Synopsis:          Important: httpd security and bug fix update
Advisory ID:       SLSA-2016:1422-1
Issue Date:        2016-07-18
CVE Numbers:       CVE-2016-5387
--

Security Fix(es):

* It was discovered that httpd used the value of the Proxy header from
HTTP requests to initialize the HTTP_PROXY environment variable for CGI
scripts, which in turn was incorrectly used by certain HTTP client
implementations to configure the proxy for outgoing HTTP requests. A
remote attacker could possibly use this flaw to redirect HTTP requests
performed by a CGI script to an attacker-controlled proxy via a malicious
HTTP request. (CVE-2016-5387)

Note: After this update, httpd will no longer pass the value of the Proxy
request header to scripts via the HTTP_PROXY environment variable.

Bug Fix(es):

* In a caching proxy configuration, the mod_cache module would treat
content as stale if the Expires header changed when refreshing a cached
response. As a consequence, an origin server returning content without a
fixed Expires header would not be treated as cacheable. The mod_cache
module has been fixed to ignore changes in the Expires header when
refreshing content. As a result, such content is now cacheable, improving
performance and reducing load at the origin server.

* The HTTP status code 451 "Unavailable For Legal Reasons" was not usable
in the httpd configuration. As a consequence, modules such as mod_rewrite
could not be configured to return a 451 error if required for legal
purposes. The 451 status code has been added to the list of available
error codes, and modules can now be configured to return a 451 error if
required.
--

SL7
  x86_64
    httpd-2.4.6-40.el7_2.4.x86_64.rpm
    httpd-debuginfo-2.4.6-40.el7_2.4.x86_64.rpm
    httpd-devel-2.4.6-40.el7_2.4.x86_64.rpm
    httpd-tools-2.4.6-40.el7_2.4.x86_64.rpm
    mod_ldap-2.4.6-40.el7_2.4.x86_64.rpm
    mod_proxy_html-2.4.6-40.el7_2.4.x86_64.rpm
    mod_session-2.4.6-40.el7_2.4.x86_64.rpm
    mod_ssl-2.4.6-40.el7_2.4.x86_64.rpm
  noarch
    httpd-manual-2.4.6-40.el7_2.4.noarch.rpm

- Scientific Linux Development Team