CVE-2016-0736
Fixed in a distro release EPSS 49%
In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured ciphers with possibly either CBC or ECB modes of operation (AES256-CBC by default), hence no selectable or builtin authenticated encryption. This made it vulnerable to padding oracle attacks, particularly with CBC.
Products: Apache Software Foundation Apache HTTP Server
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | apache2 | 2.4.25-1 |
| Debian 13 | apache2 | 2.4.25-1 |
| Debian 14 | apache2 | 2.4.25-1 |
| Debian 8 | apache2 | 2.4.10-10+deb8u8 |
| Red Hat Enterprise Linux 7 | httpd | 0:2.4.6-45.el7_3.4 |
| Red Hat Enterprise Linux 7 | httpd-debuginfo | 0:2.4.6-45.el7_3.4 |
| Red Hat Enterprise Linux 7 | httpd-devel | 0:2.4.6-45.el7_3.4 |
| Red Hat Enterprise Linux 7 | httpd-manual | 0:2.4.6-45.el7_3.4 |
| Red Hat Enterprise Linux 7 | httpd-tools | 0:2.4.6-45.el7_3.4 |
| Red Hat Enterprise Linux 7 | mod_ldap | 0:2.4.6-45.el7_3.4 |
| Red Hat Enterprise Linux 7 | mod_proxy_html | 1:2.4.6-45.el7_3.4 |
| Red Hat Enterprise Linux 7 | mod_session | 0:2.4.6-45.el7_3.4 |
| Red Hat Enterprise Linux 7 | mod_ssl | 1:2.4.6-45.el7_3.4 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd | 0:2.4.23-120.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd | 0:2.4.23-120.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-debuginfo | 0:2.4.23-120.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-debuginfo | 0:2.4.23-120.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-devel | 0:2.4.23-120.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-devel | 0:2.4.23-120.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-libs | 0:2.4.23-120.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-libs | 0:2.4.23-120.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-manual | 0:2.4.23-120.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-manual | 0:2.4.23-120.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-selinux | 0:2.4.23-120.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-selinux | 0:2.4.23-120.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-tools | 0:2.4.23-120.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-tools | 0:2.4.23-120.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ldap | 0:2.4.23-120.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ldap | 0:2.4.23-120.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_html | 1:2.4.23-120.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_html | 1:2.4.23-120.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_security | 0:2.9.1-19.GA.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_security | 0:2.9.1-19.GA.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_security-debuginfo | 0:2.9.1-19.GA.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_security-debuginfo | 0:2.9.1-19.GA.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_session | 0:2.4.23-120.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_session | 0:2.4.23-120.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ssl | 1:2.4.23-120.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ssl | 1:2.4.23-120.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl | 1:1.0.2h-13.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl | 1:1.0.2h-13.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-debuginfo | 1:1.0.2h-13.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-debuginfo | 1:1.0.2h-13.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-devel | 1:1.0.2h-13.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-devel | 1:1.0.2h-13.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-libs | 1:1.0.2h-13.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-libs | 1:1.0.2h-13.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-perl | 1:1.0.2h-13.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-perl | 1:1.0.2h-13.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-static | 1:1.0.2h-13.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-static | 1:1.0.2h-13.jbcs.el6 |
| Red Hat rhel software collections 2 | httpd24-httpd | 0:2.4.25-9.el6 |
| Red Hat rhel software collections 2 | httpd24-httpd | 0:2.4.25-9.el7 |
| Red Hat rhel software collections 2 | httpd24-httpd-debuginfo | 0:2.4.25-9.el6 |
| Red Hat rhel software collections 2 | httpd24-httpd-debuginfo | 0:2.4.25-9.el7 |
| Red Hat rhel software collections 2 | httpd24-httpd-devel | 0:2.4.25-9.el6 |
| Red Hat rhel software collections 2 | httpd24-httpd-devel | 0:2.4.25-9.el7 |
| Red Hat rhel software collections 2 | httpd24-httpd-manual | 0:2.4.25-9.el6 |
| Red Hat rhel software collections 2 | httpd24-httpd-manual | 0:2.4.25-9.el7 |
| Red Hat rhel software collections 2 | httpd24-httpd-tools | 0:2.4.25-9.el6 |
| Red Hat rhel software collections 2 | httpd24-httpd-tools | 0:2.4.25-9.el7 |
| Red Hat rhel software collections 2 | httpd24-mod_ldap | 0:2.4.25-9.el6 |
| Red Hat rhel software collections 2 | httpd24-mod_ldap | 0:2.4.25-9.el7 |
| Red Hat rhel software collections 2 | httpd24-mod_proxy_html | 1:2.4.25-9.el6 |
| Red Hat rhel software collections 2 | httpd24-mod_proxy_html | 1:2.4.25-9.el7 |
| Red Hat rhel software collections 2 | httpd24-mod_session | 0:2.4.25-9.el7 |
| Red Hat rhel software collections 2 | httpd24-mod_session | 0:2.4.25-9.el6 |
| Red Hat rhel software collections 2 | httpd24-mod_ssl | 1:2.4.25-9.el7 |
| Red Hat rhel software collections 2 | httpd24-mod_ssl | 1:2.4.25-9.el6 |
| SUSE Linux Enterprise Server 12 SP1 | apache2 | 2.4.16-19.1 |
| SUSE Linux Enterprise Server 12 SP2 | apache2 | 2.4.23-21.1 |
| SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 | apache2 | 2.4.23-21.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | apache2 | 2.4.16-19.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | apache2 | 2.4.23-21.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP1 | apache2 | 2.4.16-19.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP2 | apache2 | 2.4.23-21.1 |
| Ubuntu 14.04 LTS | apache2 | 2.4.7-1ubuntu4.15 |
| Ubuntu 16.04 LTS | apache2 | 2.4.18-2ubuntu3.2 |