ELBA-2025-8417

ELBA-2025-8417 - httpd:2.4 bug fix and enhancement update

Type:	BUG
Impact:	NA
Release Date:	2025-06-03

Description

httpd
[2.4.37-65.4.0.1]
- Replace index.html with Oracle's index page oracle_index.html

[2.4.37-65.4]
- Resolves: RHEL-87641 - apache Bug 63192 - mod_ratelimit breaks HEAD requests

[2.4.37-65.3]
- Resolves: RHEL-56068 - Apache HTTPD no longer parse PHP files with
unicode characters in the name

[2.4.37-65.2]
- Resolves: RHEL-46040 - httpd:2.4/httpd: Security issues via backend
applications whose response headers are malicious or exploitable (CVE-2024-38476)
- Resolves: RHEL-53022 - Regression introduced by CVE-2024-38474 fix

[2.4.37-65.1]
- Resolves: RHEL-45812 - httpd:2.4/httpd: Substitution encoding issue
in mod_rewrite (CVE-2024-38474)
- Resolves: RHEL-45785 - httpd:2.4/httpd: Encoding problem in
mod_proxy (CVE-2024-38473)
- Resolves: RHEL-45777 - httpd:2.4/httpd: Improper escaping of output
in mod_rewrite (CVE-2024-38475)
- Resolves: RHEL-45758 - httpd:2.4/httpd: null pointer dereference
in mod_proxy (CVE-2024-38477)
- Resolves: RHEL-45743 - httpd:2.4/httpd: Potential SSRF
in mod_rewrite (CVE-2024-39573)

mod_http2
[1.15.7-10.3]
- Resolves: RHEL-58454 - mod_proxy_http2 failures after CVE-2024-38477 fix
- Resolves: RHEL-59017 - random failures in other requests on http/2 stream
when client resets one request

[1.15.7-10.2]
- Resolves: RHEL-71575: Wrong Content-Type when proxying using H2 protocol

[1.15.7-10.1]
- Resolves: RHEL-46214 - Access logs and ErrorDocument don't work when HTTP431
occurs using http/2 on RHEL8

mod_md

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 8 (aarch64)	httpd-2.4.37-65.0.1.module+el8.10.0+90597+64bb2ac6.4.src.rpm	51fa6a542b174cf71898997dcfc2e4ef44947ab7f68d04e4ed52cda2ef79aa18	-	ol8_aarch64_appstream
	mod_http2-1.15.7-10.module+el8.10.0+90597+64bb2ac6.3.src.rpm	a93b441d812c8e1201cc9cbf1991a005b8a439de68972d4f07d62f441fd7b63a	-	ol8_aarch64_appstream
	mod_md-2.0.8-8.module+el8.9.0+90011+2f9c6a23.src.rpm	b87cd8c00082bf38a8aefb4fbac1eab758639da7e4dfe2387c661fb396a928c0	-	ol8_aarch64_appstream
	httpd-2.4.37-65.0.1.module+el8.10.0+90597+64bb2ac6.4.aarch64.rpm	4984009b7a4d30f8ca18b921135b0c039425f496ee3112faaf86ceaa8b912625	-	ol8_aarch64_appstream
	httpd-devel-2.4.37-65.0.1.module+el8.10.0+90597+64bb2ac6.4.aarch64.rpm	c1381ca5b081b75739183dd2de89e9677165b58ac0348ef842e59d3fd8cc7e10	-	ol8_aarch64_appstream
	httpd-filesystem-2.4.37-65.0.1.module+el8.10.0+90597+64bb2ac6.4.noarch.rpm	10c9ccd96ca4290b8a3f31c7d696d56105670332d6debe3b27ba3f79a3331b79	-	ol8_aarch64_appstream
	httpd-manual-2.4.37-65.0.1.module+el8.10.0+90597+64bb2ac6.4.noarch.rpm	a239fccc3d1c5e6a58f11d7c6da747e392670b5831ec4b0f9dca74ce53129d81	-	ol8_aarch64_appstream
	httpd-tools-2.4.37-65.0.1.module+el8.10.0+90597+64bb2ac6.4.aarch64.rpm	798f95390a29bb49912eebecd5f8a0afa4593261a0d513ec390c2e11236c8746	-	ol8_aarch64_appstream
	mod_http2-1.15.7-10.module+el8.10.0+90597+64bb2ac6.3.aarch64.rpm	b61b2239d66bbfcbb113ba756553c247ea80f91b66bed101ae1d7f0a8081f67c	-	ol8_aarch64_appstream
	mod_ldap-2.4.37-65.0.1.module+el8.10.0+90597+64bb2ac6.4.aarch64.rpm	782d3657a52e911f258ff7cee8b349b5358484f4de3a58dac33c1f2a3b934f07	-	ol8_aarch64_appstream
	mod_md-2.0.8-8.module+el8.9.0+90011+2f9c6a23.aarch64.rpm	09a6be461741ad2673d307ce619821ea92b3acadfc247ab13d17267c1c6011a6	-	ol8_aarch64_appstream
	mod_proxy_html-2.4.37-65.0.1.module+el8.10.0+90597+64bb2ac6.4.aarch64.rpm	b253ed7178e0940bfa1f7513dcb12c19aabd2ee561d2704570655aa513dfbbb5	-	ol8_aarch64_appstream
	mod_session-2.4.37-65.0.1.module+el8.10.0+90597+64bb2ac6.4.aarch64.rpm	69f88a9228784ab09bf3407eca685a2f099a7a3118b36f0c79c97d7cd3274ca5	-	ol8_aarch64_appstream
	mod_ssl-2.4.37-65.0.1.module+el8.10.0+90597+64bb2ac6.4.aarch64.rpm	bb29ce26e757b5fdaa110676b17300b51f85e843506cd2988783e050b5666e2e	-	ol8_aarch64_appstream
Oracle Linux 8 (x86_64)	httpd-2.4.37-65.0.1.module+el8.10.0+90597+64bb2ac6.4.src.rpm	51fa6a542b174cf71898997dcfc2e4ef44947ab7f68d04e4ed52cda2ef79aa18	-	ol8_x86_64_appstream
	mod_http2-1.15.7-10.module+el8.10.0+90597+64bb2ac6.3.src.rpm	a93b441d812c8e1201cc9cbf1991a005b8a439de68972d4f07d62f441fd7b63a	-	ol8_x86_64_appstream
	mod_md-2.0.8-8.module+el8.9.0+90011+2f9c6a23.src.rpm	b87cd8c00082bf38a8aefb4fbac1eab758639da7e4dfe2387c661fb396a928c0	-	ol8_x86_64_appstream
	httpd-2.4.37-65.0.1.module+el8.10.0+90597+64bb2ac6.4.x86_64.rpm	b188f71c7e270867da4c3606323069594f642a59c4a2529ce0b0430108225516	-	ol8_x86_64_appstream
	httpd-devel-2.4.37-65.0.1.module+el8.10.0+90597+64bb2ac6.4.x86_64.rpm	eab162a6f3b183e8b37210bd79062e21a3a267bc496e759d5ad99b427487a0be	-	ol8_x86_64_appstream
	httpd-filesystem-2.4.37-65.0.1.module+el8.10.0+90597+64bb2ac6.4.noarch.rpm	10c9ccd96ca4290b8a3f31c7d696d56105670332d6debe3b27ba3f79a3331b79	-	ol8_x86_64_appstream
	httpd-manual-2.4.37-65.0.1.module+el8.10.0+90597+64bb2ac6.4.noarch.rpm	a239fccc3d1c5e6a58f11d7c6da747e392670b5831ec4b0f9dca74ce53129d81	-	ol8_x86_64_appstream
	httpd-tools-2.4.37-65.0.1.module+el8.10.0+90597+64bb2ac6.4.x86_64.rpm	377605373764321b44e734052c810557779cda9001a879f7190ff01de75b1e44	-	ol8_x86_64_appstream
	mod_http2-1.15.7-10.module+el8.10.0+90597+64bb2ac6.3.x86_64.rpm	15a1c4cb3bde76aef45d5a53c3d41254e7ee7654bfa092fd919ca7fb67465af6	-	ol8_x86_64_appstream
	mod_ldap-2.4.37-65.0.1.module+el8.10.0+90597+64bb2ac6.4.x86_64.rpm	c4c2206b3664adea31b812d1bc11231bec61703a0a813e8bc06c76f6a1b260bf	-	ol8_x86_64_appstream
	mod_md-2.0.8-8.module+el8.9.0+90011+2f9c6a23.x86_64.rpm	48e6e9c15ca6394c944f472135dd176c00267760d8f627ddb37e95407ebacbbb	-	ol8_x86_64_appstream
	mod_proxy_html-2.4.37-65.0.1.module+el8.10.0+90597+64bb2ac6.4.x86_64.rpm	139950f18e0dd2ecd7cd90ba52bfc5dc5cf746bf4b6fb398302f4451451d8295	-	ol8_x86_64_appstream
	mod_session-2.4.37-65.0.1.module+el8.10.0+90597+64bb2ac6.4.x86_64.rpm	dca0ed4668e1e037987820e127f8fc0ccdc76d04507590507a3604c0c7893504	-	ol8_x86_64_appstream
	mod_ssl-2.4.37-65.0.1.module+el8.10.0+90597+64bb2ac6.4.x86_64.rpm	67cc6a15de459517fd476455048544a2b1b3c8e5b9a3a189c5cb97ba476e8f71	-	ol8_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team