Bugzilla – Bug 917402
VUL-1: CVE-2003-1418: apache2: ETag Header Information Disclosure Weakness still present
Last modified: 2016-04-07 10:38:54 UTC
+++ This bug was initially created as a clone of Bug #907477 +++ Seems like apache is still vulnerable to CVE-2003-1418, see https://bugzilla.novell.com/show_bug.cgi?id=907477#add_comment We need to include this into the next apache update
gnah, correct link to the comment: https://bugzilla.novell.com/show_bug.cgi?id=907477#c8
old statement we had: https://bugzilla.suse.com/show_bug.cgi?id=713970
bugbot adjusting priority
Created attachment 625920 [details] proposed patch I'm attaching a patch for this bug. According to upstream it was fixed in 2.4.1: (https://bz.apache.org/bugzilla/show_bug.cgi?id=49623#c6) The following table expresses which products are affected according to their versions: | Product | Version | Affected | request | |---------------|---------|----------|----------------| | SLE 11 | 2.2.10 | yes | wait for swamp | | SLE 11 SP1 | 2.2.12 | yes | wait for swamp | | SLE 11 SP4 | 2.2.12 | yes | wait for swamp | | SLE 12 | 2.4.10 | no | - | | openSUSE 13.1 | 2.4.6 | no | - | | openSUSE 13.2 | 2.4.10 | no | - | | Factory | 2.4.12 | no | - |
The patch is good as upstream does the same thing. I am putting this fix on the planned update list for the next apache2 update. REPRODUCER for QA put a favicon.ico or other file on the server curl -v testhost/favicon.ico 2>&1|grep -i etag < ETag: "5f40a9-57e-50a5c3c3616c0" inode in hex - filesize in hex - mtime in hex * 10000000 The inode part should go away after the update.
Thank you, I'm closing this bug until the submission is needed.
Rather than closing please just assign the bug to us, we take it from there
Submitted to: - SLE10SP3: https://build.suse.de/request/show/54652 - SLE11SP1: https://build.suse.de/request/show/53778 SLE12 and openSUSE/Factory are not affected.
was released or is in queue I think. (tracked under bug 907477)
(In reply to Marcus Meissner from comment #11) > was released or is in queue I think. (tracked under bug 907477) In this case it can be closed, I guess.
An update workflow for this issue was started. This issue was rated as moderate. Please submit fixed packages until 2015-08-07. When done, reassign the bug to security-team@suse.de. https://swamp.suse.de/webswamp/wf/62232