015-10/msg00011.html E-Mail link for openSUSE-SU-2015:1684-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings apache2-2.4.6-6.50.1 apache2-devel-2.4.6-6.50.1 apache2-doc-2.4.6-6.50.1 apache2-event-2.4.6-6.50.1 apache2-example-pages-2.4.6-6.50.1 apache2-prefork-2.4.6-6.50.1 apache2-utils-2.4.6-6.50.1 apache2-worker-2.4.6-6.50.1 The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension characters in modules/http/http_filters.c. CVE-2015-3183 moderate Please Install the update. https://lists.opensuse.org/opensuse-updates/2015-10/msg00011.html https://www.suse.com/security/cve/CVE-2015-3183.html CVE-2015-3183 https://bugzilla.suse.com/938728 SUSE Bug 938728 https://bugzilla.suse.com/948325 SUSE Bug 948325 https://bugzilla.suse.com/949218 SUSE Bug 949218 The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an authorization setting rather than an authentication setting, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging the presence of a module that relies on the 2.2 API behavior. CVE-2015-3185 low Please Install the update. https://lists.opensuse.org/opensuse-updates/2015-10/msg00011.html https://www.suse.com/security/cve/CVE-2015-3185.html CVE-2015-3185 https://bugzilla.suse.com/938723 SUSE Bug 938723 https://bugzilla.suse.com/939514 SUSE Bug 939514 https://bugzilla.suse.com/939516 SUSE Bug 939516 The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue. CVE-2015-4000 important 7.3 AV:N/AC:H/Au:N/C:C/I:C/A:P Please Install the update. https://lists.opensuse.org/opensuse-updates/2015-10/msg00011.html https://www.suse.com/security/cve/CVE-2015-4000.html CVE-2015-4000 https://bugzilla.suse.com/1074631 SUSE Bug 1074631 https://bugzilla.suse.com/931600 SUSE Bug 931600 https://bugzilla.suse.com/931698 SUSE Bug 931698 https://bugzilla.suse.com/931723 SUSE Bug 931723 https://bugzilla.suse.com/931845 SUSE Bug 931845 https://bugzilla.suse.com/932026 SUSE Bug 932026 https://bugzilla.suse.com/932483 SUSE Bug 932483 https://bugzilla.suse.com/934789 SUSE Bug 934789 https://bugzilla.suse.com/935033 SUSE Bug 935033 https://bugzilla.suse.com/935540 SUSE Bug 935540 https://bugzilla.suse.com/935979 SUSE Bug 935979 https://bugzilla.suse.com/936168 SUSE Bug 936168 https://bugzilla.suse.com/937202 SUSE Bug 937202 https://bugzilla.suse.com/937724 SUSE Bug 937724 https://bugzilla.suse.com/937766 SUSE Bug 937766 https://bugzilla.suse.com/938248 SUSE Bug 938248 https://bugzilla.suse.com/938432 SUSE Bug 938432 https://bugzilla.suse.com/938895 SUSE Bug 938895 https://bugzilla.suse.com/938905 SUSE Bug 938905 https://bugzilla.suse.com/938906 SUSE Bug 938906 https://bugzilla.suse.com/938913 SUSE Bug 938913 https://bugzilla.suse.com/938945 SUSE Bug 938945 https://bugzilla.suse.com/941696 SUSE Bug 941696 https://bugzilla.suse.com/943664 SUSE Bug 943664 https://bugzilla.suse.com/944729 SUSE Bug 944729 https://bugzilla.suse.com/945582 SUSE Bug 945582 https://bugzilla.suse.com/955589 SUSE Bug 955589 https://bugzilla.suse.com/980406 SUSE Bug 980406 https://bugzilla.suse.com/990592 SUSE Bug 990592