Please Install the Updated Packages.

The httpd packages contain the Apache HTTP Server (httpd), which is the namesake project of The Apache Software Foundation. Input sanitization flaws were found in the mod_negotiation module. A remote attacker able to upload or create files with arbitrary names in a directory that has the MultiViews options enabled, could use these flaws to conduct cross-site scripting and HTTP response splitting attacks against users visiting the site. (CVE-2008-0455, CVE-2008-0456, CVE-2012-2687) Bug fixes: * Previously, no check was made to see if the /etc/pki/tls/private/localhost.key file was a valid key prior to running the &quot %post&quot script for the &quot mod_ssl&quot package. Consequently, when /etc/pki/tls/certs/localhost.crt did not exist and &quot localhost.key&quot was present but invalid, upgrading the Apache HTTP Server daemon (httpd) with mod_ssl failed. The &quot %post&quot script has been fixed to test for an existing SSL key. As a result, upgrading httpd with mod_ssl now proceeds as expected. (BZ#752618) * The &quot mod_ssl&quot module did not support operation under FIPS mode. Consequently, when operating Red Hat Enterprise Linux 5 with FIPS mode enabled, httpd failed to start. An upstream patch has been applied to disable non-FIPS functionality if operating under FIPS mode and httpd now starts as expected. (BZ#773473) * Prior to this update, httpd exit status codes were not Linux Standard Base (LSB) compliant. When the command &quot service httpd reload&quot was run and httpd failed, the exit status code returned was &quot 0&quot and not in the range 1 to 6 as expected. A patch has been applied to the init script and httpd now returns &quot 1&quot as an exit status code. (BZ#783242) * Chunked Transfer Coding is described in RFC 2616. Previously, the Apache server did not correctly handle a chunked encoded POST request with a &quot chunk-size&quot or &quot chunk-extension&quot value of 32 bytes or more. Consequently, when such a POST request was made the server did not respond. An upstream patch has been applied and the problem no longer occurs. (BZ#840845) * Due to a regression, when mod_cache received a non-cacheable 304 response, the headers were served incorrectly. Consequently, compressed data could be returned to the client without the cached headers to indicate the data was compressed. An upstream patch has been applied to merge response and cached headers before data from the cache is served to the client. As a result, cached data is now correctly interpreted by the client. (BZ ... Description truncated, for more information please check the Reference URL

httpd on CentOS 5

• http://lists.centos.org/pipermail/centos-announce/2013-January/019175.html

---

Updated on 2015-03-25