CVE-2012-4557 — httpd: mod_proxy_ajp worker moved to error state when timeout exceeded

Back Back to CVE browser

MEDIUM

httpd: mod_proxy_ajp worker moved to error state when timeout exceeded

Published Nov 30, 2012

5.0

MEDIUM

CVSS 2.0

EPSS 17.47%

Description

The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long request-processing time, which allows remote attackers to cause a denial of service (worker consumption) via an expensive request.

Affected products

Red Hat Enterprise Linux 6

httpd-0:2.2.15-26.el6

Fixed · RHSA-2013:0512
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

ant-0:1.7.1-13.jdk6.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

antlr-0:2.7.7-7.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

cglib-0:2.2-5.1.1.1.jdk6.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

dom4j-0:1.6.1-11.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

ecj3-1:3.3.1.1-3.1.1.1.jdk6.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

glassfish-jsf-0:1.2_13-3.1.1.jdk6.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

hibernate3-1:3.3.2-1.4.GA_CP04.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

hibernate3-annotations-0:3.4.0-3.2.GA_CP04.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

hibernate3-commons-annotations-0:3.1.0-1.8.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

hibernate3-ejb-persistence-3.0-api-1:1.0.2-3.1.jdk6.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

hibernate3-entitymanager-0:3.4.0-4.3.GA_CP04.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

httpd-0:2.2.17-11.1.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

jakarta-commons-beanutils-0:1.8.0-4.1.2.1.jdk6.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

jakarta-commons-chain-0:1.2-2.2.1.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

jakarta-commons-codec-0:1.3-9.2.1.1.jdk6.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

jakarta-commons-collections-0:3.2.1-4.1.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

jakarta-commons-daemon-1:1.0.5-1.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

jakarta-commons-daemon-jsvc-1:1.0.5-1.4.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

jakarta-commons-dbcp-0:1.2.1-16.4.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

jakarta-commons-digester-0:1.8.1-8.1.jdk6.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

jakarta-commons-fileupload-1:1.1.1-7.4.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

jakarta-commons-httpclient-1:3.1-1.2.1.jdk6.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

jakarta-commons-io-0:1.4-1.3.1.jdk6.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

jakarta-commons-logging-0:1.1.1-0.4.1.jdk6.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

jakarta-commons-logging-jboss-0:1.1-10.2.1.jdk6.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

jakarta-commons-pool-0:1.3-11.2.1.jdk6.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

jakarta-commons-validator-0:1.3.1-7.5.2.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

jakarta-oro-0:2.0.8-3.3.2.1.1.1.jdk6.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

jakarta-taglibs-standard-0:1.1.1-9.1.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

javassist-0:3.12.0-1.jdk6.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

jboss-common-core-0:2.2.17-1.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

jboss-common-logging-jdk-0:2.1.2-1.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

jboss-common-logging-spi-0:2.1.2-1.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

jboss-javaee-0:5.0.1-2.9.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

jcommon-0:1.0.16-1.2.1.jdk6.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

jfreechart-0:1.0.13-2.3.2.1.jdk6.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

mod_cluster-0:1.0.10-2.1.GA_CP01.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

mod_cluster-native-0:1.0.10-2.1.GA_CP01.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

mod_jk-0:1.2.31-1.1.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

objectweb-asm-0:3.1-5.3.1.jdk6.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

struts12-0:1.2.9-3.1.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

tomcat-jkstatus-ant-0:1.2.31-2.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

tomcat-native-0:1.1.20-2.1.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

tomcat5-0:5.5.33-16_patch_04.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

tomcat6-0:6.0.32-15.1_patch_03.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

xalan-j2-0:2.7.1-5.3_patch_04.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

xerces-j2-0:2.9.1-3.patch01.1.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5

xml-commons-0:1.3.04-7.10.jdk6.ep5.el5

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

ant-0:1.7.1-14.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

antlr-0:2.7.7-7.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

cglib-0:2.2-5.4.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

dom4j-0:1.6.1-11.1.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

ecj3-1:3.3.1.1-4.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

glassfish-jsf-0:1.2_13-3.1.4.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

hibernate3-1:3.3.2-1.8.GA_CP04.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

hibernate3-annotations-0:3.4.0-3.5.GA_CP04.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

hibernate3-commons-annotations-0:3.1.0-1.8.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

hibernate3-ejb-persistence-3.0-api-1:1.0.2-3.3.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

hibernate3-entitymanager-0:3.4.0-4.4.GA_CP04.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

httpd-0:2.2.17-11.2.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

jakarta-commons-beanutils-0:1.8.0-9.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

jakarta-commons-chain-0:1.2-2.2.2.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

jakarta-commons-codec-0:1.3-12.1.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

jakarta-commons-collections-0:3.2.1-4.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

jakarta-commons-daemon-1:1.0.5-1.1.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

jakarta-commons-daemon-jsvc-1:1.0.5-1.4.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

jakarta-commons-dbcp-0:1.2.1-16.2.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

jakarta-commons-digester-0:1.8.1-8.1.1.1.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

jakarta-commons-fileupload-1:1.1.1-7.5.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

jakarta-commons-httpclient-1:3.1-1.2.2.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

jakarta-commons-io-0:1.4-4.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

jakarta-commons-logging-0:1.1.1-1.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

jakarta-commons-logging-jboss-0:1.1-10.2.2.1.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

jakarta-commons-pool-0:1.3-15.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

jakarta-commons-validator-0:1.3.1-7.5.2.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

jakarta-oro-0:2.0.8-7.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

jakarta-taglibs-standard-0:1.1.1-12.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

javassist-0:3.12.0-3.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

jboss-common-core-0:2.2.17-1.2.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

jboss-common-logging-jdk-0:2.1.2-1.2.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

jboss-common-logging-spi-0:2.1.2-1.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

jboss-javaee-0:5.0.1-2.9.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

jcommon-0:1.0.16-1.2.2.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

jfreechart-0:1.0.13-2.3.2.1.2.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

mod_cluster-0:1.0.10-2.2.GA_CP01.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

mod_cluster-native-0:1.0.10-2.1.1.GA_CP01.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

mod_jk-0:1.2.31-1.1.2.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

objectweb-asm31-0:3.1-12.1.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

struts12-0:1.2.9-3.1.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

tomcat-jkstatus-ant-0:1.2.31-2.1.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

tomcat-native-0:1.1.20-2.1.2.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

tomcat5-0:5.5.33-15_patch_04.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

tomcat6-0:6.0.32-14_patch_03.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

xalan-j2-0:2.7.1-5.3_patch_04.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

xerces-j2-0:2.9.1-8.patch01.1.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6

xml-commons-0:1.3.04-7.14.ep5.el6

Fixed · RHSA-2011:0897
Red Hat JBoss Web Server 1.0

n/a

Fixed · RHSA-2011:0896
Red Hat Enterprise Linux 4

httpd

Not affected
Red Hat Enterprise Linux 5

httpd

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 6	httpd-0:2.2.15-26.el6	Fixed	RHSA-2013:0512
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	ant-0:1.7.1-13.jdk6.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	antlr-0:2.7.7-7.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	cglib-0:2.2-5.1.1.1.jdk6.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	dom4j-0:1.6.1-11.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	ecj3-1:3.3.1.1-3.1.1.1.jdk6.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	glassfish-jsf-0:1.2_13-3.1.1.jdk6.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	hibernate3-1:3.3.2-1.4.GA_CP04.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	hibernate3-annotations-0:3.4.0-3.2.GA_CP04.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	hibernate3-commons-annotations-0:3.1.0-1.8.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	hibernate3-ejb-persistence-3.0-api-1:1.0.2-3.1.jdk6.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	hibernate3-entitymanager-0:3.4.0-4.3.GA_CP04.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	httpd-0:2.2.17-11.1.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	jakarta-commons-beanutils-0:1.8.0-4.1.2.1.jdk6.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	jakarta-commons-chain-0:1.2-2.2.1.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	jakarta-commons-codec-0:1.3-9.2.1.1.jdk6.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	jakarta-commons-collections-0:3.2.1-4.1.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	jakarta-commons-daemon-1:1.0.5-1.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	jakarta-commons-daemon-jsvc-1:1.0.5-1.4.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	jakarta-commons-dbcp-0:1.2.1-16.4.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	jakarta-commons-digester-0:1.8.1-8.1.jdk6.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	jakarta-commons-fileupload-1:1.1.1-7.4.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	jakarta-commons-httpclient-1:3.1-1.2.1.jdk6.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	jakarta-commons-io-0:1.4-1.3.1.jdk6.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	jakarta-commons-logging-0:1.1.1-0.4.1.jdk6.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	jakarta-commons-logging-jboss-0:1.1-10.2.1.jdk6.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	jakarta-commons-pool-0:1.3-11.2.1.jdk6.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	jakarta-commons-validator-0:1.3.1-7.5.2.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	jakarta-oro-0:2.0.8-3.3.2.1.1.1.jdk6.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	jakarta-taglibs-standard-0:1.1.1-9.1.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	javassist-0:3.12.0-1.jdk6.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	jboss-common-core-0:2.2.17-1.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	jboss-common-logging-jdk-0:2.1.2-1.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	jboss-common-logging-spi-0:2.1.2-1.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	jboss-javaee-0:5.0.1-2.9.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	jcommon-0:1.0.16-1.2.1.jdk6.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	jfreechart-0:1.0.13-2.3.2.1.jdk6.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	mod_cluster-0:1.0.10-2.1.GA_CP01.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	mod_cluster-native-0:1.0.10-2.1.GA_CP01.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	mod_jk-0:1.2.31-1.1.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	objectweb-asm-0:3.1-5.3.1.jdk6.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	struts12-0:1.2.9-3.1.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	tomcat-jkstatus-ant-0:1.2.31-2.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	tomcat-native-0:1.1.20-2.1.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	tomcat5-0:5.5.33-16_patch_04.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	tomcat6-0:6.0.32-15.1_patch_03.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	xalan-j2-0:2.7.1-5.3_patch_04.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	xerces-j2-0:2.9.1-3.patch01.1.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 5	xml-commons-0:1.3.04-7.10.jdk6.ep5.el5	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	ant-0:1.7.1-14.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	antlr-0:2.7.7-7.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	cglib-0:2.2-5.4.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	dom4j-0:1.6.1-11.1.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	ecj3-1:3.3.1.1-4.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	glassfish-jsf-0:1.2_13-3.1.4.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	hibernate3-1:3.3.2-1.8.GA_CP04.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	hibernate3-annotations-0:3.4.0-3.5.GA_CP04.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	hibernate3-commons-annotations-0:3.1.0-1.8.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	hibernate3-ejb-persistence-3.0-api-1:1.0.2-3.3.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	hibernate3-entitymanager-0:3.4.0-4.4.GA_CP04.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	httpd-0:2.2.17-11.2.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	jakarta-commons-beanutils-0:1.8.0-9.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	jakarta-commons-chain-0:1.2-2.2.2.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	jakarta-commons-codec-0:1.3-12.1.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	jakarta-commons-collections-0:3.2.1-4.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	jakarta-commons-daemon-1:1.0.5-1.1.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	jakarta-commons-daemon-jsvc-1:1.0.5-1.4.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	jakarta-commons-dbcp-0:1.2.1-16.2.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	jakarta-commons-digester-0:1.8.1-8.1.1.1.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	jakarta-commons-fileupload-1:1.1.1-7.5.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	jakarta-commons-httpclient-1:3.1-1.2.2.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	jakarta-commons-io-0:1.4-4.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	jakarta-commons-logging-0:1.1.1-1.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	jakarta-commons-logging-jboss-0:1.1-10.2.2.1.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	jakarta-commons-pool-0:1.3-15.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	jakarta-commons-validator-0:1.3.1-7.5.2.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	jakarta-oro-0:2.0.8-7.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	jakarta-taglibs-standard-0:1.1.1-12.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	javassist-0:3.12.0-3.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	jboss-common-core-0:2.2.17-1.2.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	jboss-common-logging-jdk-0:2.1.2-1.2.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	jboss-common-logging-spi-0:2.1.2-1.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	jboss-javaee-0:5.0.1-2.9.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	jcommon-0:1.0.16-1.2.2.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	jfreechart-0:1.0.13-2.3.2.1.2.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	mod_cluster-0:1.0.10-2.2.GA_CP01.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	mod_cluster-native-0:1.0.10-2.1.1.GA_CP01.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	mod_jk-0:1.2.31-1.1.2.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	objectweb-asm31-0:3.1-12.1.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	struts12-0:1.2.9-3.1.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	tomcat-jkstatus-ant-0:1.2.31-2.1.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	tomcat-native-0:1.1.20-2.1.2.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	tomcat5-0:5.5.33-15_patch_04.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	tomcat6-0:6.0.32-14_patch_03.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	xalan-j2-0:2.7.1-5.3_patch_04.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	xerces-j2-0:2.9.1-8.patch01.1.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Enterprise Web Server 1 for RHEL 6	xml-commons-0:1.3.04-7.14.ep5.el6	Fixed	RHSA-2011:0897
Red Hat JBoss Web Server 1.0	n/a	Fixed	RHSA-2011:0896
Red Hat Enterprise Linux 4	httpd	Not affected	n/a
Red Hat Enterprise Linux 5	httpd	Not affected	n/a

Remediation

Red Hat statement

This issue did not affect the version of httpd as shipped with Red Hat Enterprise Linux 5.

Metrics

17.47% 0.17470

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.

EPSS probability 0.17470

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (29 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 2, 2026	17.47% (0.17470)	97.05th	v5 (v2026.06.15)
Jun 15, 2026	17.47% (0.17470)	96.74th	v5 (v2026.06.15)
Feb 12, 2026	25.97% (0.25967)	96.14th	v4 (v2025.03.14)
Dec 28, 2025	29.07% (0.29065)	96.41th	v4 (v2025.03.14)
Dec 27, 2025	37.81% (0.37810)	97.09th	v4 (v2025.03.14)
Oct 28, 2025	29.07% (0.29065)	96.34th	v4 (v2025.03.14)
Oct 27, 2025	37.81% (0.37810)	97.04th	v4 (v2025.03.14)
Oct 1, 2025	29.11% (0.29108)	96.44th	v4 (v2025.03.14)
Sep 4, 2025	37.81% (0.37810)	97.11th	v4 (v2025.03.14)
Sep 1, 2025	22.54% (0.22538)	95.67th	v4 (v2025.03.14)
Aug 4, 2025	37.81% (0.37810)	97.06th	v4 (v2025.03.14)
Aug 1, 2025	22.54% (0.22538)	95.65th	v4 (v2025.03.14)
Jul 30, 2025	37.81% (0.37810)	97.06th	v4 (v2025.03.14)
Jun 5, 2025	29.07% (0.29065)	96.30th	v4 (v2025.03.14)
Jun 4, 2025	35.02% (0.35018)	96.81th	v4 (v2025.03.14)
Jun 1, 2025	29.48% (0.29480)	96.37th	v4 (v2025.03.14)
May 4, 2025	35.02% (0.35018)	96.78th	v4 (v2025.03.14)
May 1, 2025	29.48% (0.29480)	96.33th	v4 (v2025.03.14)
Mar 30, 2025	35.02% (0.35018)	96.69th	v4 (v2025.03.14)
Mar 29, 2025	39.57% (0.39568)	95.94th	v4 (v2025.03.14)
Mar 17, 2025	35.02% (0.35018)	96.66th	v4 (v2025.03.14)
Dec 17, 2024	28.62% (0.28616)	96.86th	v3 (v2023.03.01)
Dec 25, 2023	7.73% (0.07732)	93.53th	v3 (v2023.03.01)
Aug 18, 2023	18.79% (0.18787)	95.58th	v3 (v2023.03.01)
Jun 18, 2023	18.61% (0.18611)	95.48th	v3 (v2023.03.01)
Mar 7, 2023	24.17% (0.24170)	95.83th	v3 (v2023.03.01)
Mar 6, 2023	7.34% (0.07344)	92.59th	v2 (v2022.01.01)
Apr 1, 2022	7.34% (0.07344)	91.87th	v2 (v2022.01.01)
Feb 4, 2022	7.34% (0.07344)	80.64th	v2 (v2022.01.01)

Weaknesses (1)

CWE-399

References (26)

http://httpd.apache.org/security/vulnerabilities_22.html#2.2.22
x_refsource_CONFIRMPatchVendor Advisory
http://lists.opensuse.org/opensuse-updates/2013-02/msg00009.html
vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-updates/2013-02/msg00012.html
vendor-advisoryx_refsource_SUSE
http://marc.info/?l=bugtraq&m=136612293908376&w=2
vendor-advisoryx_refsource_HP
http://svn.apache.org/viewvc?view=revision&revision=1227298
x_refsource_CONFIRMExploit
http://www.debian.org/security/2012/dsa-2579
vendor-advisoryx_refsource_DEBIAN
https://access.redhat.com/security/cve/CVE-2012-4557
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=871685
x_refsource_CONFIRMIssue Tracking
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E
mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E
mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E
mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E
mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E
mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E
mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3Ccvs.httpd.apache.org%3E
mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3E
mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E
mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E
mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E
mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E
mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E
mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E
mailing-listx_refsource_MLIST
https://nvd.nist.gov/vuln/detail/CVE-2012-4557
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18938
vdb-entrysignaturex_refsource_OVAL
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19284
vdb-entrysignaturex_refsource_OVAL
https://www.cve.org/CVERecord?id=CVE-2012-4557

Link	Providers	Tags
http://httpd.apache.org/security/vulnerabilities_22.html#2.2.22		x_refsource_CONFIRMPatchVendor Advisory
http://lists.opensuse.org/opensuse-updates/2013-02/msg00009.html		vendor-advisoryx_refsource_SUSE
http://lists.opensuse.org/opensuse-updates/2013-02/msg00012.html		vendor-advisoryx_refsource_SUSE
http://marc.info/?l=bugtraq&m=136612293908376&w=2		vendor-advisoryx_refsource_HP
http://svn.apache.org/viewvc?view=revision&revision=1227298		x_refsource_CONFIRMExploit
http://www.debian.org/security/2012/dsa-2579		vendor-advisoryx_refsource_DEBIAN
https://access.redhat.com/security/cve/CVE-2012-4557		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=871685		x_refsource_CONFIRMIssue Tracking
https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E		mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E		mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r05b5357d1f6bd106f41541ee7d87aafe3f5ea4dc3e9bde5ce09baff8%40%3Ccvs.httpd.apache.org%3E		mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E		mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E		mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E		mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r9821b0a32a1d0a1b4947abb6f3630053fcbb2ec905d9a32c2bd4d4ee%40%3Ccvs.httpd.apache.org%3E		mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r9b4b963760a3cb5a4a70c902f325c6c0337fe51d5b8570416f8f8729%40%3Ccvs.httpd.apache.org%3E		mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E		mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E		mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E		mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E		mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E		mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E		mailing-listx_refsource_MLIST
https://nvd.nist.gov/vuln/detail/CVE-2012-4557
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18938		vdb-entrysignaturex_refsource_OVAL
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19284		vdb-entrysignaturex_refsource_OVAL
https://www.cve.org/CVERecord?id=CVE-2012-4557

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner redhat

Published Nov 30, 2012

Updated Aug 6, 2024

Reserved Aug 21, 2012

Link CVE-2012-4557

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 16, 2026

Link CVE-2012-4557

Red Hat

Severity Low

Public date Jan 4, 2012

Links CVE-2012-4557 - Bugzilla