製品・ソフトウェアに関する情報

JVN脆弱性詳細

Apache HTTP Server の mod_headers モジュールにおけるディレクティブを回避される脆弱性

Title	Apache HTTP Server の mod_headers モジュールにおけるディレクティブを回避される脆弱性
Summary	Apache HTTP Server の mod_headers モジュールには、"RequestHeader unset" ディレクティブを回避される脆弱性が存在します。
Possible impacts	第三者により、チャンク転送コーディングで送信されるデータのトレーラ部分にヘッダを配置されることで、"RequestHeader unset" ディレクティブを回避される可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Sept. 5, 2013, midnight
Registration Date	April 16, 2014, 6:34 p.m.
Last Update	Jan. 29, 2016, 4:27 p.m.

CVSS2.0 : 警告
Score	5
Vector	AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected System

Apache Software Foundation

Apache HTTP Server 2.2.22

オラクル

Oracle Enterprise Manager Ops Center 12.1.4 未満

Oracle Enterprise Manager Ops Center 12.2.0

Oracle Enterprise Manager Ops Center 12.2.1

Oracle Enterprise Manager Ops Center 12.3.0

Oracle Enterprise Manager Ops Center 12.1.4 未満

Oracle Enterprise Manager Ops Center 12.2.0

Oracle Enterprise Manager Ops Center 12.2.1

Oracle Enterprise Manager Ops Center 12.3.0

Oracle HTTP Server 10.1.3.5.0

Oracle HTTP Server 11.1.1.7.0

Oracle HTTP Server 12.1.2.0

Oracle HTTP Server 12.1.3.0

Oracle HTTP Server 10.1.3.5.0

Oracle HTTP Server 11.1.1.7.0

Oracle HTTP Server 12.1.2.0

Oracle HTTP Server 12.1.3.0

SPARC Enterprise M3000 サーバ

SPARC Enterprise M4000 サーバ

SPARC Enterprise M5000 サーバ

SPARC Enterprise M8000 サーバ

SPARC Enterprise M9000 サーバ

XCP 1120 未満 (SPARC Enterprise M3000/M4000/M5000/M8000/M9000 サーバ)

アップル

Apple Mac OS X 10.10 から 10.10.2

Apple Mac OS X 10.8.5

Apple Mac OS X 10.9.5

Apple Mac OS X 10.10 から 10.10.2

Apple Mac OS X 10.8.5

Apple Mac OS X 10.9.5

macOS Server (旧 OS X Server) 5.0.3 未満 (OS X Yosemite v10.10.5 以降)

日立

Cosminexus HTTP Server

Hitachi Application Server

Hitachi Application Server for Developers

Hitachi Web Server

Hitachi Web Server - Custom Edition

Hitachi Web Server

Hitachi Web Server - Custom Edition

uCosminexus Application Server

uCosminexus Application Server (64)

uCosminexus Application Server -R

uCosminexus Application Server Express

uCosminexus Application Server Standard-R

uCosminexus Application Server

uCosminexus Application Server (64)

uCosminexus Application Server -R

uCosminexus Application Server Express

uCosminexus Application Server Standard-R

uCosminexus Application Server Enterprise

uCosminexus Application Server Smart Edition

uCosminexus Application Server Standard

uCosminexus Developer

uCosminexus Developer 01

uCosminexus Developer Professional

uCosminexus Developer Professional for Plug-in

uCosminexus Developer

uCosminexus Developer 01

uCosminexus Developer Professional

uCosminexus Developer Professional for Plug-in

uCosminexus Developer Standard

uCosminexus Primary Server Base

uCosminexus Primary Server Base(64)

uCosminexus Primary Server Base

uCosminexus Primary Server Base(64)

uCosminexus Service Architect

uCosminexus Service Platform

uCosminexus Service Platform (64)

uCosminexus Service Platform - Messaging

uCosminexus Service Platform

uCosminexus Service Platform (64)

uCosminexus Service Platform - Messaging

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2013-5704	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5704
2	CVE-2013-5704	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5704
National Vulnerability Database (NVD)
3	CVE-2013-5704	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-5704
4	CVE-2013-5704	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-5704

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-264	https://jvndb.jvn.jp/ja/cwe/CWE-264.html
2	CWE-264	https://jvndb.jvn.jp/ja/cwe/CWE-264.html

ベンダー情報

No	Name	URL
Apache
1	Apache HTTP Server Project	https://httpd.apache.org/
2	Apache HTTP Server Project	https://httpd.apache.org/
Apple Mailing Lists
3	APPLE-SA-2015-04-08-2 OS X 10.10.3 and Security Update 2015-004	http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html
4	APPLE-SA-2015-04-08-2 OS X 10.10.3 and Security Update 2015-004	http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html
5	APPLE-SA-2015-09-16-4 OS X Server 5.0.3	http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html
6	APPLE-SA-2015-09-16-4 OS X Server 5.0.3	http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html
Apple Security Updates
7	HT204659	http://support.apple.com/en-us/HT204659
8	HT204659	http://support.apple.com/en-us/HT204659
9	HT205219	https://support.apple.com/en-us/HT205219
10	HT205219	https://support.apple.com/en-us/HT205219
Apple セキュリティアップデート
11	HT204659	http://support.apple.com/ja-jp/HT204659
12	HT204659	http://support.apple.com/ja-jp/HT204659
13	HT205219	http://support.apple.com/ja-jp/HT205219
14	HT205219	http://support.apple.com/ja-jp/HT205219
Hitachi Software Vulnerability Information
15	HS15-011	http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS15-011/index.html
16	HS15-011	http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS15-011/index.html
Oracle Critical Patch Update
17	Oracle Critical Patch Update Advisory - January 2015	http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
18	Oracle Critical Patch Update Advisory - January 2015	http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html
19	Oracle Critical Patch Update Advisory - January 2016	http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
20	Oracle Critical Patch Update Advisory - January 2016	http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
21	Oracle Critical Patch Update Advisory - July 2015	http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
22	Oracle Critical Patch Update Advisory - July 2015	http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
23	Text Form of Oracle Critical Patch Update - January 2015 Risk Matrices	http://www.oracle.com/technetwork/topics/security/cpujan2015verbose-1972976.html
24	Text Form of Oracle Critical Patch Update - January 2015 Risk Matrices	http://www.oracle.com/technetwork/topics/security/cpujan2015verbose-1972976.html
25	Text Form of Oracle Critical Patch Update - January 2016 Risk Matrices	http://www.oracle.com/technetwork/topics/security/cpujan2016verbose-2367956.html
26	Text Form of Oracle Critical Patch Update - January 2016 Risk Matrices	http://www.oracle.com/technetwork/topics/security/cpujan2016verbose-2367956.html
27	Text Form of Oracle Critical Patch Update - July 2015 Risk Matrices	http://www.oracle.com/technetwork/topics/security/cpujul2015verbose-2367947.html
28	Text Form of Oracle Critical Patch Update - July 2015 Risk Matrices	http://www.oracle.com/technetwork/topics/security/cpujul2015verbose-2367947.html
Oracle Technology Network
29	Oracle Third Party Bulletin - January 2015	http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
30	Oracle Third Party Bulletin - January 2015	http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
SECURITY BLOG
31	January 2015 Critical Patch Update Released	https://blogs.oracle.com/security/entry/january_2015_critical_patch_update
32	January 2015 Critical Patch Update Released	https://blogs.oracle.com/security/entry/january_2015_critical_patch_update
33	January 2016 Critical Patch Update Released	https://blogs.oracle.com/security/entry/january_2016_critical_patch_update
34	January 2016 Critical Patch Update Released	https://blogs.oracle.com/security/entry/january_2016_critical_patch_update
35	July 2015 Critical Patch Update Released	https://blogs.oracle.com/security/entry/july_2015_critical_patch_update
36	July 2015 Critical Patch Update Released	https://blogs.oracle.com/security/entry/july_2015_critical_patch_update
Turbolinux Security Advisory
37	TLSA-2015-19	http://www.turbolinux.co.jp/security/2015/TLSA-2015-19j.html
38	TLSA-2015-19	http://www.turbolinux.co.jp/security/2015/TLSA-2015-19j.html
ソフトウェア製品セキュリティ情報
39	HS15-011	http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS15-011/index.html
40	HS15-011	http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS15-011/index.html

その他

No	Name	URL
JVN
1	JVNVU#91828320	http://jvn.jp/vu/JVNVU91828320/index.html
2	JVNVU#91828320	http://jvn.jp/vu/JVNVU91828320/index.html
3	JVNVU#99970459	http://jvn.jp/vu/JVNVU99970459/index.html
4	JVNVU#99970459	http://jvn.jp/vu/JVNVU99970459/index.html
関連文書
5	Chunked HTTP transfer encoding	http://martin.swende.se/blog/HTTPChunked.html
6	Chunked HTTP transfer encoding	http://martin.swende.se/blog/HTTPChunked.html

Change Log

No	Changed Details	Date of change
0	[2014年04月16日] 掲載 [2015年01月22日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：オラクル (Oracle Critical Patch Update Advisory - January 2015) を追加ベンダ情報：オラクル (Text Form of Oracle Critical Patch Update - January 2015 Risk Matrices) を追加ベンダ情報：オラクル (January 2015 Critical Patch Update Released) を追加 [2015年01月30日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：オラクル (Oracle Third Party Bulletin - January 2015) を追加 [2015年04月13日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：アップル (HT204659) を追加ベンダ情報：アップル (APPLE-SA-2015-04-08-2 OS X 10.10.3 and Security Update 2015-004) を追加参考情報：JVN (JVNVU#91828320) を追加 [2015年04月22日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：日立 (HS15-011) を追加 [2015年07月29日] ベンダ情報：オラクル (Oracle Critical Patch Update Advisory - July 2015) を追加ベンダ情報：オラクル (Text Form of Oracle Critical Patch Update - July 2015 Risk Matrices) を追加ベンダ情報：オラクル (July 2015 Critical Patch Update Released) を追加 [2015年10月05日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：アップル (APPLE-SA-2015-09-16-4 OS X Server 5.0.3) を追加ベンダ情報：アップル (HT205219) を追加参考情報：JVN (JVNVU#99970459) を追加 [2015年10月08日] ベンダ情報：ターボリナックス (TLSA-2015-19) を追加 [2016年01月29日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：オラクル (Oracle Critical Patch Update Advisory - January 2016) を追加ベンダ情報：オラクル (Text Form of Oracle Critical Patch Update - January 2016 Risk Matrices) を追加ベンダ情報：オラクル (January 2016 Critical Patch Update Released) を追加	Feb. 17, 2018, 10:37 a.m.
0	[2014年04月16日] 掲載 [2015年01月22日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：オラクル (Oracle Critical Patch Update Advisory - January 2015) を追加ベンダ情報：オラクル (Text Form of Oracle Critical Patch Update - January 2015 Risk Matrices) を追加ベンダ情報：オラクル (January 2015 Critical Patch Update Released) を追加 [2015年01月30日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：オラクル (Oracle Third Party Bulletin - January 2015) を追加 [2015年04月13日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：アップル (HT204659) を追加ベンダ情報：アップル (APPLE-SA-2015-04-08-2 OS X 10.10.3 and Security Update 2015-004) を追加参考情報：JVN (JVNVU#91828320) を追加 [2015年04月22日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：日立 (HS15-011) を追加 [2015年07月29日] ベンダ情報：オラクル (Oracle Critical Patch Update Advisory - July 2015) を追加ベンダ情報：オラクル (Text Form of Oracle Critical Patch Update - July 2015 Risk Matrices) を追加ベンダ情報：オラクル (July 2015 Critical Patch Update Released) を追加 [2015年10月05日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：アップル (APPLE-SA-2015-09-16-4 OS X Server 5.0.3) を追加ベンダ情報：アップル (HT205219) を追加参考情報：JVN (JVNVU#99970459) を追加 [2015年10月08日] ベンダ情報：ターボリナックス (TLSA-2015-19) を追加 [2016年01月29日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：オラクル (Oracle Critical Patch Update Advisory - January 2016) を追加ベンダ情報：オラクル (Text Form of Oracle Critical Patch Update - January 2016 Risk Matrices) を追加ベンダ情報：オラクル (January 2016 Critical Patch Update Released) を追加	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2013-5704

Summary	The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."
Publication Date	April 15, 2014, 7:55 p.m.
Registration Date	Jan. 26, 2021, 3:46 p.m.
Last Update	Nov. 21, 2024, 10:57 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:apache:http_server:2.2.23:::::::*
cpe:2.3:a:apache:http_server:2.4.1:::::::*
cpe:2.3:a:apache:http_server:2.2.11:::::::*
cpe:2.3:a:apache:http_server:2.2.0:::::::*
cpe:2.3:a:apache:http_server:2.2.10:::::::*
cpe:2.3:a:apache:http_server:2.4.6:::::::*
cpe:2.3:a:apache:http_server:2.2.13:::::::*
cpe:2.3:a:apache:http_server:2.2.2:::::::*
cpe:2.3:a:apache:http_server:2.2.4:::::::*
cpe:2.3:a:apache:http_server:2.2.17:::::::*
cpe:2.3:a:apache:http_server:2.2.16:::::::*
cpe:2.3:a:apache:http_server:2.2.21:::::::*
cpe:2.3:a:apache:http_server:2.4.3:::::::*
cpe:2.3:a:apache:http_server:2.2.8:::::::*
cpe:2.3:a:apache:http_server:2.4.4:::::::*
cpe:2.3:a:apache:http_server:2.4.10:::::::*
cpe:2.3:a:apache:http_server:2.4.7:::::::*
cpe:2.3:a:apache:http_server:2.2.14:::::::*
cpe:2.3:a:apache:http_server:2.2.24:::::::*
cpe:2.3:a:apache:http_server:2.2.25:::::::*
cpe:2.3:a:apache:http_server:2.2.6:::::::*
cpe:2.3:a:apache:http_server:2.2.22:::::::*
cpe:2.3:a:apache:http_server:2.2.19:::::::*
cpe:2.3:a:apache:http_server:2.2.27:::::::*
cpe:2.3:a:apache:http_server:2.2.9:::::::*
cpe:2.3:a:apache:http_server:2.2.18:::::::*
cpe:2.3:a:apache:http_server:2.2.12:::::::*
cpe:2.3:a:apache:http_server:2.2.3:::::::*
cpe:2.3:a:apache:http_server:2.4.2:::::::*
cpe:2.3:a:apache:http_server:2.2.15:::::::*
cpe:2.3:a:apache:http_server:2.2.20:::::::*
cpe:2.3:a:apache:http_server:2.4.9:::::::*
cpe:2.3:a:apache:http_server:2.2.26:::::::*
cpe:2.3:a:apache:http_server:2.2.5:::::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:::::::*
cpe:2.3:o:redhat:enterprise_linux_eus:7.3:::::::*
cpe:2.3:o:redhat:enterprise_linux_eus:7.4:::::::*
cpe:2.3:o:redhat:enterprise_linux_eus:7.5:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:::::::*
cpe:2.3:o:redhat:enterprise_linux_eus:7.6:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:::::::*
cpe:2.3:o:redhat:enterprise_linux_eus:7.7:::::::*

Configuration3		or higher	or less	more than	less than
cpe:2.3:a:redhat:jboss_enterprise_web_server:3.0.0:::::::*
execution environment
1	cpe:2.3:o:redhat:enterprise_linux:6.0:::::::*
2	cpe:2.3:o:redhat:enterprise_linux:7.0:::::::*

Configuration4		or higher	or less	more than	less than
cpe:2.3:a:redhat:jboss_enterprise_web_server:2.0.0:::::::*
execution environment
1	cpe:2.3:o:redhat:enterprise_linux:5.0:::::::*
2	cpe:2.3:o:redhat:enterprise_linux:6.0:::::::*
3	cpe:2.3:o:redhat:enterprise_linux:7.0:::::::*

Configuration5	or higher	or less	more than	less than
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.1:::::::*
cpe:2.3:a:oracle:http_server:12.1.3.0:::::::*
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.0:::::::*
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.0:::::::*
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.1.4:::::::*
cpe:2.3:a:oracle:http_server:12.1.2.0:::::::*
cpe:2.3:o:oracle:solaris:11.2:::::::*
cpe:2.3:a:oracle:http_server:11.1.1.7.0:::::::*
cpe:2.3:o:oracle:linux:6:-::::::
cpe:2.3:a:oracle:enterprise_manager_ops_center::::::::				12.1.4
cpe:2.3:a:oracle:http_server:10.1.3.5.0:::::::*

Configuration6	or higher	or less	more than	less than
cpe:2.3:o:apple:mac_os_x::::::::				10.10.4
cpe:2.3:o:apple:mac_os_x_server::::::::				5.0.3

Configuration7	or higher	or less	more than	less than
cpe:2.3:o:canonical:ubuntu_linux:14.10:::::::*
cpe:2.3:o:canonical:ubuntu_linux:14.04::::esm:::
cpe:2.3:o:canonical:ubuntu_linux:10.04::::-:::
cpe:2.3:o:canonical:ubuntu_linux:12.04::::-:::

Related information, measures and tools

No	URL	タグ
1	http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html	Mailing List Third Party Advisory
2	http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html	Mailing List Third Party Advisory
3	http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html	Mailing List Third Party Advisory
4	http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html	Mailing List Third Party Advisory
5	http://marc.info/?l=apache-httpd-dev&m=139636309822854&w=2	Mailing List Third Party Advisory
6	http://marc.info/?l=apache-httpd-dev&m=139636309822854&w=2	Mailing List Third Party Advisory
7	http://marc.info/?l=bugtraq&m=143403519711434&w=2	Issue Tracking Mailing List Third Party Advisory
8	http://marc.info/?l=bugtraq&m=143403519711434&w=2	Issue Tracking Mailing List Third Party Advisory
9	http://marc.info/?l=bugtraq&m=143403519711434&w=2	Issue Tracking Mailing List Third Party Advisory
10	http://marc.info/?l=bugtraq&m=143403519711434&w=2	Issue Tracking Mailing List Third Party Advisory
11	http://marc.info/?l=bugtraq&m=144493176821532&w=2	Issue Tracking Mailing List Third Party Advisory
12	http://marc.info/?l=bugtraq&m=144493176821532&w=2	Issue Tracking Mailing List Third Party Advisory
13	http://marc.info/?l=bugtraq&m=144493176821532&w=2	Issue Tracking Mailing List Third Party Advisory
14	http://marc.info/?l=bugtraq&m=144493176821532&w=2	Issue Tracking Mailing List Third Party Advisory
15	http://martin.swende.se/blog/HTTPChunked.html	Broken Link Exploit Third Party Advisory
16	http://martin.swende.se/blog/HTTPChunked.html	Broken Link Exploit Third Party Advisory
17	http://rhn.redhat.com/errata/RHSA-2015-0325.html	Third Party Advisory
18	http://rhn.redhat.com/errata/RHSA-2015-0325.html	Third Party Advisory
19	http://rhn.redhat.com/errata/RHSA-2015-1249.html	Third Party Advisory
20	http://rhn.redhat.com/errata/RHSA-2015-1249.html	Third Party Advisory
21	http://rhn.redhat.com/errata/RHSA-2015-2661.html	Broken Link Third Party Advisory
22	http://rhn.redhat.com/errata/RHSA-2015-2661.html	Broken Link Third Party Advisory
23	http://rhn.redhat.com/errata/RHSA-2016-0061.html	Third Party Advisory
24	http://rhn.redhat.com/errata/RHSA-2016-0061.html	Third Party Advisory
25	http://rhn.redhat.com/errata/RHSA-2016-0062.html	Third Party Advisory
26	http://rhn.redhat.com/errata/RHSA-2016-0062.html	Third Party Advisory
27	http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGES	Release Notes Vendor Advisory
28	http://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x/CHANGES	Release Notes Vendor Advisory
29	http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c	Patch Vendor Advisory
30	http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c	Patch Vendor Advisory
31	http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c?r1=1610674&r2=1610814&diff_format=h	Patch Vendor Advisory
32	http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_http.c?r1=1610674&r2=1610814&diff_format=h	Patch Vendor Advisory
33	http://www.mandriva.com/security/advisories?name=MDVSA-2014:174	Third Party Advisory
34	http://www.mandriva.com/security/advisories?name=MDVSA-2014:174	Third Party Advisory
35	http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html	Third Party Advisory
36	http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html	Third Party Advisory
37	http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html	Third Party Advisory
38	http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html	Third Party Advisory
39	http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html	Third Party Advisory
40	http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html	Third Party Advisory
41	http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html	Third Party Advisory
42	http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html	Third Party Advisory
43	http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html	Third Party Advisory
44	http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html	Third Party Advisory
45	http://www.securityfocus.com/bid/66550	Third Party Advisory VDB Entry
46	http://www.securityfocus.com/bid/66550	Third Party Advisory VDB Entry
47	http://www.ubuntu.com/usn/USN-2523-1	Third Party Advisory
48	http://www.ubuntu.com/usn/USN-2523-1	Third Party Advisory
49	https://access.redhat.com/errata/RHSA-2015:2659	Third Party Advisory
50	https://access.redhat.com/errata/RHSA-2015:2659	Third Party Advisory
51	https://access.redhat.com/errata/RHSA-2015:2660	Third Party Advisory
52	https://access.redhat.com/errata/RHSA-2015:2660	Third Party Advisory
53	https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246	Third Party Advisory
54	https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04832246	Third Party Advisory
55	https://httpd.apache.org/security/vulnerabilities_24.html	Vendor Advisory
56	https://httpd.apache.org/security/vulnerabilities_24.html	Vendor Advisory
57	https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E
58	https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E
59	https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E
60	https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E
61	https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E
62	https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E
63	https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E
64	https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E
65	https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E
66	https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E
67	https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E
68	https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E
69	https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E
70	https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E
71	https://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3Ccvs.httpd.apache.org%3E
72	https://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3Ccvs.httpd.apache.org%3E
73	https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E
74	https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E
75	https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E
76	https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E
77	https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E
78	https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E
79	https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E
80	https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E
81	https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E
82	https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E
83	https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E
84	https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E
85	https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E
86	https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E
87	https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E
88	https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E
89	https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E
90	https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E
91	https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E
92	https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E
93	https://security.gentoo.org/glsa/201504-03	Third Party Advisory
94	https://security.gentoo.org/glsa/201504-03	Third Party Advisory
95	https://support.apple.com/HT204659	Third Party Advisory
96	https://support.apple.com/HT204659	Third Party Advisory
97	https://support.apple.com/HT205219	Third Party Advisory
98	https://support.apple.com/HT205219	Third Party Advisory

Common Vulnerabilities List

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:apache:http_server:2.2.23:::::::*
cpe:2.3:a:apache:http_server:2.4.1:::::::*
cpe:2.3:a:apache:http_server:2.2.11:::::::*
cpe:2.3:a:apache:http_server:2.2.0:::::::*
cpe:2.3:a:apache:http_server:2.2.10:::::::*
cpe:2.3:a:apache:http_server:2.4.6:::::::*
cpe:2.3:a:apache:http_server:2.2.13:::::::*
cpe:2.3:a:apache:http_server:2.2.2:::::::*
cpe:2.3:a:apache:http_server:2.2.4:::::::*
cpe:2.3:a:apache:http_server:2.2.17:::::::*
cpe:2.3:a:apache:http_server:2.2.16:::::::*
cpe:2.3:a:apache:http_server:2.2.21:::::::*
cpe:2.3:a:apache:http_server:2.4.3:::::::*
cpe:2.3:a:apache:http_server:2.2.8:::::::*
cpe:2.3:a:apache:http_server:2.4.4:::::::*
cpe:2.3:a:apache:http_server:2.4.10:::::::*
cpe:2.3:a:apache:http_server:2.4.7:::::::*
cpe:2.3:a:apache:http_server:2.2.14:::::::*
cpe:2.3:a:apache:http_server:2.2.24:::::::*
cpe:2.3:a:apache:http_server:2.2.25:::::::*
cpe:2.3:a:apache:http_server:2.2.6:::::::*
cpe:2.3:a:apache:http_server:2.2.22:::::::*
cpe:2.3:a:apache:http_server:2.2.19:::::::*
cpe:2.3:a:apache:http_server:2.2.27:::::::*
cpe:2.3:a:apache:http_server:2.2.9:::::::*
cpe:2.3:a:apache:http_server:2.2.18:::::::*
cpe:2.3:a:apache:http_server:2.2.12:::::::*
cpe:2.3:a:apache:http_server:2.2.3:::::::*
cpe:2.3:a:apache:http_server:2.4.2:::::::*
cpe:2.3:a:apache:http_server:2.2.15:::::::*
cpe:2.3:a:apache:http_server:2.2.20:::::::*
cpe:2.3:a:apache:http_server:2.4.9:::::::*
cpe:2.3:a:apache:http_server:2.2.26:::::::*
cpe:2.3:a:apache:http_server:2.2.5:::::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:::::::*
cpe:2.3:o:redhat:enterprise_linux_eus:7.3:::::::*
cpe:2.3:o:redhat:enterprise_linux_eus:7.4:::::::*
cpe:2.3:o:redhat:enterprise_linux_eus:7.5:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:::::::*
cpe:2.3:o:redhat:enterprise_linux_eus:7.6:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:::::::*
cpe:2.3:o:redhat:enterprise_linux_eus:7.7:::::::*

Configuration5	or higher	or less	more than	less than
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.1:::::::*
cpe:2.3:a:oracle:http_server:12.1.3.0:::::::*
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.0:::::::*
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.0:::::::*
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.1.4:::::::*
cpe:2.3:a:oracle:http_server:12.1.2.0:::::::*
cpe:2.3:o:oracle:solaris:11.2:::::::*
cpe:2.3:a:oracle:http_server:11.1.1.7.0:::::::*
cpe:2.3:o:oracle:linux:6:-::::::
cpe:2.3:a:oracle:enterprise_manager_ops_center::::::::				12.1.4
cpe:2.3:a:oracle:http_server:10.1.3.5.0:::::::*