<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="3">
<package pkgid="e34a4526475f7bb082c66185c8ed3df8eb5e1b7b59c0946976b6c478fa1e636b" name="httpd" arch="src">
  <version epoch="0" ver="2.4.37" rel="56.module+el8.8.0+18758+b3a9c8da.6"/>
  <changelog author="Lubo&#x161; Uhliarik &lt;luhliari@redhat.com&gt; - 2.4.37-49" date="1654862400">- Resolves: #2090848 - CVE-2020-13950 httpd:2.4/httpd: mod_proxy NULL pointer
  dereference</changelog>
  <changelog author="Lubo&#x161; Uhliarik &lt;luhliari@redhat.com&gt; - 2.4.37-50" date="1655812800">- Resolves: #2065237 - CVE-2022-22719 httpd:2.4/httpd: mod_lua: Use of
  uninitialized value of in r:parsebody
- Resolves: #2065267 - CVE-2022-22721 httpd:2.4/httpd: core: Possible buffer
  overflow with very large or unlimited LimitXMLRequestBody
- Resolves: #2065324 - CVE-2022-23943 httpd:2.4/httpd: mod_sed: Read/write
  beyond bounds</changelog>
  <changelog author="Lubo&#x161; Uhliarik &lt;luhliari@redhat.com&gt; - 2.4.37-51" date="1658750400">- Resolves: #2097015 - CVE-2022-28614 httpd:2.4/httpd: out-of-bounds read via
  ap_rwrite()
- Resolves: #2097031 - CVE-2022-28615 httpd:2.4/httpd: out-of-bounds read in
  ap_strcmp_match()
- Resolves: #2097458 - CVE-2022-30522 httpd:2.4/httpd: mod_sed: DoS
  vulnerability
- Resolves: #2097480 - CVE-2022-30556 httpd:2.4/httpd: mod_lua: Information
  disclosure with websockets
- Resolves: #2098247 - CVE-2022-31813 httpd:2.4/httpd: mod_proxy:
  X-Forwarded-For dropped by hop-by-hop mechanism
- Resolves: #2097451 - CVE-2022-29404 httpd:2.4/httpd: mod_lua: DoS in
  r:parsebody
- Resolves: #2096997 - CVE-2022-26377 httpd:2.4/httpd: mod_proxy_ajp: Possible
  request smuggling</changelog>
  <changelog author="Tomas Korbar &lt;tkorbar@redhat.com&gt; - 2.4.37-52" date="1663588800">- Add the SNI support in mod_proxy_wstunnel module for Apache httpd
- Resolves: rhbz#2017543</changelog>
  <changelog author="Lubo&#x161; Uhliarik &lt;luhliari@redhat.com&gt; - 2.4.37-53" date="1667995200">- Resolves: #2050888 - httpd with SSL fails to start unless hostname command
  was installed</changelog>
  <changelog author="Lubo&#x161; Uhliarik &lt;luhliari@redhat.com&gt; - 2.4.37-54" date="1670500800">- Resolves: #2095650 - Dependency from mod_http2 on httpd broken</changelog>
  <changelog author="Lubo&#x161; Uhliarik &lt;luhliari@redhat.com&gt; - 2.4.37-55" date="1674734400">- Resolves: #2155961 - prevent sscg creating /dhparams.pem</changelog>
  <changelog author="Lubo&#x161; Uhliarik &lt;luhliari@redhat.com&gt; - 2.4.37-56" date="1675166400">- Resolves: #2162499 - CVE-2006-20001 httpd: mod_dav: out-of-bounds read/write
  of zero byte
- Resolves: #2162485 - CVE-2022-37436 httpd: mod_proxy: HTTP response splitting
- Resolves: #2162509 - CVE-2022-36760 httpd: mod_proxy_ajp: Possible request
  smuggling</changelog>
  <changelog author="Lubo&#x161; Uhliarik &lt;luhliari@redhat.com&gt; - 2.4.37-56.4" date="1679140800">- Resolves: #2177748 - CVE-2023-25690 httpd:2.4/httpd: HTTP request splitting
  with mod_rewrite and mod_proxy</changelog>
  <changelog author="Lubo&#x161; Uhliarik &lt;luhliari@redhat.com&gt; - 2.4.37-56.6" date="1682596800">- Resolves: #2190133 - mod_rewrite regression with CVE-2023-25690</changelog>
</package>
<package pkgid="e933c6170c8ea2c3453d840652c753213f1c174eeb808feebd942c23e0b59173" name="httpd" arch="src">
  <version epoch="0" ver="2.4.37" rel="56.module+el8.8.0+19808+379766d6.7"/>
  <changelog author="Lubo&#x161; Uhliarik &lt;luhliari@redhat.com&gt; - 2.4.37-50" date="1655812800">- Resolves: #2065237 - CVE-2022-22719 httpd:2.4/httpd: mod_lua: Use of
  uninitialized value of in r:parsebody
- Resolves: #2065267 - CVE-2022-22721 httpd:2.4/httpd: core: Possible buffer
  overflow with very large or unlimited LimitXMLRequestBody
- Resolves: #2065324 - CVE-2022-23943 httpd:2.4/httpd: mod_sed: Read/write
  beyond bounds</changelog>
  <changelog author="Lubo&#x161; Uhliarik &lt;luhliari@redhat.com&gt; - 2.4.37-51" date="1658750400">- Resolves: #2097015 - CVE-2022-28614 httpd:2.4/httpd: out-of-bounds read via
  ap_rwrite()
- Resolves: #2097031 - CVE-2022-28615 httpd:2.4/httpd: out-of-bounds read in
  ap_strcmp_match()
- Resolves: #2097458 - CVE-2022-30522 httpd:2.4/httpd: mod_sed: DoS
  vulnerability
- Resolves: #2097480 - CVE-2022-30556 httpd:2.4/httpd: mod_lua: Information
  disclosure with websockets
- Resolves: #2098247 - CVE-2022-31813 httpd:2.4/httpd: mod_proxy:
  X-Forwarded-For dropped by hop-by-hop mechanism
- Resolves: #2097451 - CVE-2022-29404 httpd:2.4/httpd: mod_lua: DoS in
  r:parsebody
- Resolves: #2096997 - CVE-2022-26377 httpd:2.4/httpd: mod_proxy_ajp: Possible
  request smuggling</changelog>
  <changelog author="Tomas Korbar &lt;tkorbar@redhat.com&gt; - 2.4.37-52" date="1663588800">- Add the SNI support in mod_proxy_wstunnel module for Apache httpd
- Resolves: rhbz#2017543</changelog>
  <changelog author="Lubo&#x161; Uhliarik &lt;luhliari@redhat.com&gt; - 2.4.37-53" date="1667995200">- Resolves: #2050888 - httpd with SSL fails to start unless hostname command
  was installed</changelog>
  <changelog author="Lubo&#x161; Uhliarik &lt;luhliari@redhat.com&gt; - 2.4.37-54" date="1670500800">- Resolves: #2095650 - Dependency from mod_http2 on httpd broken</changelog>
  <changelog author="Lubo&#x161; Uhliarik &lt;luhliari@redhat.com&gt; - 2.4.37-55" date="1674734400">- Resolves: #2155961 - prevent sscg creating /dhparams.pem</changelog>
  <changelog author="Lubo&#x161; Uhliarik &lt;luhliari@redhat.com&gt; - 2.4.37-56" date="1675166400">- Resolves: #2162499 - CVE-2006-20001 httpd: mod_dav: out-of-bounds read/write
  of zero byte
- Resolves: #2162485 - CVE-2022-37436 httpd: mod_proxy: HTTP response splitting
- Resolves: #2162509 - CVE-2022-36760 httpd: mod_proxy_ajp: Possible request
  smuggling</changelog>
  <changelog author="Lubo&#x161; Uhliarik &lt;luhliari@redhat.com&gt; - 2.4.37-56.4" date="1679140800">- Resolves: #2177748 - CVE-2023-25690 httpd:2.4/httpd: HTTP request splitting
  with mod_rewrite and mod_proxy</changelog>
  <changelog author="Lubo&#x161; Uhliarik &lt;luhliari@redhat.com&gt; - 2.4.37-56.6" date="1682596800">- Resolves: #2190133 - mod_rewrite regression with CVE-2023-25690</changelog>
  <changelog author="Lubo&#x161; Uhliarik &lt;luhliari@redhat.com&gt; - 2.4.37-56.7" date="1693396800">- Resolves: #2236177 - CVE-2023-27522 httpd:2.4/httpd: mod_proxy_uwsgi HTTP
  response splitting</changelog>
</package>
<package pkgid="ebfe208b14d4f1ba902df301d7411182b9213ed9a7811c8a0cf8f7ad54b94f6e" name="mod_http2" arch="src">
  <version epoch="0" ver="1.15.7" rel="8.module+el8.8.0+18751+b4557bca.3"/>
  <changelog author="Joe Orton &lt;jorton@redhat.com&gt; - 1.11.3-2" date="1554379200">- update release (#1695587)</changelog>
  <changelog author="Lubos Uhliarik &lt;luhliari@redhat.com&gt; - 1.11.3-3" date="1567080000">- Resolves: #1744999 - CVE-2019-9511 httpd:2.4/mod_http2: HTTP/2: large amount
  of data request leads to denial of service
- Resolves: #1745086 - CVE-2019-9516 httpd:2.4/mod_http2: HTTP/2: 0-length
  headers leads to denial of service
- Resolves: #1745154 - CVE-2019-9517 httpd:2.4/mod_http2: HTTP/2: request for
  large response leads to denial of service</changelog>
  <changelog author="Lubos Uhliarik &lt;luhliari@redhat.com&gt; - 1.15.7-1" date="1586865600">- new version 1.15.7
- Resolves: #1814236 - RFE: mod_http2 rebase 
- Resolves: #1747289 - CVE-2019-10082 httpd:2.4/mod_http2: httpd: 
  read-after-free in h2 connection shutdown
- Resolves: #1696099 - CVE-2019-0197 httpd:2.4/mod_http2: httpd: 
  mod_http2: possible crash on late upgrade
- Resolves: #1696094 - CVE-2019-0196 httpd:2.4/mod_http2: httpd:
  mod_http2: read-after-free on a string compare
- Resolves: #1677591 - CVE-2018-17189 httpd:2.4/mod_http2: httpd: 
  mod_http2: DoS via slow, unneeded request bodies</changelog>
  <changelog author="Lubos Uhliarik &lt;luhliari@redhat.com&gt; - 1.15.7-2" date="1597665600">- Resolves: #1869073 - CVE-2020-9490 httpd:2.4/mod_http2: httpd: 
  Push diary crash on specifically crafted HTTP/2 header</changelog>
  <changelog author="Lubos Uhliarik &lt;luhliari@redhat.com&gt; - 1.15.7-3" date="1604059200">- Resolves: #1869077 - CVE-2020-11993 httpd:2.4/mod_http2: httpd:
  mod_http2 concurrent pool usage</changelog>
  <changelog author="Lubo&#x161; Uhliarik &lt;luhliari@redhat.com&gt; - 1.15.7-4" date="1641470400">- Resolves: #1966728 - CVE-2021-33193 httpd:2.4/mod_http2: httpd:
  Request splitting via HTTP/2 method injection and mod_proxy</changelog>
  <changelog author="Lubo&#x161; Uhliarik &lt;luhliari@redhat.com&gt; - 1.15.7-5" date="1643025600">- Resolves: #2035030 - CVE-2021-44224 httpd:2.4/httpd: possible NULL dereference
  or SSRF in forward proxy configurations</changelog>
  <changelog author="Tomas Korbar &lt;tkorbar@redhat.com&gt; - 1.15.7-6" date="1667304000">- Backport SNI feature refactor
- Resolves: rhbz#2137257</changelog>
  <changelog author="Lubo&#x161; Uhliarik &lt;luhliari@redhat.com&gt; - 1.15.7-7" date="1670500800">- Resolves: #2095650 - Dependency from mod_http2 on httpd broken</changelog>
  <changelog author="Lubo&#x161; Uhliarik &lt;luhliari@redhat.com&gt; - 1.15.7-8.3" date="1679140800">- Resolves: #2177748 - CVE-2023-25690 httpd:2.4/httpd: HTTP request splitting
  with mod_rewrite and mod_proxy</changelog>
</package>
</otherdata>