{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for Red Hat JBoss Core Services.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience.\n\nThis release of Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 1 serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.23, and includes bug fixes, which are documented in the Release Notes document linked to in the References.\n\nSecurity Fix(es):\n\n* A memory leak flaw was found in the way OpenSSL handled TLS status request extension data during session renegotiation. A remote attacker could cause a TLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory, if it enabled OCSP stapling support. (CVE-2016-6304)\n\n* It was discovered that the mod_session_crypto module of httpd did not use any mechanisms to verify integrity of the encrypted session data stored in the user\u0027s browser. A remote attacker could use this flaw to decrypt and modify session data using a padding oracle attack. (CVE-2016-0736)\n\n* It was discovered that the mod_auth_digest module of httpd did not properly check for memory allocation failures. A remote attacker could use this flaw to cause httpd child processes to repeatedly crash if the server used HTTP digest authentication. (CVE-2016-2161)\n\n* A timing attack flaw was found in OpenSSL that could allow a malicious user with local access to recover ECDSA P-256 private keys. (CVE-2016-7056)\n\n* A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients. (CVE-2016-8610)\n\n* It was discovered that the HTTP parser in httpd incorrectly allowed certain characters not permitted by the HTTP protocol specification to appear unencoded in HTTP request headers. If httpd was used in conjunction with a proxy or backend server that interpreted those characters differently, a remote attacker could possibly use this flaw to inject data into HTTP responses, resulting in proxy cache poisoning. (CVE-2016-8743)\n\n* A vulnerability was found in httpd\u0027s handling of the LimitRequestFields directive in mod_http2, affecting servers with HTTP/2 enabled. An attacker could send crafted requests with headers larger than the server\u0027s available memory, causing httpd to crash. (CVE-2016-8740)\n\nRed Hat would like to thank the OpenSSL project for reporting CVE-2016-6304 and Shi Lei (Gear Team of Qihoo 360 Inc.) for reporting CVE-2016-8610. Upstream acknowledges Shi Lei (Gear Team of Qihoo 360 Inc.) as the original reporter of CVE-2016-6304.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2017:1415",
        "url": "https://access.redhat.com/errata/RHSA-2017:1415"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=core.service.apachehttp\u0026downloadType=securityPatches\u0026version=2.4.23",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=core.service.apachehttp\u0026downloadType=securityPatches\u0026version=2.4.23"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en/red-hat-jboss-core-services/",
        "url": "https://access.redhat.com/documentation/en/red-hat-jboss-core-services/"
      },
      {
        "category": "external",
        "summary": "1377600",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1377600"
      },
      {
        "category": "external",
        "summary": "1384743",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1384743"
      },
      {
        "category": "external",
        "summary": "1401528",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1401528"
      },
      {
        "category": "external",
        "summary": "1406744",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1406744"
      },
      {
        "category": "external",
        "summary": "1406753",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1406753"
      },
      {
        "category": "external",
        "summary": "1406822",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1406822"
      },
      {
        "category": "external",
        "summary": "1412120",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1412120"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1415.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 1",
    "tracking": {
      "current_release_date": "2024-11-22T10:49:37+00:00",
      "generator": {
        "date": "2024-11-22T10:49:37+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2017:1415",
      "initial_release_date": "2017-06-07T17:43:43+00:00",
      "revision_history": [
        {
          "date": "2017-06-07T17:43:43+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2017-06-07T17:43:43+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T10:49:37+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Core Services 1",
                "product": {
                  "name": "Red Hat JBoss Core Services 1",
                  "product_id": "Red Hat JBoss Core Services 1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_core_services:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Core Services"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2016-0736",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "discovery_date": "2016-12-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1406744"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was discovered that the mod_session_crypto module of httpd did not use any mechanisms to verify integrity of the encrypted session data stored in the user\u0027s browser. A remote attacker could use this flaw to decrypt and modify session data using a padding oracle attack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: Padding Oracle in Apache mod_session_crypto",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Core Services 1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-0736"
        },
        {
          "category": "external",
          "summary": "RHBZ#1406744",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1406744"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-0736",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-0736"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0736",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0736"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html#2.4.25",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html#2.4.25"
        },
        {
          "category": "external",
          "summary": "https://www.redteam-pentesting.de/advisories/rt-sa-2016-001.txt",
          "url": "https://www.redteam-pentesting.de/advisories/rt-sa-2016-001.txt"
        }
      ],
      "release_date": "2016-12-20T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2017-06-07T17:43:43+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Core Services 1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2017:1415"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss Core Services 1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: Padding Oracle in Apache mod_session_crypto"
    },
    {
      "cve": "CVE-2016-2161",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2016-12-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1406753"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was discovered that the mod_auth_digest module of httpd did not properly check for memory allocation failures. A remote attacker could use this flaw to cause httpd child processes to repeatedly crash if the server used HTTP digest authentication.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: DoS vulnerability in mod_auth_digest",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Core Services 1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-2161"
        },
        {
          "category": "external",
          "summary": "RHBZ#1406753",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1406753"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-2161",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-2161"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-2161",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2161"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html#2.4.25",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html#2.4.25"
        }
      ],
      "release_date": "2016-12-20T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2017-06-07T17:43:43+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Core Services 1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2017:1415"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss Core Services 1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: DoS vulnerability in mod_auth_digest"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "the OpenSSL project"
          ]
        },
        {
          "names": [
            "Shi Lei"
          ],
          "organization": "Gear Team of Qihoo 360 Inc.",
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2016-6304",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2016-09-19T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1377600"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A memory leak flaw was found in the way OpenSSL handled TLS status request extension data during session renegotiation. A remote attacker could cause a TLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory, if it enabled OCSP stapling support.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: OCSP Status Request extension unbounded memory growth",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "TLS server applications using OpenSSL versions in Red Hat Enterprise Linux 6 and 7 are only affected if they enable OCSP stapling support. Applications not enabling OCSP stapling support are not affected. Few applications implement OCSP stapling support and typically do not enable it by default.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Core Services 1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-6304"
        },
        {
          "category": "external",
          "summary": "RHBZ#1377600",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1377600"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-6304",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-6304"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6304",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6304"
        },
        {
          "category": "external",
          "summary": "https://www.openssl.org/news/secadv/20160922.txt",
          "url": "https://www.openssl.org/news/secadv/20160922.txt"
        }
      ],
      "release_date": "2016-09-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2017-06-07T17:43:43+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Core Services 1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2017:1415"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss Core Services 1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "openssl: OCSP Status Request extension unbounded memory growth"
    },
    {
      "cve": "CVE-2016-7056",
      "cwe": {
        "id": "CWE-385",
        "name": "Covert Timing Channel"
      },
      "discovery_date": "2017-01-10T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1412120"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A timing attack flaw was found in OpenSSL that could allow a malicious user with local access to recover ECDSA P-256 private keys.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: ECDSA P-256 timing attack key recovery",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In order to exploit this flaw, the attacker needs to be have local (shell) access to the machine where the message is being signed using the ECDSA algorithm with a P-256 elliptic curve key. Then using cache timing attacks (which needs precise timing), on multiple signature runs, the private key could be obtained. Based on the factor that exploitation is difficult, Red Hat Product Security Team has rated this flaw as having Moderate impact. A further security release may address this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Core Services 1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-7056"
        },
        {
          "category": "external",
          "summary": "RHBZ#1412120",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1412120"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-7056",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-7056"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-7056",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7056"
        }
      ],
      "release_date": "2017-01-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2017-06-07T17:43:43+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Core Services 1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2017:1415"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss Core Services 1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: ECDSA P-256 timing attack key recovery"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Shi Lei"
          ],
          "organization": "Gear Team of Qihoo 360 Inc."
        }
      ],
      "cve": "CVE-2016-8610",
      "discovery_date": "2016-10-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1384743"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "SSL/TLS: Malformed plain-text ALERT packets could cause remote DoS",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw affects applications that are compiled against OpenSSL or GnuTLS and do not allocate an extra thread for processing ClientHello messages. Nginx is affected by this issue; Apache httpd is not affected by this issue. This issue has been rated as having a security impact of Moderate. It requires an attacker to send a very large amount of SSL ALERT messages to the host network connection. This issue can also be mitigated by configuring firewalls to limit the number of connections per IP address, or use deep packet inspection to reject these type of alert packets. A future update may address this issue.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Core Services 1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-8610"
        },
        {
          "category": "external",
          "summary": "RHBZ#1384743",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1384743"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-8610",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-8610"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-8610",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8610"
        },
        {
          "category": "external",
          "summary": "http://security.360.cn/cve/CVE-2016-8610",
          "url": "http://security.360.cn/cve/CVE-2016-8610"
        }
      ],
      "release_date": "2016-10-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2017-06-07T17:43:43+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Core Services 1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2017:1415"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss Core Services 1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "SSL/TLS: Malformed plain-text ALERT packets could cause remote DoS"
    },
    {
      "cve": "CVE-2016-8740",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2016-12-05T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1401528"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in httpd\u0027s handling of the LimitRequestFields directive in mod_http2, affecting servers with HTTP/2 enabled. An attacker could send crafted requests with headers larger than the server\u0027s available memory, causing httpd to crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: Incomplete handling of LimitRequestFields directive in mod_http2",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has rated this issue as having Low security\nimpact. This issue is not currently planned to be addressed in future\nupdates. For additional information, refer to the Issue Severity\nClassification: https://access.redhat.com/security/updates/classification/.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Core Services 1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-8740"
        },
        {
          "category": "external",
          "summary": "RHBZ#1401528",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1401528"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-8740",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-8740"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-8740",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8740"
        },
        {
          "category": "external",
          "summary": "http://seclists.org/bugtraq/2016/Dec/3",
          "url": "http://seclists.org/bugtraq/2016/Dec/3"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2016-12-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2017-06-07T17:43:43+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Core Services 1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2017:1415"
        },
        {
          "category": "workaround",
          "details": "As a temporary workaround - HTTP/2 can be disabled by changing\nthe configuration by removing h2 and h2c from the Protocols\nline(s) in the configuration file. \n\nThe resulting line should read:\n\n\t\tProtocols http/1.1",
          "product_ids": [
            "Red Hat JBoss Core Services 1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss Core Services 1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "httpd: Incomplete handling of LimitRequestFields directive in mod_http2"
    },
    {
      "cve": "CVE-2016-8743",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2016-12-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1406822"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was discovered that the HTTP parser in httpd incorrectly allowed certain characters not permitted by the HTTP protocol specification to appear unencoded in HTTP request headers. If httpd was used in conjunction with a proxy or backend server that interpreted those characters differently, a remote attacker could possibly use this flaw to inject data into HTTP responses, resulting in proxy cache poisoning.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: Apache HTTP Request Parsing Whitespace Defects",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Core Services 1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-8743"
        },
        {
          "category": "external",
          "summary": "RHBZ#1406822",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1406822"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-8743",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-8743"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-8743",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8743"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html#2.4.25",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html#2.4.25"
        }
      ],
      "release_date": "2016-12-20T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2017-06-07T17:43:43+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Core Services 1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2017:1415"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss Core Services 1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: Apache HTTP Request Parsing Whitespace Defects"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated httpd24 packages are now available as a part of Red Hat Software Collections 2.4 for Red Hat Enterprise Linux.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The Apache HTTP Server is a powerful, efficient, and extensible web server. The httpd24 packages provide a recent stable release of version 2.4 of the Apache HTTP Server, along with the mod_auth_kerb module.\n\nThe httpd24 Software Collection has been upgraded to version 2.4.25, which provides a number of bug fixes and enhancements over the previous version. For detailed changes, see the Red Hat Software Collections 2.4 Release Notes linked from the References section. (BZ#1404778)\n\nSecurity Fix(es):\n\n* It was discovered that the mod_session_crypto module of httpd did not use any mechanisms to verify integrity of the encrypted session data stored in the user\u0027s browser. A remote attacker could use this flaw to decrypt and modify session data using a padding oracle attack. (CVE-2016-0736)\n\n* A denial of service flaw was found in httpd\u0027s mod_http2 module. A remote attacker could use this flaw to block server threads for long times, causing starvation of worker threads, by manipulating the flow control windows on streams. (CVE-2016-1546)\n\n* It was discovered that the mod_auth_digest module of httpd did not properly check for memory allocation failures. A remote attacker could use this flaw to cause httpd child processes to repeatedly crash if the server used HTTP digest authentication. (CVE-2016-2161)\n\n* It was discovered that the HTTP parser in httpd incorrectly allowed certain characters not permitted by the HTTP protocol specification to appear unencoded in HTTP request headers. If httpd was used in conjunction with a proxy or backend server that interpreted those characters differently, a remote attacker could possibly use this flaw to inject data into HTTP responses, resulting in proxy cache poisoning. (CVE-2016-8743)\n\nNote: The fix for the CVE-2016-8743 issue causes httpd to return \"400 Bad Request\" error to HTTP clients which do not strictly follow HTTP protocol specification. A newly introduced configuration directive \"HttpProtocolOptions Unsafe\" can be used to re-enable the old less strict parsing. However, such setting also re-introduces the CVE-2016-8743 issue.\n\n* A vulnerability was found in httpd\u0027s handling of the LimitRequestFields directive in mod_http2, affecting servers with HTTP/2 enabled. An attacker could send crafted requests with headers larger than the server\u0027s available memory, causing httpd to crash. (CVE-2016-8740)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2017:1161",
        "url": "https://access.redhat.com/errata/RHSA-2017:1161"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-US/Red_Hat_Software_Collections/2/html/2.4_Release_Notes/chap-RHSCL.html#sect-RHSCL-Changes-httpd",
        "url": "https://access.redhat.com/documentation/en-US/Red_Hat_Software_Collections/2/html/2.4_Release_Notes/chap-RHSCL.html#sect-RHSCL-Changes-httpd"
      },
      {
        "category": "external",
        "summary": "1329639",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1329639"
      },
      {
        "category": "external",
        "summary": "1335616",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1335616"
      },
      {
        "category": "external",
        "summary": "1336350",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1336350"
      },
      {
        "category": "external",
        "summary": "1401528",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1401528"
      },
      {
        "category": "external",
        "summary": "1406744",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1406744"
      },
      {
        "category": "external",
        "summary": "1406753",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1406753"
      },
      {
        "category": "external",
        "summary": "1406822",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1406822"
      },
      {
        "category": "external",
        "summary": "1414037",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1414037"
      },
      {
        "category": "external",
        "summary": "1432249",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1432249"
      },
      {
        "category": "external",
        "summary": "1433474",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1433474"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1161.json"
      }
    ],
    "title": "Red Hat Security Advisory: httpd24-httpd security, bug fix, and enhancement update",
    "tracking": {
      "current_release_date": "2024-11-15T08:22:35+00:00",
      "generator": {
        "date": "2024-11-15T08:22:35+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2017:1161",
      "initial_release_date": "2017-04-26T10:19:21+00:00",
      "revision_history": [
        {
          "date": "2017-04-26T10:19:21+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2017-04-26T10:19:21+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-15T08:22:35+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
                  "product_id": "6Server-RHSCL-2.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
                  "product_id": "6Workstation-RHSCL-2.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
                  "product_id": "6Server-RHSCL-2.4-6.7.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
                  "product_id": "7Server-RHSCL-2.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
                  "product_id": "7Workstation-RHSCL-2.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)",
                  "product_id": "7Server-RHSCL-2.4-7.3.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Software Collections"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
                "product": {
                  "name": "httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
                  "product_id": "httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd24-httpd-manual@2.4.25-9.el6?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
                "product": {
                  "name": "httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
                  "product_id": "httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd24-httpd-manual@2.4.25-9.el7?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
                "product": {
                  "name": "httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
                  "product_id": "httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd24-mod_ssl@2.4.25-9.el6?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
                "product": {
                  "name": "httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
                  "product_id": "httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd24-httpd-debuginfo@2.4.25-9.el6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd24-mod_session-0:2.4.25-9.el6.x86_64",
                "product": {
                  "name": "httpd24-mod_session-0:2.4.25-9.el6.x86_64",
                  "product_id": "httpd24-mod_session-0:2.4.25-9.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd24-mod_session@2.4.25-9.el6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
                "product": {
                  "name": "httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
                  "product_id": "httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd24-mod_proxy_html@2.4.25-9.el6?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
                "product": {
                  "name": "httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
                  "product_id": "httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd24-mod_ldap@2.4.25-9.el6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd24-httpd-0:2.4.25-9.el6.x86_64",
                "product": {
                  "name": "httpd24-httpd-0:2.4.25-9.el6.x86_64",
                  "product_id": "httpd24-httpd-0:2.4.25-9.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd24-httpd@2.4.25-9.el6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
                "product": {
                  "name": "httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
                  "product_id": "httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd24-httpd-devel@2.4.25-9.el6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
                "product": {
                  "name": "httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
                  "product_id": "httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd24-httpd-tools@2.4.25-9.el6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
                "product": {
                  "name": "httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
                  "product_id": "httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd24-mod_ssl@2.4.25-9.el7?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd24-mod_session-0:2.4.25-9.el7.x86_64",
                "product": {
                  "name": "httpd24-mod_session-0:2.4.25-9.el7.x86_64",
                  "product_id": "httpd24-mod_session-0:2.4.25-9.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd24-mod_session@2.4.25-9.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
                "product": {
                  "name": "httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
                  "product_id": "httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd24-httpd-debuginfo@2.4.25-9.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
                "product": {
                  "name": "httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
                  "product_id": "httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd24-mod_proxy_html@2.4.25-9.el7?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
                "product": {
                  "name": "httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
                  "product_id": "httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd24-mod_ldap@2.4.25-9.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd24-httpd-0:2.4.25-9.el7.x86_64",
                "product": {
                  "name": "httpd24-httpd-0:2.4.25-9.el7.x86_64",
                  "product_id": "httpd24-httpd-0:2.4.25-9.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd24-httpd@2.4.25-9.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
                "product": {
                  "name": "httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
                  "product_id": "httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd24-httpd-devel@2.4.25-9.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
                "product": {
                  "name": "httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
                  "product_id": "httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd24-httpd-tools@2.4.25-9.el7?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "httpd24-httpd-0:2.4.25-9.el6.src",
                "product": {
                  "name": "httpd24-httpd-0:2.4.25-9.el6.src",
                  "product_id": "httpd24-httpd-0:2.4.25-9.el6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd24-httpd@2.4.25-9.el6?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "httpd24-httpd-0:2.4.25-9.el7.src",
                "product": {
                  "name": "httpd24-httpd-0:2.4.25-9.el7.src",
                  "product_id": "httpd24-httpd-0:2.4.25-9.el7.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/httpd24-httpd@2.4.25-9.el7?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-httpd-0:2.4.25-9.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
          "product_id": "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.src"
        },
        "product_reference": "httpd24-httpd-0:2.4.25-9.el6.src",
        "relates_to_product_reference": "6Server-RHSCL-2.4-6.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-httpd-0:2.4.25-9.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
          "product_id": "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.x86_64"
        },
        "product_reference": "httpd24-httpd-0:2.4.25-9.el6.x86_64",
        "relates_to_product_reference": "6Server-RHSCL-2.4-6.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
          "product_id": "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64"
        },
        "product_reference": "httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
        "relates_to_product_reference": "6Server-RHSCL-2.4-6.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-httpd-devel-0:2.4.25-9.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
          "product_id": "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64"
        },
        "product_reference": "httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
        "relates_to_product_reference": "6Server-RHSCL-2.4-6.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-httpd-manual-0:2.4.25-9.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
          "product_id": "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-manual-0:2.4.25-9.el6.noarch"
        },
        "product_reference": "httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
        "relates_to_product_reference": "6Server-RHSCL-2.4-6.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-httpd-tools-0:2.4.25-9.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
          "product_id": "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64"
        },
        "product_reference": "httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
        "relates_to_product_reference": "6Server-RHSCL-2.4-6.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-mod_ldap-0:2.4.25-9.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
          "product_id": "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64"
        },
        "product_reference": "httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
        "relates_to_product_reference": "6Server-RHSCL-2.4-6.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
          "product_id": "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64"
        },
        "product_reference": "httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
        "relates_to_product_reference": "6Server-RHSCL-2.4-6.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-mod_session-0:2.4.25-9.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
          "product_id": "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_session-0:2.4.25-9.el6.x86_64"
        },
        "product_reference": "httpd24-mod_session-0:2.4.25-9.el6.x86_64",
        "relates_to_product_reference": "6Server-RHSCL-2.4-6.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-mod_ssl-1:2.4.25-9.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
          "product_id": "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64"
        },
        "product_reference": "httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
        "relates_to_product_reference": "6Server-RHSCL-2.4-6.7.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-httpd-0:2.4.25-9.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src"
        },
        "product_reference": "httpd24-httpd-0:2.4.25-9.el6.src",
        "relates_to_product_reference": "6Server-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-httpd-0:2.4.25-9.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64"
        },
        "product_reference": "httpd24-httpd-0:2.4.25-9.el6.x86_64",
        "relates_to_product_reference": "6Server-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64"
        },
        "product_reference": "httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
        "relates_to_product_reference": "6Server-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-httpd-devel-0:2.4.25-9.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64"
        },
        "product_reference": "httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
        "relates_to_product_reference": "6Server-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-httpd-manual-0:2.4.25-9.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch"
        },
        "product_reference": "httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
        "relates_to_product_reference": "6Server-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-httpd-tools-0:2.4.25-9.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64"
        },
        "product_reference": "httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
        "relates_to_product_reference": "6Server-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-mod_ldap-0:2.4.25-9.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64"
        },
        "product_reference": "httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
        "relates_to_product_reference": "6Server-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64"
        },
        "product_reference": "httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
        "relates_to_product_reference": "6Server-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-mod_session-0:2.4.25-9.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64"
        },
        "product_reference": "httpd24-mod_session-0:2.4.25-9.el6.x86_64",
        "relates_to_product_reference": "6Server-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-mod_ssl-1:2.4.25-9.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64"
        },
        "product_reference": "httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
        "relates_to_product_reference": "6Server-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-httpd-0:2.4.25-9.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src"
        },
        "product_reference": "httpd24-httpd-0:2.4.25-9.el6.src",
        "relates_to_product_reference": "6Workstation-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-httpd-0:2.4.25-9.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64"
        },
        "product_reference": "httpd24-httpd-0:2.4.25-9.el6.x86_64",
        "relates_to_product_reference": "6Workstation-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64"
        },
        "product_reference": "httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
        "relates_to_product_reference": "6Workstation-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-httpd-devel-0:2.4.25-9.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64"
        },
        "product_reference": "httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
        "relates_to_product_reference": "6Workstation-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-httpd-manual-0:2.4.25-9.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch"
        },
        "product_reference": "httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
        "relates_to_product_reference": "6Workstation-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-httpd-tools-0:2.4.25-9.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64"
        },
        "product_reference": "httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
        "relates_to_product_reference": "6Workstation-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-mod_ldap-0:2.4.25-9.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64"
        },
        "product_reference": "httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
        "relates_to_product_reference": "6Workstation-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64"
        },
        "product_reference": "httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
        "relates_to_product_reference": "6Workstation-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-mod_session-0:2.4.25-9.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64"
        },
        "product_reference": "httpd24-mod_session-0:2.4.25-9.el6.x86_64",
        "relates_to_product_reference": "6Workstation-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-mod_ssl-1:2.4.25-9.el6.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64"
        },
        "product_reference": "httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
        "relates_to_product_reference": "6Workstation-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-httpd-0:2.4.25-9.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)",
          "product_id": "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.src"
        },
        "product_reference": "httpd24-httpd-0:2.4.25-9.el7.src",
        "relates_to_product_reference": "7Server-RHSCL-2.4-7.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-httpd-0:2.4.25-9.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)",
          "product_id": "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.x86_64"
        },
        "product_reference": "httpd24-httpd-0:2.4.25-9.el7.x86_64",
        "relates_to_product_reference": "7Server-RHSCL-2.4-7.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)",
          "product_id": "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64"
        },
        "product_reference": "httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
        "relates_to_product_reference": "7Server-RHSCL-2.4-7.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-httpd-devel-0:2.4.25-9.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)",
          "product_id": "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64"
        },
        "product_reference": "httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
        "relates_to_product_reference": "7Server-RHSCL-2.4-7.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-httpd-manual-0:2.4.25-9.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)",
          "product_id": "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-manual-0:2.4.25-9.el7.noarch"
        },
        "product_reference": "httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-2.4-7.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-httpd-tools-0:2.4.25-9.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)",
          "product_id": "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64"
        },
        "product_reference": "httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
        "relates_to_product_reference": "7Server-RHSCL-2.4-7.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-mod_ldap-0:2.4.25-9.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)",
          "product_id": "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64"
        },
        "product_reference": "httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
        "relates_to_product_reference": "7Server-RHSCL-2.4-7.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)",
          "product_id": "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64"
        },
        "product_reference": "httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
        "relates_to_product_reference": "7Server-RHSCL-2.4-7.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-mod_session-0:2.4.25-9.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)",
          "product_id": "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_session-0:2.4.25-9.el7.x86_64"
        },
        "product_reference": "httpd24-mod_session-0:2.4.25-9.el7.x86_64",
        "relates_to_product_reference": "7Server-RHSCL-2.4-7.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-mod_ssl-1:2.4.25-9.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.3)",
          "product_id": "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64"
        },
        "product_reference": "httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
        "relates_to_product_reference": "7Server-RHSCL-2.4-7.3.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-httpd-0:2.4.25-9.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src"
        },
        "product_reference": "httpd24-httpd-0:2.4.25-9.el7.src",
        "relates_to_product_reference": "7Server-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-httpd-0:2.4.25-9.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64"
        },
        "product_reference": "httpd24-httpd-0:2.4.25-9.el7.x86_64",
        "relates_to_product_reference": "7Server-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64"
        },
        "product_reference": "httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
        "relates_to_product_reference": "7Server-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-httpd-devel-0:2.4.25-9.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64"
        },
        "product_reference": "httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
        "relates_to_product_reference": "7Server-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-httpd-manual-0:2.4.25-9.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch"
        },
        "product_reference": "httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-httpd-tools-0:2.4.25-9.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64"
        },
        "product_reference": "httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
        "relates_to_product_reference": "7Server-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-mod_ldap-0:2.4.25-9.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64"
        },
        "product_reference": "httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
        "relates_to_product_reference": "7Server-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64"
        },
        "product_reference": "httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
        "relates_to_product_reference": "7Server-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-mod_session-0:2.4.25-9.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64"
        },
        "product_reference": "httpd24-mod_session-0:2.4.25-9.el7.x86_64",
        "relates_to_product_reference": "7Server-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-mod_ssl-1:2.4.25-9.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64"
        },
        "product_reference": "httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
        "relates_to_product_reference": "7Server-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-httpd-0:2.4.25-9.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src"
        },
        "product_reference": "httpd24-httpd-0:2.4.25-9.el7.src",
        "relates_to_product_reference": "7Workstation-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-httpd-0:2.4.25-9.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64"
        },
        "product_reference": "httpd24-httpd-0:2.4.25-9.el7.x86_64",
        "relates_to_product_reference": "7Workstation-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64"
        },
        "product_reference": "httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
        "relates_to_product_reference": "7Workstation-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-httpd-devel-0:2.4.25-9.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64"
        },
        "product_reference": "httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
        "relates_to_product_reference": "7Workstation-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-httpd-manual-0:2.4.25-9.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch"
        },
        "product_reference": "httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
        "relates_to_product_reference": "7Workstation-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-httpd-tools-0:2.4.25-9.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64"
        },
        "product_reference": "httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
        "relates_to_product_reference": "7Workstation-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-mod_ldap-0:2.4.25-9.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64"
        },
        "product_reference": "httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
        "relates_to_product_reference": "7Workstation-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64"
        },
        "product_reference": "httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
        "relates_to_product_reference": "7Workstation-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-mod_session-0:2.4.25-9.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64"
        },
        "product_reference": "httpd24-mod_session-0:2.4.25-9.el7.x86_64",
        "relates_to_product_reference": "7Workstation-RHSCL-2.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "httpd24-mod_ssl-1:2.4.25-9.el7.x86_64 as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64"
        },
        "product_reference": "httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
        "relates_to_product_reference": "7Workstation-RHSCL-2.4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2016-0736",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "discovery_date": "2016-12-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1406744"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was discovered that the mod_session_crypto module of httpd did not use any mechanisms to verify integrity of the encrypted session data stored in the user\u0027s browser. A remote attacker could use this flaw to decrypt and modify session data using a padding oracle attack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: Padding Oracle in Apache mod_session_crypto",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.src",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src",
          "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
          "6Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src",
          "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
          "6Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.src",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src",
          "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
          "7Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src",
          "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
          "7Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-0736"
        },
        {
          "category": "external",
          "summary": "RHBZ#1406744",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1406744"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-0736",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-0736"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0736",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0736"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html#2.4.25",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html#2.4.25"
        },
        {
          "category": "external",
          "summary": "https://www.redteam-pentesting.de/advisories/rt-sa-2016-001.txt",
          "url": "https://www.redteam-pentesting.de/advisories/rt-sa-2016-001.txt"
        }
      ],
      "release_date": "2016-12-20T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2017-04-26T10:19:21+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
          "product_ids": [
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.src",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src",
            "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
            "6Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src",
            "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
            "6Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.src",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src",
            "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
            "7Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src",
            "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
            "7Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2017:1161"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.src",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src",
            "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
            "6Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src",
            "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
            "6Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.src",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src",
            "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
            "7Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src",
            "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
            "7Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: Padding Oracle in Apache mod_session_crypto"
    },
    {
      "cve": "CVE-2016-1546",
      "discovery_date": "2016-05-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1336350"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service flaw was found in httpd\u0027s mod_http2 module. A remote attacker could use this flaw to block server threads for long times, causing starvation of worker threads, by manipulating the flow control windows on streams.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: mod_http2 denial-of-service by thread starvation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.src",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src",
          "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
          "6Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src",
          "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
          "6Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.src",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src",
          "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
          "7Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src",
          "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
          "7Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-1546"
        },
        {
          "category": "external",
          "summary": "RHBZ#1336350",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1336350"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-1546",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-1546"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-1546",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-1546"
        },
        {
          "category": "external",
          "summary": "http://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "http://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2016-04-11T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2017-04-26T10:19:21+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
          "product_ids": [
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.src",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src",
            "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
            "6Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src",
            "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
            "6Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.src",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src",
            "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
            "7Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src",
            "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
            "7Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2017:1161"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.src",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src",
            "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
            "6Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src",
            "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
            "6Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.src",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src",
            "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
            "7Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src",
            "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
            "7Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: mod_http2 denial-of-service by thread starvation"
    },
    {
      "cve": "CVE-2016-2161",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2016-12-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1406753"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was discovered that the mod_auth_digest module of httpd did not properly check for memory allocation failures. A remote attacker could use this flaw to cause httpd child processes to repeatedly crash if the server used HTTP digest authentication.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: DoS vulnerability in mod_auth_digest",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.src",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src",
          "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
          "6Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src",
          "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
          "6Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.src",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src",
          "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
          "7Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src",
          "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
          "7Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-2161"
        },
        {
          "category": "external",
          "summary": "RHBZ#1406753",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1406753"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-2161",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-2161"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-2161",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2161"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html#2.4.25",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html#2.4.25"
        }
      ],
      "release_date": "2016-12-20T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2017-04-26T10:19:21+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
          "product_ids": [
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.src",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src",
            "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
            "6Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src",
            "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
            "6Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.src",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src",
            "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
            "7Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src",
            "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
            "7Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2017:1161"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.src",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src",
            "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
            "6Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src",
            "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
            "6Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.src",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src",
            "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
            "7Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src",
            "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
            "7Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: DoS vulnerability in mod_auth_digest"
    },
    {
      "cve": "CVE-2016-8740",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2016-12-05T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1401528"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in httpd\u0027s handling of the LimitRequestFields directive in mod_http2, affecting servers with HTTP/2 enabled. An attacker could send crafted requests with headers larger than the server\u0027s available memory, causing httpd to crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: Incomplete handling of LimitRequestFields directive in mod_http2",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has rated this issue as having Low security\nimpact. This issue is not currently planned to be addressed in future\nupdates. For additional information, refer to the Issue Severity\nClassification: https://access.redhat.com/security/updates/classification/.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.src",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src",
          "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
          "6Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src",
          "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
          "6Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.src",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src",
          "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
          "7Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src",
          "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
          "7Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-8740"
        },
        {
          "category": "external",
          "summary": "RHBZ#1401528",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1401528"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-8740",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-8740"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-8740",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8740"
        },
        {
          "category": "external",
          "summary": "http://seclists.org/bugtraq/2016/Dec/3",
          "url": "http://seclists.org/bugtraq/2016/Dec/3"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2016-12-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2017-04-26T10:19:21+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
          "product_ids": [
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.src",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src",
            "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
            "6Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src",
            "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
            "6Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.src",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src",
            "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
            "7Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src",
            "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
            "7Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2017:1161"
        },
        {
          "category": "workaround",
          "details": "As a temporary workaround - HTTP/2 can be disabled by changing\nthe configuration by removing h2 and h2c from the Protocols\nline(s) in the configuration file. \n\nThe resulting line should read:\n\n\t\tProtocols http/1.1",
          "product_ids": [
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.src",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src",
            "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
            "6Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src",
            "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
            "6Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.src",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src",
            "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
            "7Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src",
            "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
            "7Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.src",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src",
            "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
            "6Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src",
            "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
            "6Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.src",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src",
            "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
            "7Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src",
            "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
            "7Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "httpd: Incomplete handling of LimitRequestFields directive in mod_http2"
    },
    {
      "cve": "CVE-2016-8743",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2016-12-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1406822"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was discovered that the HTTP parser in httpd incorrectly allowed certain characters not permitted by the HTTP protocol specification to appear unencoded in HTTP request headers. If httpd was used in conjunction with a proxy or backend server that interpreted those characters differently, a remote attacker could possibly use this flaw to inject data into HTTP responses, resulting in proxy cache poisoning.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: Apache HTTP Request Parsing Whitespace Defects",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.src",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src",
          "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
          "6Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src",
          "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
          "6Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.src",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src",
          "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
          "7Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src",
          "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
          "7Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-8743"
        },
        {
          "category": "external",
          "summary": "RHBZ#1406822",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1406822"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-8743",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-8743"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-8743",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8743"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html#2.4.25",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html#2.4.25"
        }
      ],
      "release_date": "2016-12-20T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2017-04-26T10:19:21+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
          "product_ids": [
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.src",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src",
            "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
            "6Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src",
            "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
            "6Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.src",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src",
            "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
            "7Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src",
            "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
            "7Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2017:1161"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.src",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src",
            "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
            "6Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src",
            "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
            "6Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.src",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src",
            "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
            "7Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src",
            "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
            "7Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: Apache HTTP Request Parsing Whitespace Defects"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "the Apache project"
          ]
        }
      ],
      "cve": "CVE-2020-11985",
      "cwe": {
        "id": "CWE-345",
        "name": "Insufficient Verification of Data Authenticity"
      },
      "discovery_date": "2020-08-05T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1866559"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the mod_remoteip module shipped with the httpd package. This flaw allows an attacker to spoof the IP address, resulting in the bypass of a mod_rewrite rule. The highest threat from this vulnerability is to integrity.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: IP address spoofing when proxying using mod_remoteip and mod_rewrite",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue only affects httpd-2.4.x, therefore, httpd packages shipped with Red Hat Enterprise Linux 6 are not affected by this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.src",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src",
          "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
          "6Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
          "6Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src",
          "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
          "6Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
          "6Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.src",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src",
          "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
          "7Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
          "7Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src",
          "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
          "7Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
          "7Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-11985"
        },
        {
          "category": "external",
          "summary": "RHBZ#1866559",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1866559"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11985",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-11985"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11985",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11985"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-11985",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-11985"
        }
      ],
      "release_date": "2020-08-07T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2017-04-26T10:19:21+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the updated packages, the httpd daemon will be restarted automatically.",
          "product_ids": [
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.src",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src",
            "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
            "6Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src",
            "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
            "6Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.src",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src",
            "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
            "7Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src",
            "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
            "7Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2017:1161"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.src",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4-6.7.Z:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src",
            "6Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
            "6Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
            "6Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.src",
            "6Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el6.noarch",
            "6Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el6.x86_64",
            "6Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el6.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.src",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4-7.3.Z:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src",
            "7Server-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
            "7Server-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
            "7Server-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.src",
            "7Workstation-RHSCL-2.4:httpd24-httpd-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-debuginfo-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-devel-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-httpd-manual-0:2.4.25-9.el7.noarch",
            "7Workstation-RHSCL-2.4:httpd24-httpd-tools-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_ldap-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_proxy_html-1:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_session-0:2.4.25-9.el7.x86_64",
            "7Workstation-RHSCL-2.4:httpd24-mod_ssl-1:2.4.25-9.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: IP address spoofing when proxying using mod_remoteip and mod_rewrite"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for Red Hat JBoss Core Services on RHEL 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience.\n\nThis release of Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 1 serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.23, and includes bug fixes, which are documented in the Release Notes document linked to in the References.\n\nSecurity Fix(es):\n\n* A memory leak flaw was found in the way OpenSSL handled TLS status request extension data during session renegotiation. A remote attacker could cause a TLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory, if it enabled OCSP stapling support. (CVE-2016-6304)\n\n* It was discovered that the mod_session_crypto module of httpd did not use any mechanisms to verify integrity of the encrypted session data stored in the user\u0027s browser. A remote attacker could use this flaw to decrypt and modify session data using a padding oracle attack. (CVE-2016-0736)\n\n* It was discovered that the mod_auth_digest module of httpd did not properly check for memory allocation failures. A remote attacker could use this flaw to cause httpd child processes to repeatedly crash if the server used HTTP digest authentication. (CVE-2016-2161)\n\n* A timing attack flaw was found in OpenSSL that could allow a malicious user with local access to recover ECDSA P-256 private keys. (CVE-2016-7056)\n\n* A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients. (CVE-2016-8610)\n\n* It was discovered that the HTTP parser in httpd incorrectly allowed certain characters not permitted by the HTTP protocol specification to appear unencoded in HTTP request headers. If httpd was used in conjunction with a proxy or backend server that interpreted those characters differently, a remote attacker could possibly use this flaw to inject data into HTTP responses, resulting in proxy cache poisoning. (CVE-2016-8743)\n\n* A vulnerability was found in httpd\u0027s handling of the LimitRequestFields directive in mod_http2, affecting servers with HTTP/2 enabled. An attacker could send crafted requests with headers larger than the server\u0027s available memory, causing httpd to crash. (CVE-2016-8740)\n\nRed Hat would like to thank the OpenSSL project for reporting CVE-2016-6304 and Shi Lei (Gear Team of Qihoo 360 Inc.) for reporting CVE-2016-8610. Upstream acknowledges Shi Lei (Gear Team of Qihoo 360 Inc.) as the original reporter of CVE-2016-6304.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2017:1413",
        "url": "https://access.redhat.com/errata/RHSA-2017:1413"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en/red-hat-jboss-core-services/",
        "url": "https://access.redhat.com/documentation/en/red-hat-jboss-core-services/"
      },
      {
        "category": "external",
        "summary": "1377600",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1377600"
      },
      {
        "category": "external",
        "summary": "1384743",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1384743"
      },
      {
        "category": "external",
        "summary": "1401528",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1401528"
      },
      {
        "category": "external",
        "summary": "1406744",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1406744"
      },
      {
        "category": "external",
        "summary": "1406753",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1406753"
      },
      {
        "category": "external",
        "summary": "1406822",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1406822"
      },
      {
        "category": "external",
        "summary": "1412120",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1412120"
      },
      {
        "category": "external",
        "summary": "JBCS-319",
        "url": "https://issues.redhat.com/browse/JBCS-319"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1413.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 1 for RHEL 7",
    "tracking": {
      "current_release_date": "2024-11-22T10:49:27+00:00",
      "generator": {
        "date": "2024-11-22T10:49:27+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2017:1413",
      "initial_release_date": "2017-06-07T17:54:35+00:00",
      "revision_history": [
        {
          "date": "2017-06-07T17:54:35+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2017-06-07T17:54:35+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T10:49:27+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Core Services on RHEL 7 Server",
                "product": {
                  "name": "Red Hat JBoss Core Services on RHEL 7 Server",
                  "product_id": "7Server-JBCS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_core_services:1::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Core Services"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.x86_64",
                "product": {
                  "name": "jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.x86_64",
                  "product_id": "jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl@1.0.2h-13.jbcs.el7?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el7.x86_64",
                "product": {
                  "name": "jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el7.x86_64",
                  "product_id": "jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-libs@1.0.2h-13.jbcs.el7?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el7.x86_64",
                "product": {
                  "name": "jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el7.x86_64",
                  "product_id": "jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-debuginfo@1.0.2h-13.jbcs.el7?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el7.x86_64",
                "product": {
                  "name": "jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el7.x86_64",
                  "product_id": "jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-perl@1.0.2h-13.jbcs.el7?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el7.x86_64",
                "product": {
                  "name": "jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el7.x86_64",
                  "product_id": "jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-static@1.0.2h-13.jbcs.el7?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el7.x86_64",
                "product": {
                  "name": "jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el7.x86_64",
                  "product_id": "jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-devel@1.0.2h-13.jbcs.el7?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.x86_64",
                "product": {
                  "name": "jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.x86_64",
                  "product_id": "jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_security@2.9.1-19.GA.jbcs.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el7.x86_64",
                "product": {
                  "name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el7.x86_64",
                  "product_id": "jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_security-debuginfo@2.9.1-19.GA.jbcs.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el7.x86_64",
                "product": {
                  "name": "jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el7.x86_64",
                  "product_id": "jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_session@2.4.23-120.jbcs.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el7.x86_64",
                "product": {
                  "name": "jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el7.x86_64",
                  "product_id": "jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-tools@2.4.23-120.jbcs.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el7.x86_64",
                "product": {
                  "name": "jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el7.x86_64",
                  "product_id": "jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-libs@2.4.23-120.jbcs.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el7.x86_64",
                "product": {
                  "name": "jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el7.x86_64",
                  "product_id": "jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-selinux@2.4.23-120.jbcs.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.x86_64",
                "product": {
                  "name": "jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.x86_64",
                  "product_id": "jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd@2.4.23-120.jbcs.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el7.x86_64",
                "product": {
                  "name": "jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el7.x86_64",
                  "product_id": "jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_ssl@2.4.23-120.jbcs.el7?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el7.x86_64",
                "product": {
                  "name": "jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el7.x86_64",
                  "product_id": "jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_proxy_html@2.4.23-120.jbcs.el7?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el7.x86_64",
                "product": {
                  "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el7.x86_64",
                  "product_id": "jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-debuginfo@2.4.23-120.jbcs.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el7.x86_64",
                "product": {
                  "name": "jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el7.x86_64",
                  "product_id": "jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-devel@2.4.23-120.jbcs.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el7.x86_64",
                "product": {
                  "name": "jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el7.x86_64",
                  "product_id": "jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_ldap@2.4.23-120.jbcs.el7?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.src",
                "product": {
                  "name": "jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.src",
                  "product_id": "jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl@1.0.2h-13.jbcs.el7?arch=src\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.src",
                "product": {
                  "name": "jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.src",
                  "product_id": "jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_security@2.9.1-19.GA.jbcs.el7?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.src",
                "product": {
                  "name": "jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.src",
                  "product_id": "jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd@2.4.23-120.jbcs.el7?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el7.noarch",
                "product": {
                  "name": "jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el7.noarch",
                  "product_id": "jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-manual@2.4.23-120.jbcs.el7?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server",
          "product_id": "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.src"
        },
        "product_reference": "jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.src",
        "relates_to_product_reference": "7Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
          "product_id": "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.x86_64"
        },
        "product_reference": "jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.x86_64",
        "relates_to_product_reference": "7Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
          "product_id": "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el7.x86_64"
        },
        "product_reference": "jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el7.x86_64",
        "relates_to_product_reference": "7Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
          "product_id": "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el7.x86_64"
        },
        "product_reference": "jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el7.x86_64",
        "relates_to_product_reference": "7Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
          "product_id": "7Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el7.x86_64"
        },
        "product_reference": "jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el7.x86_64",
        "relates_to_product_reference": "7Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el7.noarch as a component of Red Hat JBoss Core Services on RHEL 7 Server",
          "product_id": "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el7.noarch"
        },
        "product_reference": "jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el7.noarch",
        "relates_to_product_reference": "7Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
          "product_id": "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el7.x86_64"
        },
        "product_reference": "jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el7.x86_64",
        "relates_to_product_reference": "7Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
          "product_id": "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el7.x86_64"
        },
        "product_reference": "jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el7.x86_64",
        "relates_to_product_reference": "7Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
          "product_id": "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el7.x86_64"
        },
        "product_reference": "jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el7.x86_64",
        "relates_to_product_reference": "7Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
          "product_id": "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el7.x86_64"
        },
        "product_reference": "jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el7.x86_64",
        "relates_to_product_reference": "7Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server",
          "product_id": "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.src"
        },
        "product_reference": "jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.src",
        "relates_to_product_reference": "7Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
          "product_id": "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.x86_64"
        },
        "product_reference": "jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.x86_64",
        "relates_to_product_reference": "7Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
          "product_id": "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el7.x86_64"
        },
        "product_reference": "jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el7.x86_64",
        "relates_to_product_reference": "7Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
          "product_id": "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el7.x86_64"
        },
        "product_reference": "jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el7.x86_64",
        "relates_to_product_reference": "7Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
          "product_id": "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el7.x86_64"
        },
        "product_reference": "jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el7.x86_64",
        "relates_to_product_reference": "7Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.src as a component of Red Hat JBoss Core Services on RHEL 7 Server",
          "product_id": "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.src"
        },
        "product_reference": "jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.src",
        "relates_to_product_reference": "7Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
          "product_id": "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.x86_64"
        },
        "product_reference": "jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.x86_64",
        "relates_to_product_reference": "7Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
          "product_id": "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el7.x86_64"
        },
        "product_reference": "jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el7.x86_64",
        "relates_to_product_reference": "7Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
          "product_id": "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el7.x86_64"
        },
        "product_reference": "jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el7.x86_64",
        "relates_to_product_reference": "7Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
          "product_id": "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el7.x86_64"
        },
        "product_reference": "jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el7.x86_64",
        "relates_to_product_reference": "7Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
          "product_id": "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el7.x86_64"
        },
        "product_reference": "jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el7.x86_64",
        "relates_to_product_reference": "7Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el7.x86_64 as a component of Red Hat JBoss Core Services on RHEL 7 Server",
          "product_id": "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el7.x86_64"
        },
        "product_reference": "jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el7.x86_64",
        "relates_to_product_reference": "7Server-JBCS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2016-0736",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "discovery_date": "2016-12-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1406744"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was discovered that the mod_session_crypto module of httpd did not use any mechanisms to verify integrity of the encrypted session data stored in the user\u0027s browser. A remote attacker could use this flaw to decrypt and modify session data using a padding oracle attack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: Padding Oracle in Apache mod_session_crypto",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.src",
          "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el7.noarch",
          "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.src",
          "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.src",
          "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-0736"
        },
        {
          "category": "external",
          "summary": "RHBZ#1406744",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1406744"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-0736",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-0736"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0736",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0736"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html#2.4.25",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html#2.4.25"
        },
        {
          "category": "external",
          "summary": "https://www.redteam-pentesting.de/advisories/rt-sa-2016-001.txt",
          "url": "https://www.redteam-pentesting.de/advisories/rt-sa-2016-001.txt"
        }
      ],
      "release_date": "2016-12-20T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2017-06-07T17:54:35+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.",
          "product_ids": [
            "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el7.noarch",
            "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2017:1413"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el7.noarch",
            "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: Padding Oracle in Apache mod_session_crypto"
    },
    {
      "cve": "CVE-2016-2161",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2016-12-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1406753"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was discovered that the mod_auth_digest module of httpd did not properly check for memory allocation failures. A remote attacker could use this flaw to cause httpd child processes to repeatedly crash if the server used HTTP digest authentication.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: DoS vulnerability in mod_auth_digest",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.src",
          "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el7.noarch",
          "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.src",
          "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.src",
          "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-2161"
        },
        {
          "category": "external",
          "summary": "RHBZ#1406753",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1406753"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-2161",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-2161"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-2161",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2161"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html#2.4.25",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html#2.4.25"
        }
      ],
      "release_date": "2016-12-20T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2017-06-07T17:54:35+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.",
          "product_ids": [
            "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el7.noarch",
            "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2017:1413"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el7.noarch",
            "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: DoS vulnerability in mod_auth_digest"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "the OpenSSL project"
          ]
        },
        {
          "names": [
            "Shi Lei"
          ],
          "organization": "Gear Team of Qihoo 360 Inc.",
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2016-6304",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2016-09-19T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1377600"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A memory leak flaw was found in the way OpenSSL handled TLS status request extension data during session renegotiation. A remote attacker could cause a TLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory, if it enabled OCSP stapling support.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: OCSP Status Request extension unbounded memory growth",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "TLS server applications using OpenSSL versions in Red Hat Enterprise Linux 6 and 7 are only affected if they enable OCSP stapling support. Applications not enabling OCSP stapling support are not affected. Few applications implement OCSP stapling support and typically do not enable it by default.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.src",
          "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el7.noarch",
          "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.src",
          "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.src",
          "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-6304"
        },
        {
          "category": "external",
          "summary": "RHBZ#1377600",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1377600"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-6304",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-6304"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6304",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6304"
        },
        {
          "category": "external",
          "summary": "https://www.openssl.org/news/secadv/20160922.txt",
          "url": "https://www.openssl.org/news/secadv/20160922.txt"
        }
      ],
      "release_date": "2016-09-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2017-06-07T17:54:35+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.",
          "product_ids": [
            "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el7.noarch",
            "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2017:1413"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el7.noarch",
            "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "openssl: OCSP Status Request extension unbounded memory growth"
    },
    {
      "cve": "CVE-2016-7056",
      "cwe": {
        "id": "CWE-385",
        "name": "Covert Timing Channel"
      },
      "discovery_date": "2017-01-10T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1412120"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A timing attack flaw was found in OpenSSL that could allow a malicious user with local access to recover ECDSA P-256 private keys.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: ECDSA P-256 timing attack key recovery",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In order to exploit this flaw, the attacker needs to be have local (shell) access to the machine where the message is being signed using the ECDSA algorithm with a P-256 elliptic curve key. Then using cache timing attacks (which needs precise timing), on multiple signature runs, the private key could be obtained. Based on the factor that exploitation is difficult, Red Hat Product Security Team has rated this flaw as having Moderate impact. A further security release may address this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.src",
          "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el7.noarch",
          "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.src",
          "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.src",
          "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-7056"
        },
        {
          "category": "external",
          "summary": "RHBZ#1412120",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1412120"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-7056",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-7056"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-7056",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7056"
        }
      ],
      "release_date": "2017-01-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2017-06-07T17:54:35+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.",
          "product_ids": [
            "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el7.noarch",
            "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2017:1413"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el7.noarch",
            "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: ECDSA P-256 timing attack key recovery"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Shi Lei"
          ],
          "organization": "Gear Team of Qihoo 360 Inc."
        }
      ],
      "cve": "CVE-2016-8610",
      "discovery_date": "2016-10-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1384743"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "SSL/TLS: Malformed plain-text ALERT packets could cause remote DoS",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw affects applications that are compiled against OpenSSL or GnuTLS and do not allocate an extra thread for processing ClientHello messages. Nginx is affected by this issue; Apache httpd is not affected by this issue. This issue has been rated as having a security impact of Moderate. It requires an attacker to send a very large amount of SSL ALERT messages to the host network connection. This issue can also be mitigated by configuring firewalls to limit the number of connections per IP address, or use deep packet inspection to reject these type of alert packets. A future update may address this issue.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.src",
          "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el7.noarch",
          "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.src",
          "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.src",
          "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-8610"
        },
        {
          "category": "external",
          "summary": "RHBZ#1384743",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1384743"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-8610",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-8610"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-8610",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8610"
        },
        {
          "category": "external",
          "summary": "http://security.360.cn/cve/CVE-2016-8610",
          "url": "http://security.360.cn/cve/CVE-2016-8610"
        }
      ],
      "release_date": "2016-10-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2017-06-07T17:54:35+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.",
          "product_ids": [
            "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el7.noarch",
            "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2017:1413"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el7.noarch",
            "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "SSL/TLS: Malformed plain-text ALERT packets could cause remote DoS"
    },
    {
      "cve": "CVE-2016-8740",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2016-12-05T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1401528"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in httpd\u0027s handling of the LimitRequestFields directive in mod_http2, affecting servers with HTTP/2 enabled. An attacker could send crafted requests with headers larger than the server\u0027s available memory, causing httpd to crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: Incomplete handling of LimitRequestFields directive in mod_http2",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has rated this issue as having Low security\nimpact. This issue is not currently planned to be addressed in future\nupdates. For additional information, refer to the Issue Severity\nClassification: https://access.redhat.com/security/updates/classification/.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.src",
          "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el7.noarch",
          "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.src",
          "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.src",
          "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-8740"
        },
        {
          "category": "external",
          "summary": "RHBZ#1401528",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1401528"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-8740",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-8740"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-8740",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8740"
        },
        {
          "category": "external",
          "summary": "http://seclists.org/bugtraq/2016/Dec/3",
          "url": "http://seclists.org/bugtraq/2016/Dec/3"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2016-12-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2017-06-07T17:54:35+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.",
          "product_ids": [
            "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el7.noarch",
            "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2017:1413"
        },
        {
          "category": "workaround",
          "details": "As a temporary workaround - HTTP/2 can be disabled by changing\nthe configuration by removing h2 and h2c from the Protocols\nline(s) in the configuration file. \n\nThe resulting line should read:\n\n\t\tProtocols http/1.1",
          "product_ids": [
            "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el7.noarch",
            "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el7.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el7.noarch",
            "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "httpd: Incomplete handling of LimitRequestFields directive in mod_http2"
    },
    {
      "cve": "CVE-2016-8743",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2016-12-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1406822"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was discovered that the HTTP parser in httpd incorrectly allowed certain characters not permitted by the HTTP protocol specification to appear unencoded in HTTP request headers. If httpd was used in conjunction with a proxy or backend server that interpreted those characters differently, a remote attacker could possibly use this flaw to inject data into HTTP responses, resulting in proxy cache poisoning.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: Apache HTTP Request Parsing Whitespace Defects",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.src",
          "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el7.noarch",
          "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.src",
          "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.src",
          "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el7.x86_64",
          "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-8743"
        },
        {
          "category": "external",
          "summary": "RHBZ#1406822",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1406822"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-8743",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-8743"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-8743",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8743"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html#2.4.25",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html#2.4.25"
        }
      ],
      "release_date": "2016-12-20T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2017-06-07T17:54:35+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.",
          "product_ids": [
            "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el7.noarch",
            "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2017:1413"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el7.noarch",
            "7Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.src",
            "7Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el7.x86_64",
            "7Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: Apache HTTP Request Parsing Whitespace Defects"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for Red Hat JBoss Core Services on RHEL 6.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience.\n\nThis release of Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 1 serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.23, and includes bug fixes, which are documented in the Release Notes document linked to in the References.\n\nSecurity Fix(es):\n\n* A memory leak flaw was found in the way OpenSSL handled TLS status request extension data during session renegotiation. A remote attacker could cause a TLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory, if it enabled OCSP stapling support. (CVE-2016-6304)\n\n* It was discovered that the mod_session_crypto module of httpd did not use any mechanisms to verify integrity of the encrypted session data stored in the user\u0027s browser. A remote attacker could use this flaw to decrypt and modify session data using a padding oracle attack. (CVE-2016-0736)\n\n* It was discovered that the mod_auth_digest module of httpd did not properly check for memory allocation failures. A remote attacker could use this flaw to cause httpd child processes to repeatedly crash if the server used HTTP digest authentication. (CVE-2016-2161)\n\n* A timing attack flaw was found in OpenSSL that could allow a malicious user with local access to recover ECDSA P-256 private keys. (CVE-2016-7056)\n\n* A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients. (CVE-2016-8610)\n\n* It was discovered that the HTTP parser in httpd incorrectly allowed certain characters not permitted by the HTTP protocol specification to appear unencoded in HTTP request headers. If httpd was used in conjunction with a proxy or backend server that interpreted those characters differently, a remote attacker could possibly use this flaw to inject data into HTTP responses, resulting in proxy cache poisoning. (CVE-2016-8743)\n\n* A vulnerability was found in httpd\u0027s handling of the LimitRequestFields directive in mod_http2, affecting servers with HTTP/2 enabled. An attacker could send crafted requests with headers larger than the server\u0027s available memory, causing httpd to crash. (CVE-2016-8740)\n\nRed Hat would like to thank the OpenSSL project for reporting CVE-2016-6304 and Shi Lei (Gear Team of Qihoo 360 Inc.) for reporting CVE-2016-8610. Upstream acknowledges Shi Lei (Gear Team of Qihoo 360 Inc.) as the original reporter of CVE-2016-6304.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2017:1414",
        "url": "https://access.redhat.com/errata/RHSA-2017:1414"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en/red-hat-jboss-core-services/",
        "url": "https://access.redhat.com/documentation/en/red-hat-jboss-core-services/"
      },
      {
        "category": "external",
        "summary": "1377600",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1377600"
      },
      {
        "category": "external",
        "summary": "1384743",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1384743"
      },
      {
        "category": "external",
        "summary": "1401528",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1401528"
      },
      {
        "category": "external",
        "summary": "1406744",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1406744"
      },
      {
        "category": "external",
        "summary": "1406753",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1406753"
      },
      {
        "category": "external",
        "summary": "1406822",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1406822"
      },
      {
        "category": "external",
        "summary": "1412120",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1412120"
      },
      {
        "category": "external",
        "summary": "JBCS-318",
        "url": "https://issues.redhat.com/browse/JBCS-318"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1414.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 1 for RHEL 6",
    "tracking": {
      "current_release_date": "2024-11-22T10:49:32+00:00",
      "generator": {
        "date": "2024-11-22T10:49:32+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2017:1414",
      "initial_release_date": "2017-06-07T17:54:17+00:00",
      "revision_history": [
        {
          "date": "2017-06-07T17:54:17+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2017-06-07T17:54:17+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T10:49:32+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Core Services on RHEL 6 Server",
                "product": {
                  "name": "Red Hat JBoss Core Services on RHEL 6 Server",
                  "product_id": "6Server-JBCS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_core_services:1::el6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Core Services"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.x86_64",
                "product": {
                  "name": "jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.x86_64",
                  "product_id": "jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl@1.0.2h-13.jbcs.el6?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.x86_64",
                "product": {
                  "name": "jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.x86_64",
                  "product_id": "jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-libs@1.0.2h-13.jbcs.el6?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.x86_64",
                "product": {
                  "name": "jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.x86_64",
                  "product_id": "jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-perl@1.0.2h-13.jbcs.el6?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.x86_64",
                "product": {
                  "name": "jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.x86_64",
                  "product_id": "jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-debuginfo@1.0.2h-13.jbcs.el6?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.x86_64",
                "product": {
                  "name": "jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.x86_64",
                  "product_id": "jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-static@1.0.2h-13.jbcs.el6?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.x86_64",
                "product": {
                  "name": "jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.x86_64",
                  "product_id": "jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-devel@1.0.2h-13.jbcs.el6?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.x86_64",
                "product": {
                  "name": "jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.x86_64",
                  "product_id": "jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_security@2.9.1-19.GA.jbcs.el6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.x86_64",
                "product": {
                  "name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.x86_64",
                  "product_id": "jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_security-debuginfo@2.9.1-19.GA.jbcs.el6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.x86_64",
                "product": {
                  "name": "jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.x86_64",
                  "product_id": "jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_session@2.4.23-120.jbcs.el6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.x86_64",
                "product": {
                  "name": "jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.x86_64",
                  "product_id": "jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-selinux@2.4.23-120.jbcs.el6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.x86_64",
                "product": {
                  "name": "jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.x86_64",
                  "product_id": "jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-tools@2.4.23-120.jbcs.el6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.x86_64",
                "product": {
                  "name": "jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.x86_64",
                  "product_id": "jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-libs@2.4.23-120.jbcs.el6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.x86_64",
                "product": {
                  "name": "jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.x86_64",
                  "product_id": "jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_ssl@2.4.23-120.jbcs.el6?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.x86_64",
                "product": {
                  "name": "jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.x86_64",
                  "product_id": "jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd@2.4.23-120.jbcs.el6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.x86_64",
                "product": {
                  "name": "jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.x86_64",
                  "product_id": "jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_proxy_html@2.4.23-120.jbcs.el6?arch=x86_64\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.x86_64",
                "product": {
                  "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.x86_64",
                  "product_id": "jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-debuginfo@2.4.23-120.jbcs.el6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.x86_64",
                "product": {
                  "name": "jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.x86_64",
                  "product_id": "jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-devel@2.4.23-120.jbcs.el6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.x86_64",
                "product": {
                  "name": "jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.x86_64",
                  "product_id": "jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_ldap@2.4.23-120.jbcs.el6?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.src",
                "product": {
                  "name": "jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.src",
                  "product_id": "jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl@1.0.2h-13.jbcs.el6?arch=src\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.src",
                "product": {
                  "name": "jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.src",
                  "product_id": "jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_security@2.9.1-19.GA.jbcs.el6?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.src",
                "product": {
                  "name": "jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.src",
                  "product_id": "jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd@2.4.23-120.jbcs.el6?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.i686",
                "product": {
                  "name": "jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.i686",
                  "product_id": "jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl@1.0.2h-13.jbcs.el6?arch=i686\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.i686",
                "product": {
                  "name": "jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.i686",
                  "product_id": "jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-libs@1.0.2h-13.jbcs.el6?arch=i686\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.i686",
                "product": {
                  "name": "jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.i686",
                  "product_id": "jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-perl@1.0.2h-13.jbcs.el6?arch=i686\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.i686",
                "product": {
                  "name": "jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.i686",
                  "product_id": "jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-debuginfo@1.0.2h-13.jbcs.el6?arch=i686\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.i686",
                "product": {
                  "name": "jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.i686",
                  "product_id": "jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-static@1.0.2h-13.jbcs.el6?arch=i686\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.i686",
                "product": {
                  "name": "jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.i686",
                  "product_id": "jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-openssl-devel@1.0.2h-13.jbcs.el6?arch=i686\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.i686",
                "product": {
                  "name": "jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.i686",
                  "product_id": "jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_security@2.9.1-19.GA.jbcs.el6?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.i686",
                "product": {
                  "name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.i686",
                  "product_id": "jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_security-debuginfo@2.9.1-19.GA.jbcs.el6?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.i686",
                "product": {
                  "name": "jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.i686",
                  "product_id": "jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_session@2.4.23-120.jbcs.el6?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.i686",
                "product": {
                  "name": "jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.i686",
                  "product_id": "jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-selinux@2.4.23-120.jbcs.el6?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.i686",
                "product": {
                  "name": "jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.i686",
                  "product_id": "jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-tools@2.4.23-120.jbcs.el6?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.i686",
                "product": {
                  "name": "jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.i686",
                  "product_id": "jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-libs@2.4.23-120.jbcs.el6?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.i686",
                "product": {
                  "name": "jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.i686",
                  "product_id": "jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_ssl@2.4.23-120.jbcs.el6?arch=i686\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.i686",
                "product": {
                  "name": "jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.i686",
                  "product_id": "jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd@2.4.23-120.jbcs.el6?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.i686",
                "product": {
                  "name": "jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.i686",
                  "product_id": "jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_proxy_html@2.4.23-120.jbcs.el6?arch=i686\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.i686",
                "product": {
                  "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.i686",
                  "product_id": "jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-debuginfo@2.4.23-120.jbcs.el6?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.i686",
                "product": {
                  "name": "jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.i686",
                  "product_id": "jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-devel@2.4.23-120.jbcs.el6?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.i686",
                "product": {
                  "name": "jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.i686",
                  "product_id": "jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-mod_ldap@2.4.23-120.jbcs.el6?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el6.noarch",
                "product": {
                  "name": "jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el6.noarch",
                  "product_id": "jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jbcs-httpd24-httpd-manual@2.4.23-120.jbcs.el6?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.i686"
        },
        "product_reference": "jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.i686",
        "relates_to_product_reference": "6Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.src"
        },
        "product_reference": "jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.src",
        "relates_to_product_reference": "6Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.x86_64"
        },
        "product_reference": "jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.x86_64",
        "relates_to_product_reference": "6Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.i686"
        },
        "product_reference": "jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.i686",
        "relates_to_product_reference": "6Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.x86_64"
        },
        "product_reference": "jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.x86_64",
        "relates_to_product_reference": "6Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.i686"
        },
        "product_reference": "jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.i686",
        "relates_to_product_reference": "6Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.x86_64"
        },
        "product_reference": "jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.x86_64",
        "relates_to_product_reference": "6Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.i686"
        },
        "product_reference": "jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.i686",
        "relates_to_product_reference": "6Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.x86_64"
        },
        "product_reference": "jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.x86_64",
        "relates_to_product_reference": "6Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el6.noarch as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el6.noarch"
        },
        "product_reference": "jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el6.noarch",
        "relates_to_product_reference": "6Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.i686"
        },
        "product_reference": "jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.i686",
        "relates_to_product_reference": "6Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.x86_64"
        },
        "product_reference": "jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.x86_64",
        "relates_to_product_reference": "6Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.i686"
        },
        "product_reference": "jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.i686",
        "relates_to_product_reference": "6Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.x86_64"
        },
        "product_reference": "jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.x86_64",
        "relates_to_product_reference": "6Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.i686"
        },
        "product_reference": "jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.i686",
        "relates_to_product_reference": "6Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.x86_64"
        },
        "product_reference": "jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.x86_64",
        "relates_to_product_reference": "6Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.i686"
        },
        "product_reference": "jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.i686",
        "relates_to_product_reference": "6Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.x86_64"
        },
        "product_reference": "jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.x86_64",
        "relates_to_product_reference": "6Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.i686"
        },
        "product_reference": "jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.i686",
        "relates_to_product_reference": "6Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.src"
        },
        "product_reference": "jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.src",
        "relates_to_product_reference": "6Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.x86_64"
        },
        "product_reference": "jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.x86_64",
        "relates_to_product_reference": "6Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.i686"
        },
        "product_reference": "jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.i686",
        "relates_to_product_reference": "6Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.x86_64"
        },
        "product_reference": "jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.x86_64",
        "relates_to_product_reference": "6Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.i686"
        },
        "product_reference": "jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.i686",
        "relates_to_product_reference": "6Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.x86_64"
        },
        "product_reference": "jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.x86_64",
        "relates_to_product_reference": "6Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.i686"
        },
        "product_reference": "jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.i686",
        "relates_to_product_reference": "6Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.x86_64"
        },
        "product_reference": "jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.x86_64",
        "relates_to_product_reference": "6Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.i686"
        },
        "product_reference": "jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.i686",
        "relates_to_product_reference": "6Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.src as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.src"
        },
        "product_reference": "jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.src",
        "relates_to_product_reference": "6Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.x86_64"
        },
        "product_reference": "jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.x86_64",
        "relates_to_product_reference": "6Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.i686"
        },
        "product_reference": "jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.i686",
        "relates_to_product_reference": "6Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.x86_64"
        },
        "product_reference": "jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.x86_64",
        "relates_to_product_reference": "6Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.i686"
        },
        "product_reference": "jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.i686",
        "relates_to_product_reference": "6Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.x86_64"
        },
        "product_reference": "jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.x86_64",
        "relates_to_product_reference": "6Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.i686"
        },
        "product_reference": "jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.i686",
        "relates_to_product_reference": "6Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.x86_64"
        },
        "product_reference": "jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.x86_64",
        "relates_to_product_reference": "6Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.i686"
        },
        "product_reference": "jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.i686",
        "relates_to_product_reference": "6Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.x86_64"
        },
        "product_reference": "jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.x86_64",
        "relates_to_product_reference": "6Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.i686 as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.i686"
        },
        "product_reference": "jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.i686",
        "relates_to_product_reference": "6Server-JBCS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.x86_64 as a component of Red Hat JBoss Core Services on RHEL 6 Server",
          "product_id": "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.x86_64"
        },
        "product_reference": "jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.x86_64",
        "relates_to_product_reference": "6Server-JBCS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2016-0736",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "discovery_date": "2016-12-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1406744"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was discovered that the mod_session_crypto module of httpd did not use any mechanisms to verify integrity of the encrypted session data stored in the user\u0027s browser. A remote attacker could use this flaw to decrypt and modify session data using a padding oracle attack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: Padding Oracle in Apache mod_session_crypto",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.src",
          "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el6.noarch",
          "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.src",
          "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.src",
          "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-0736"
        },
        {
          "category": "external",
          "summary": "RHBZ#1406744",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1406744"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-0736",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-0736"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-0736",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0736"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html#2.4.25",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html#2.4.25"
        },
        {
          "category": "external",
          "summary": "https://www.redteam-pentesting.de/advisories/rt-sa-2016-001.txt",
          "url": "https://www.redteam-pentesting.de/advisories/rt-sa-2016-001.txt"
        }
      ],
      "release_date": "2016-12-20T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2017-06-07T17:54:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.",
          "product_ids": [
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el6.noarch",
            "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2017:1414"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el6.noarch",
            "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: Padding Oracle in Apache mod_session_crypto"
    },
    {
      "cve": "CVE-2016-2161",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2016-12-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1406753"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was discovered that the mod_auth_digest module of httpd did not properly check for memory allocation failures. A remote attacker could use this flaw to cause httpd child processes to repeatedly crash if the server used HTTP digest authentication.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: DoS vulnerability in mod_auth_digest",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.src",
          "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el6.noarch",
          "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.src",
          "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.src",
          "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-2161"
        },
        {
          "category": "external",
          "summary": "RHBZ#1406753",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1406753"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-2161",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-2161"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-2161",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2161"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html#2.4.25",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html#2.4.25"
        }
      ],
      "release_date": "2016-12-20T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2017-06-07T17:54:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.",
          "product_ids": [
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el6.noarch",
            "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2017:1414"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el6.noarch",
            "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: DoS vulnerability in mod_auth_digest"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "the OpenSSL project"
          ]
        },
        {
          "names": [
            "Shi Lei"
          ],
          "organization": "Gear Team of Qihoo 360 Inc.",
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2016-6304",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "discovery_date": "2016-09-19T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1377600"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A memory leak flaw was found in the way OpenSSL handled TLS status request extension data during session renegotiation. A remote attacker could cause a TLS server using OpenSSL to consume an excessive amount of memory and, possibly, exit unexpectedly after exhausting all available memory, if it enabled OCSP stapling support.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: OCSP Status Request extension unbounded memory growth",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "TLS server applications using OpenSSL versions in Red Hat Enterprise Linux 6 and 7 are only affected if they enable OCSP stapling support. Applications not enabling OCSP stapling support are not affected. Few applications implement OCSP stapling support and typically do not enable it by default.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.src",
          "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el6.noarch",
          "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.src",
          "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.src",
          "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-6304"
        },
        {
          "category": "external",
          "summary": "RHBZ#1377600",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1377600"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-6304",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-6304"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6304",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6304"
        },
        {
          "category": "external",
          "summary": "https://www.openssl.org/news/secadv/20160922.txt",
          "url": "https://www.openssl.org/news/secadv/20160922.txt"
        }
      ],
      "release_date": "2016-09-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2017-06-07T17:54:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.",
          "product_ids": [
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el6.noarch",
            "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2017:1414"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el6.noarch",
            "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "openssl: OCSP Status Request extension unbounded memory growth"
    },
    {
      "cve": "CVE-2016-7056",
      "cwe": {
        "id": "CWE-385",
        "name": "Covert Timing Channel"
      },
      "discovery_date": "2017-01-10T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1412120"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A timing attack flaw was found in OpenSSL that could allow a malicious user with local access to recover ECDSA P-256 private keys.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: ECDSA P-256 timing attack key recovery",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In order to exploit this flaw, the attacker needs to be have local (shell) access to the machine where the message is being signed using the ECDSA algorithm with a P-256 elliptic curve key. Then using cache timing attacks (which needs precise timing), on multiple signature runs, the private key could be obtained. Based on the factor that exploitation is difficult, Red Hat Product Security Team has rated this flaw as having Moderate impact. A further security release may address this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.src",
          "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el6.noarch",
          "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.src",
          "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.src",
          "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-7056"
        },
        {
          "category": "external",
          "summary": "RHBZ#1412120",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1412120"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-7056",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-7056"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-7056",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7056"
        }
      ],
      "release_date": "2017-01-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2017-06-07T17:54:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.",
          "product_ids": [
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el6.noarch",
            "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2017:1414"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el6.noarch",
            "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: ECDSA P-256 timing attack key recovery"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Shi Lei"
          ],
          "organization": "Gear Team of Qihoo 360 Inc."
        }
      ],
      "cve": "CVE-2016-8610",
      "discovery_date": "2016-10-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1384743"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A denial of service flaw was found in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "SSL/TLS: Malformed plain-text ALERT packets could cause remote DoS",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw affects applications that are compiled against OpenSSL or GnuTLS and do not allocate an extra thread for processing ClientHello messages. Nginx is affected by this issue; Apache httpd is not affected by this issue. This issue has been rated as having a security impact of Moderate. It requires an attacker to send a very large amount of SSL ALERT messages to the host network connection. This issue can also be mitigated by configuring firewalls to limit the number of connections per IP address, or use deep packet inspection to reject these type of alert packets. A future update may address this issue.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.src",
          "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el6.noarch",
          "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.src",
          "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.src",
          "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-8610"
        },
        {
          "category": "external",
          "summary": "RHBZ#1384743",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1384743"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-8610",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-8610"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-8610",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8610"
        },
        {
          "category": "external",
          "summary": "http://security.360.cn/cve/CVE-2016-8610",
          "url": "http://security.360.cn/cve/CVE-2016-8610"
        }
      ],
      "release_date": "2016-10-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2017-06-07T17:54:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.",
          "product_ids": [
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el6.noarch",
            "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2017:1414"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el6.noarch",
            "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "SSL/TLS: Malformed plain-text ALERT packets could cause remote DoS"
    },
    {
      "cve": "CVE-2016-8740",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2016-12-05T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1401528"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in httpd\u0027s handling of the LimitRequestFields directive in mod_http2, affecting servers with HTTP/2 enabled. An attacker could send crafted requests with headers larger than the server\u0027s available memory, causing httpd to crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: Incomplete handling of LimitRequestFields directive in mod_http2",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has rated this issue as having Low security\nimpact. This issue is not currently planned to be addressed in future\nupdates. For additional information, refer to the Issue Severity\nClassification: https://access.redhat.com/security/updates/classification/.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.src",
          "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el6.noarch",
          "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.src",
          "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.src",
          "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-8740"
        },
        {
          "category": "external",
          "summary": "RHBZ#1401528",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1401528"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-8740",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-8740"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-8740",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8740"
        },
        {
          "category": "external",
          "summary": "http://seclists.org/bugtraq/2016/Dec/3",
          "url": "http://seclists.org/bugtraq/2016/Dec/3"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html"
        }
      ],
      "release_date": "2016-12-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2017-06-07T17:54:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.",
          "product_ids": [
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el6.noarch",
            "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2017:1414"
        },
        {
          "category": "workaround",
          "details": "As a temporary workaround - HTTP/2 can be disabled by changing\nthe configuration by removing h2 and h2c from the Protocols\nline(s) in the configuration file. \n\nThe resulting line should read:\n\n\t\tProtocols http/1.1",
          "product_ids": [
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el6.noarch",
            "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el6.noarch",
            "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "httpd: Incomplete handling of LimitRequestFields directive in mod_http2"
    },
    {
      "cve": "CVE-2016-8743",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2016-12-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1406822"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was discovered that the HTTP parser in httpd incorrectly allowed certain characters not permitted by the HTTP protocol specification to appear unencoded in HTTP request headers. If httpd was used in conjunction with a proxy or backend server that interpreted those characters differently, a remote attacker could possibly use this flaw to inject data into HTTP responses, resulting in proxy cache poisoning.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "httpd: Apache HTTP Request Parsing Whitespace Defects",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.src",
          "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el6.noarch",
          "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.src",
          "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.src",
          "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.x86_64",
          "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.i686",
          "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-8743"
        },
        {
          "category": "external",
          "summary": "RHBZ#1406822",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1406822"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-8743",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-8743"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-8743",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8743"
        },
        {
          "category": "external",
          "summary": "https://httpd.apache.org/security/vulnerabilities_24.html#2.4.25",
          "url": "https://httpd.apache.org/security/vulnerabilities_24.html#2.4.25"
        }
      ],
      "release_date": "2016-12-20T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2017-06-07T17:54:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nFor the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.",
          "product_ids": [
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el6.noarch",
            "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2017:1414"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-debuginfo-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-devel-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-libs-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-manual-0:2.4.23-120.jbcs.el6.noarch",
            "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-selinux-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-httpd-tools-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_ldap-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_proxy_html-1:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_security-debuginfo-0:2.9.1-19.GA.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_session-0:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-mod_ssl-1:2.4.23-120.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.src",
            "6Server-JBCS:jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.x86_64",
            "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.i686",
            "6Server-JBCS:jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "httpd: Apache HTTP Request Parsing Whitespace Defects"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2016-8740"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2016-12-05T19:59:00Z",
    "severity": "HIGH"
  },
  "details": "The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows remote attackers to cause a denial of service (memory consumption) via crafted CONTINUATION frames in an HTTP/2 request.",
  "id": "GHSA-pfj2-72r3-p693",
  "modified": "2022-05-13T01:09:43Z",
  "published": "2022-05-13T01:09:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8740"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/httpd/commit/29c63b786ae028d82405421585e91283c8fa0da3"
    },
    {
      "type": "WEB",
      "url": "https://www.tenable.com/security/tns-2017-04"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/40909"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/HT208221"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20180423-0001"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/201701-36"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234@%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467@%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9@%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f@%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e@%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b@%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a@%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f@%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830@%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbux03725en_us"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2017:1414"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2017:1413"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2017:1161"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/140023/Apache-HTTPD-Web-Server-2.4.23-Memory-Exhaustion.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2017-1415.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/94650"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1037388"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "GSD": {
    "alias": "CVE-2016-8740",
    "description": "The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows remote attackers to cause a denial of service (memory consumption) via crafted CONTINUATION frames in an HTTP/2 request.",
    "id": "GSD-2016-8740",
    "references": [
      "https://www.suse.com/security/cve/CVE-2016-8740.html",
      "https://access.redhat.com/errata/RHSA-2017:1415",
      "https://access.redhat.com/errata/RHSA-2017:1414",
      "https://access.redhat.com/errata/RHSA-2017:1413",
      "https://access.redhat.com/errata/RHSA-2017:1161"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2016-8740"
      ],
      "details": "The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows remote attackers to cause a denial of service (memory consumption) via crafted CONTINUATION frames in an HTTP/2 request.",
      "id": "GSD-2016-8740",
      "modified": "2023-12-13T01:21:22.457115Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@apache.org",
        "ID": "CVE-2016-8740",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Apache HTTP Server",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "2.4.17 - 2.4.23"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Apache Software Foundation"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows remote attackers to cause a denial of service (memory consumption) via crafted CONTINUATION frames in an HTTP/2 request."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://support.apple.com/HT208221",
            "refsource": "CONFIRM",
            "url": "https://support.apple.com/HT208221"
          },
          {
            "name": "https://github.com/apache/httpd/commit/29c63b786ae028d82405421585e91283c8fa0da3",
            "refsource": "CONFIRM",
            "url": "https://github.com/apache/httpd/commit/29c63b786ae028d82405421585e91283c8fa0da3"
          },
          {
            "name": "1037388",
            "refsource": "SECTRACK",
            "url": "http://www.securitytracker.com/id/1037388"
          },
          {
            "name": "http://packetstormsecurity.com/files/140023/Apache-HTTPD-Web-Server-2.4.23-Memory-Exhaustion.html",
            "refsource": "MISC",
            "url": "http://packetstormsecurity.com/files/140023/Apache-HTTPD-Web-Server-2.4.23-Memory-Exhaustion.html"
          },
          {
            "name": "RHSA-2017:1413",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2017:1413"
          },
          {
            "name": "RHSA-2017:1161",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2017:1161"
          },
          {
            "name": "https://www.tenable.com/security/tns-2017-04",
            "refsource": "CONFIRM",
            "url": "https://www.tenable.com/security/tns-2017-04"
          },
          {
            "name": "RHSA-2017:1414",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2017:1414"
          },
          {
            "name": "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbux03725en_us",
            "refsource": "CONFIRM",
            "url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbux03725en_us"
          },
          {
            "name": "40909",
            "refsource": "EXPLOIT-DB",
            "url": "https://www.exploit-db.com/exploits/40909/"
          },
          {
            "name": "RHSA-2017:1415",
            "refsource": "REDHAT",
            "url": "http://rhn.redhat.com/errata/RHSA-2017-1415.html"
          },
          {
            "name": "94650",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/94650"
          },
          {
            "name": "GLSA-201701-36",
            "refsource": "GENTOO",
            "url": "https://security.gentoo.org/glsa/201701-36"
          },
          {
            "name": "https://security.netapp.com/advisory/ntap-20180423-0001/",
            "refsource": "CONFIRM",
            "url": "https://security.netapp.com/advisory/ntap-20180423-0001/"
          },
          {
            "name": "[httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830@%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-cvs] 20200401 svn commit: r1058586 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f@%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-cvs] 20200401 svn commit: r1058587 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234@%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-cvs] 20210330 svn commit: r1073140 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-cvs] 20210330 svn commit: r1888194 [10/13] - /httpd/site/trunk/content/security/json/",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467@%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-cvs] 20210330 svn commit: r1073139 [10/13] - in /websites/staging/httpd/trunk/content: ./ security/json/",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f@%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-cvs] 20210330 svn commit: r1073146 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e@%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-cvs] 20210330 svn commit: r1073149 [10/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b@%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-cvs] 20210603 svn commit: r1075360 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9@%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-cvs] 20210606 svn commit: r1075467 [2/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a@%3Ccvs.httpd.apache.org%3E"
          },
          {
            "name": "[httpd-cvs] 20210606 svn commit: r1075470 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
            "refsource": "MLIST",
            "url": "https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:apache:http_server:2.4.22:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:http_server:2.4.21:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:http_server:2.4.17:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:http_server:2.4.23:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:http_server:2.4.20:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:http_server:2.4.19:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:apache:http_server:2.4.18:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2016-8740"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header length, which allows remote attackers to cause a denial of service (memory consumption) via crafted CONTINUATION frames in an HTTP/2 request."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-20"
                },
                {
                  "lang": "en",
                  "value": "CWE-399"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/apache/httpd/commit/29c63b786ae028d82405421585e91283c8fa0da3",
              "refsource": "CONFIRM",
              "tags": [
                "Issue Tracking",
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/apache/httpd/commit/29c63b786ae028d82405421585e91283c8fa0da3"
            },
            {
              "name": "94650",
              "refsource": "BID",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://www.securityfocus.com/bid/94650"
            },
            {
              "name": "40909",
              "refsource": "EXPLOIT-DB",
              "tags": [
                "Exploit",
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "https://www.exploit-db.com/exploits/40909/"
            },
            {
              "name": "1037388",
              "refsource": "SECTRACK",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://www.securitytracker.com/id/1037388"
            },
            {
              "name": "http://packetstormsecurity.com/files/140023/Apache-HTTPD-Web-Server-2.4.23-Memory-Exhaustion.html",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://packetstormsecurity.com/files/140023/Apache-HTTPD-Web-Server-2.4.23-Memory-Exhaustion.html"
            },
            {
              "name": "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbux03725en_us",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbux03725en_us"
            },
            {
              "name": "GLSA-201701-36",
              "refsource": "GENTOO",
              "tags": [],
              "url": "https://security.gentoo.org/glsa/201701-36"
            },
            {
              "name": "https://www.tenable.com/security/tns-2017-04",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "https://www.tenable.com/security/tns-2017-04"
            },
            {
              "name": "https://support.apple.com/HT208221",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "https://support.apple.com/HT208221"
            },
            {
              "name": "RHSA-2017:1414",
              "refsource": "REDHAT",
              "tags": [],
              "url": "https://access.redhat.com/errata/RHSA-2017:1414"
            },
            {
              "name": "RHSA-2017:1413",
              "refsource": "REDHAT",
              "tags": [],
              "url": "https://access.redhat.com/errata/RHSA-2017:1413"
            },
            {
              "name": "RHSA-2017:1161",
              "refsource": "REDHAT",
              "tags": [],
              "url": "https://access.redhat.com/errata/RHSA-2017:1161"
            },
            {
              "name": "RHSA-2017:1415",
              "refsource": "REDHAT",
              "tags": [],
              "url": "http://rhn.redhat.com/errata/RHSA-2017-1415.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20180423-0001/",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "https://security.netapp.com/advisory/ntap-20180423-0001/"
            },
            {
              "name": "[httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E"
            },
            {
              "name": "[httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830@%3Ccvs.httpd.apache.org%3E"
            },
            {
              "name": "[httpd-cvs] 20200401 svn commit: r1058586 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f@%3Ccvs.httpd.apache.org%3E"
            },
            {
              "name": "[httpd-cvs] 20200401 svn commit: r1058587 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234@%3Ccvs.httpd.apache.org%3E"
            },
            {
              "name": "[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E"
            },
            {
              "name": "[httpd-cvs] 20210330 svn commit: r1073140 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E"
            },
            {
              "name": "[httpd-cvs] 20210330 svn commit: r1073149 [10/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b@%3Ccvs.httpd.apache.org%3E"
            },
            {
              "name": "[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E"
            },
            {
              "name": "[httpd-cvs] 20210330 svn commit: r1073139 [10/13] - in /websites/staging/httpd/trunk/content: ./ security/json/",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f@%3Ccvs.httpd.apache.org%3E"
            },
            {
              "name": "[httpd-cvs] 20210330 svn commit: r1888194 [10/13] - /httpd/site/trunk/content/security/json/",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467@%3Ccvs.httpd.apache.org%3E"
            },
            {
              "name": "[httpd-cvs] 20210330 svn commit: r1073146 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e@%3Ccvs.httpd.apache.org%3E"
            },
            {
              "name": "[httpd-cvs] 20210603 svn commit: r1075360 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9@%3Ccvs.httpd.apache.org%3E"
            },
            {
              "name": "[httpd-cvs] 20210606 svn commit: r1075467 [2/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a@%3Ccvs.httpd.apache.org%3E"
            },
            {
              "name": "[httpd-cvs] 20210606 svn commit: r1075470 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
              "refsource": "MLIST",
              "tags": [],
              "url": "https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2021-06-06T11:15Z",
      "publishedDate": "2016-12-05T19:59Z"
    }
  }
}