Access Restriction Bypass Affecting httpd package, versions <0:2.4.6-31.0.1.el7_1.1


Severity

Recommended
0.0
medium
0
10

Based on Oracle Linux security rating.

Threat Intelligence

EPSS
0.37% (73rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ORACLE7-HTTPD-2497510
  • published10 Apr 2022
  • disclosed20 Jul 2015

Introduced: 20 Jul 2015

CVE-2015-3185  (opens in a new tab)
CWE-264  (opens in a new tab)

How to fix?

Upgrade Oracle:7 httpd to version 0:2.4.6-31.0.1.el7_1.1 or higher.
This issue was patched in ELSA-2015-1667.

NVD Description

Note: Versions mentioned in the description apply only to the upstream httpd package and not the httpd package as distributed by Oracle. See How to fix? for Oracle:7 relevant fixed versions and status.

The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an authorization setting rather than an authentication setting, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging the presence of a module that relies on the 2.2 API behavior.

References

CVSS Scores

version 3.1