This release adds the `H2Padding` configuration directive and has various bug fixes.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4751 advisory.

    The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

    The following packages have been upgraded to a later upstream version: mod_http2 (1.15.7). (BZ#1814236)

    Security Fix(es):

    * httpd: memory corruption on early pushes (CVE-2019-10081)

    * httpd: read-after-free in h2 connection shutdown (CVE-2019-10082)

    * httpd: null-pointer dereference in mod_remoteip (CVE-2019-10097)

    * httpd: mod_rewrite configurations vulnerable to open redirect (CVE-2020-1927)

    * httpd: mod_http2: DoS via slow, unneeded request bodies (CVE-2018-17189)

    * httpd: mod_http2: read-after-free on a string compare (CVE-2019-0196)

    * httpd: mod_http2: possible crash on late upgrade (CVE-2019-0197)

    * httpd: limited cross-site scripting in mod_proxy error page (CVE-2019-10092)

    * httpd: mod_rewrite potential open redirect (CVE-2019-10098)

    * httpd: mod_proxy_ftp use of uninitialized value (CVE-2020-1934)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4751 advisory.

  - httpd: mod_http2: DoS via slow, unneeded request bodies (CVE-2018-17189)

  - httpd: mod_http2: read-after-free on a string compare (CVE-2019-0196)

  - httpd: mod_http2: possible crash on late upgrade (CVE-2019-0197)

  - httpd: memory corruption on early pushes (CVE-2019-10081)

  - httpd: read-after-free in h2 connection shutdown (CVE-2019-10082)

  - httpd: limited cross-site scripting in mod_proxy error page (CVE-2019-10092)

  - httpd: null-pointer dereference in mod_remoteip (CVE-2019-10097)

  - httpd: mod_rewrite potential open redirect (CVE-2019-10098)

  - httpd: mod_rewrite configurations vulnerable to open redirect (CVE-2020-1927)

  - httpd: mod_proxy_ftp use of uninitialized value (CVE-2020-1934)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1605 advisory.

    This advisory aggregates security fixes for the mod_http2 SRPM in CIQ LTS 8.6. It addresses 14 CVEs:
    CVE-2023-44487, CVE-2019-9516, CVE-2019-9511, CVE-2019-9517, CVE-2020-11993, and 9 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3932 advisory.

    This release adds the new Apache HTTP Server 2.4.37 packages that are part of the JBoss Core Services     offering.

    This release serves as a replacement for Red Hat JBoss Core Services Pack Apache Server 2.4.29 and     includes bug fixes and enhancements. Refer to the Release Notes for information on the most significant     bug fixes and enhancements included in this release.

    Security Fix(es):

    * openssl: RSA key generation cache timing vulnerability in crypto/rsa/rsa_gen.c allows attackers to     recover private keys (CVE-2018-0737) * openssl: timing side channel attack in the DSA signature algorithm     (CVE-2018-0734) * mod_auth_digest: access control bypass due to race condition (CVE-2019-0217) * openssl:
    Side-channel vulnerability on SMT/Hyper-Threading architectures (PortSmash) (CVE-2018-5407) *     mod_session_cookie does not respect expiry time (CVE-2018-17199) * mod_http2: DoS via slow, unneeded     request bodies (CVE-2018-17189) * mod_http2: possible crash on late upgrade (CVE-2019-0197) * mod_http2:
    read-after-free on a string compare (CVE-2019-0196) * nghttp2: HTTP/2: large amount of data request leads     to denial of service (CVE-2019-9511) * nghttp2: HTTP/2: flood using PRIORITY frames resulting in excessive     resource consumption (CVE-2019-9513) * mod_http2: HTTP/2: 0-length headers leads to denial of service     (CVE-2019-9516) * mod_http2: HTTP/2: request for large response leads to denial of service (CVE-2019-9517)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2020_4751 advisory.

    * httpd: memory corruption on early pushes (CVE-2019-10081)

    * httpd: read-after-free in h2 connection shutdown (CVE-2019-10082)

    * httpd: null-pointer dereference in mod_remoteip (CVE-2019-10097)

    * httpd: mod_rewrite configurations vulnerable to open redirect (CVE-2020-1927)

    * httpd: mod_http2: DoS via slow, unneeded request bodies (CVE-2018-17189)

    * httpd: mod_http2: read-after-free on a string compare (CVE-2019-0196)

    * httpd: mod_http2: possible crash on late upgrade (CVE-2019-0197)

    * httpd: limited cross-site scripting in mod_proxy error page (CVE-2019-10092)

    * httpd: mod_rewrite potential open redirect (CVE-2019-10098)

    * httpd: mod_proxy_ftp use of uninitialized value (CVE-2020-1934)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201903-21 (Apache: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Apache. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker can possibly cause a Denial of Service condition or       could bypass mod_session_cookie expiration time.
  Workaround :

    There is no known workaround at this time.

ID	名稱	產品	系列	已發布	已更新	嚴重性
124506	Fedora 30 : mod_http2 (2019-75b4a34d4f)	Nessus	Fedora Local Security Checks	2019/5/2	2024/5/29	medium
142397	RHEL 8 : httpd:2.4 (RHSA-2020:4751)	Nessus	Red Hat Local Security Checks	2020/11/4	2025/3/15	critical
145821	CentOS 8 : httpd:2.4 (CESA-2020:4751)	Nessus	CentOS Local Security Checks	2021/2/1	2023/2/8	critical
364632	Rocky Linux 8.6 [CIQ] Security Update: mod_http2 Multiple Vulnerabilities (ciqsa-2026_1605)	Nessus	Rocky Linux Local Security Checks	2026/10/12	2026/10/13	medium
131215	RHEL 6 : Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 6 (Important) (RHSA-2019:3932)	Nessus	Red Hat Local Security Checks	2019/11/22	2024/11/7	high
358614	Rocky Linux 8 [CIQ] Security Update: mod_md / mod_md-debuginfo / mod_md-debugsource Multiple Vulnerabilities (crlsa-2020_4751)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/2	critical
123427	GLSA-201903-21 : Apache: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2019/3/28	2024/6/7	critical

偵測

搜尋 Plugin

medium

critical

critical

medium

high

critical

critical