Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
Received-SPF: pass (athena.apache.org: domain of mike.rumph@oracle.com
 designates 156.151.31.81 as permitted sender)
Message-ID: <53D83968.8070703@oracle.com>
Date: Tue, 29 Jul 2014 17:16:40 -0700
From: Mike Rumph <mike.rumph@oracle.com>
Organization: Oracle Corporation
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
 rv:17.0) Gecko/20130307 Thunderbird/17.0.4
MIME-Version: 1.0
To: users@httpd.apache.org
References: 
 <OF3C37EC9B.03258C6C-ON86257D24.00578950-86257D24.0058B1BB@advantuscapital.com>
In-Reply-To: 
 <OF3C37EC9B.03258C6C-ON86257D24.00578950-86257D24.0058B1BB@advantuscapital.com>
Content-Type: multipart/alternative;
 boundary="------------000404090900000500010008"
Subject: Re: [users@httpd] Reconciling security advisories

--------------000404090900000500010008
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

Hello Michael,

I cannot speak for Red Hat, but the difference between the 2.4 and 2.2 
vulnerabilities page is clear.
The fix for CVE-2014-0226 was announced with the release of Apache httpd 
2.4.10.
The fix will also be included in Apache httpd 2.2.28 which has not yet 
been released.
- 
http://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x/CHANGES?view=markup
The fix for this was applied to the 2.2 branch with revision 1610515.
- http://svn.apache.org/viewvc?view=revision&revision=r1610515

Thanks,

Mike Rumph


On 7/29/2014 9:08 AM, Michael.Beadle@securian.com wrote:
> If a vulnerability is listed on the 2.4 page 
> (https://httpd.apache.org/security/vulnerabilities_24.html) - let's 
> pick on CVE-2014-0226 for mod_status and it is listed as affecting 
> 2.4.9 down to 2.4.1, would 2.2.x also be vulnerable? It is not 
> specifically listed on the 2.2 vulnerability page 
> (https://httpd.apache.org/security/vulnerabilities_22.html).
>
>
> To add to any confusion, we are using the RHEL 6 RPM install of httpd, 
> which is based on 2.2.15 with fixes added. So they have a versioning 
> scheme of 2.2.15-## (currently 30). A new update was released stating 
> that CVE-2014-0226 is corrected.
>
> Did Red Hat re-engineer the 2.4 fix for 2.2?
>
> Thank you for any input anyone may have.
>
>
> ------------------------------------------------------------------------
> *Mike Beadle*
> Engineer - Collaborative Systems, Information Technology  •  Securian 
> Financial Group
> 400 Robert Street North  •  St. Paul, MN 55101-2098
> 651-665-7620
> michael.beadle@securian.com <mailto:michael.beadle@securian.com> • 
> www.securian.com
>
> Securian Financial Group – Financial security /for the long run /®
>
>
> This email transmission and any file attachments may contain 
> confidential information intended solely for the use of the individual 
> or entity to whom it is addressed. If you have received this email 
> message in error, please notify the sender and delete this email from 
> your system. If you are not the intended recipient, you may not 
> disclose, copy, or distribute the contents of this email.


--------------000404090900000500010008
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit

<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body text="#000000" bgcolor="#FFFFFF">
    Hello Michael,<br>
    <br>
    I cannot speak for Red Hat, but the difference between the 2.4 and
    2.2 vulnerabilities page is clear.<br>
    The fix for CVE-2014-0226 was announced with the release of Apache
    httpd 2.4.10.<br>
    The fix will also be included in Apache httpd 2.2.28 which has not
    yet been released.<br>
    -
    <a class="moz-txt-link-freetext" href="http://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x/CHANGES?view=markup">http://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x/CHANGES?view=markup</a>
    <br>
    The fix for this was applied to the 2.2 branch with revision
    1610515.<br>
    - <a class="moz-txt-link-freetext" href="http://svn.apache.org/viewvc?view=revision&amp;revision=r1610515">http://svn.apache.org/viewvc?view=revision&amp;revision=r1610515</a><br>
    <br>
    Thanks,<br>
    <br>
    Mike Rumph<br>
    <br>
    <br>
    <div class="moz-cite-prefix">On 7/29/2014 9:08 AM,
      <a class="moz-txt-link-abbreviated" href="mailto:Michael.Beadle@securian.com">Michael.Beadle@securian.com</a> wrote:<br>
    </div>
    <blockquote
cite="mid:OF3C37EC9B.03258C6C-ON86257D24.00578950-86257D24.0058B1BB@advantuscapital.com"
      type="cite"><font face="sans-serif" size="2">If a vulnerability is
        listed on the 2.4
        page (</font><a moz-do-not-send="true"
        href="https://httpd.apache.org/security/vulnerabilities_24.html"><font
          face="sans-serif" size="2">https://httpd.apache.org/security/vulnerabilities_24.html</font></a><font
        face="sans-serif" size="2">)
        - let's pick on CVE-2014-0226 for mod_status and it is listed as
        affecting
        2.4.9 down to 2.4.1, would 2.2.x also be vulnerable? It is not
        specifically
        listed on the 2.2 vulnerability page (</font><a
        moz-do-not-send="true"
        href="https://httpd.apache.org/security/vulnerabilities_22.html"><font
          face="sans-serif" size="2">https://httpd.apache.org/security/vulnerabilities_22.html</font></a><font
        face="sans-serif" size="2">).</font>
      <br>
      <br>
      <br>
      <font face="sans-serif" size="2">To add to any confusion, we are
        using
        the RHEL 6 RPM install of httpd, which is based on 2.2.15 with
        fixes added.
        So they have a versioning scheme of 2.2.15-## (currently 30). A
        new update
        was released stating that CVE-2014-0226 is corrected. </font>
      <br>
      <br>
      <font face="sans-serif" size="2">Did Red Hat re-engineer the 2.4
        fix
        for 2.2? </font>
      <br>
      <br>
      <font face="sans-serif" size="2">Thank you for any input anyone
        may have.</font>
      <br>
      <br>
      <br>
      <hr><font face="Arial" size="2"><b>Mike Beadle</b></font>
      <br>
      <font face="Arial" size="2" color="#808080">Engineer -
        Collaborative Systems,
        Information Technology  •  Securian Financial Group</font>
      <br>
      <font face="Arial" size="2" color="#808080">400 Robert Street
        North  •
         St. Paul, MN 55101-2098</font>
      <br>
      <font face="Arial" size="2" color="#808080">651-665-7620</font>
      <br>
      <a moz-do-not-send="true"
        href="mailto:michael.beadle@securian.com"><font
          face="sans-serif" size="2" color="blue">michael.beadle@securian.com</font></a><font
        face="Arial" size="2" color="#808080">
         •  </font><a moz-do-not-send="true" href="www.securian.com"><font
          face="sans-serif" size="2" color="blue">www.securian.com</font></a>
      <br>
      <br>
      <font face="Arial" size="2" color="#808080">Securian Financial
        Group –
        Financial security <i>for the long run </i>®</font>
      <br>
      <br>
      <br>
      <font face="Arial" size="1" color="#808080">This email
        transmission and
        any file attachments may contain confidential information
        intended solely
        for the use of the individual or entity to whom it is addressed.
        If you
        have received this email message in error, please notify the
        sender and
        delete this email from your system. If you are not the intended
        recipient,
        you may not disclose, copy, or distribute the contents of this
        email. <br>
      </font><font face="sans-serif" size="2"> </font>
    </blockquote>
    <br>
  </body>
</html>

--------------000404090900000500010008--