httpd (SL7)

Synopsis: Important: httpd security and bug fix update
Advisory ID: SLSA-2016:1422-1
Issue Date: 2016-07-18
CVE Numbers: CVE-2016-5387

Security Fix(es):

* It was discovered that httpd used the value of the Proxy header from
HTTP requests to initialize the HTTP_PROXY environment variable for CGI
scripts, which in turn was incorrectly used by certain HTTP client
implementations to configure the proxy for outgoing HTTP requests. A
remote attacker could possibly use this flaw to redirect HTTP requests
performed by a CGI script to an attacker-controlled proxy via a malicious
HTTP request. (CVE-2016-5387)

Note: After this update, httpd will no longer pass the value of the Proxy
request header to scripts via the HTTP_PROXY environment variable.

Bug Fix(es):

* In a caching proxy configuration, the mod_cache module would treat
content as stale if the Expires header changed when refreshing a cached
response. As a consequence, an origin server returning content without a
fixed Expires header would not be treated as cacheable. The mod_cache
module has been fixed to ignore changes in the Expires header when
refreshing content. As a result, such content is now cacheable, improving
performance and reducing load at the origin server.

* The HTTP status code 451 “Unavailable For Legal Reasons” was not usable
in the httpd configuration. As a consequence, modules such as mod_rewrite
could not be configured to return a 451 error if required for legal
purposes. The 451 status code has been added to the list of available
error codes, and modules can now be configured to return a 451 error if


– Scientific Linux Development Team