'In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key with no '=' assignment could reflect the stale value of uninitialized pool memory used by the prior request, leading to leakage of potentially confidential information, and a segfault in other cases resulting in denial of service.'
This issue affects ClearOS 7 and ClearOS 6.
This issue was fixed in the backported fixes of versions of:
httpd version 2.4.6-67 and later in ClearOS 7
webconfig-httpd version 2.4.6-67 and later in ClearOS 7
httpd version 2.2.15-60 or later in ClearOS 6
webconfig-httpd version 2.2.15-60 or later in ClearOS 6
This issue was fixed during the maintenance cycle of ClearOS 7 and 6. ClearOS systems that are up to date do not suffer from this vulnerability. Some vulnerability scanning software may report this bug because their only method for determining the issue is to check the http version number since the exploit requires specific web configurations and has not other means for testing vulnerability. In ClearOS, version numbers stay consistent through the product's life-cycle and will produce a false positive on this issue if the testing software considers only the http version and not the ClearOS patch level.
If you are running ClearOS 6 or 7, please ensure that you are running the latest updates:
You may also validate your version by running:
rpm -qi httpd
You should validate that you are running: