In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured ciphers with possibly either CBC or ECB modes of operation (AES256-CBC by default), hence no selectable or builtin authenticated encryption. This made it vulnerable to padding oracle attacks, particularly with CBC.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Http_server | Apache | 2.4.0 (including) | 2.4.0 (including) |
| Http_server | Apache | 2.4.1 (including) | 2.4.1 (including) |
| Http_server | Apache | 2.4.2 (including) | 2.4.2 (including) |
| Http_server | Apache | 2.4.3 (including) | 2.4.3 (including) |
| Http_server | Apache | 2.4.6 (including) | 2.4.6 (including) |
| Http_server | Apache | 2.4.7 (including) | 2.4.7 (including) |
| Http_server | Apache | 2.4.8 (including) | 2.4.8 (including) |
| Http_server | Apache | 2.4.9 (including) | 2.4.9 (including) |
| Http_server | Apache | 2.4.10 (including) | 2.4.10 (including) |
| Http_server | Apache | 2.4.12 (including) | 2.4.12 (including) |
| Http_server | Apache | 2.4.14 (including) | 2.4.14 (including) |
| Http_server | Apache | 2.4.16 (including) | 2.4.16 (including) |
| Http_server | Apache | 2.4.19 (including) | 2.4.19 (including) |
| Http_server | Apache | 2.4.20 (including) | 2.4.20 (including) |
| Http_server | Apache | 2.4.21 (including) | 2.4.21 (including) |
| Http_server | Apache | 2.4.22 (including) | 2.4.22 (including) |
| Http_server | Apache | 2.4.23 (including) | 2.4.23 (including) |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el6 | * |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el6 | * |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-httpd-0:2.4.23-120.jbcs.el7 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-mod_security-0:2.9.1-19.GA.jbcs.el7 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7 | * |
| Red Hat Enterprise Linux 7 | RedHat | httpd-0:2.4.6-45.el7_3.4 | * |
| Red Hat JBoss Core Services 1 | RedHat | * | |
| Red Hat Software Collections for Red Hat Enterprise Linux 6 | RedHat | httpd24-httpd-0:2.4.25-9.el6 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS | RedHat | httpd24-httpd-0:2.4.25-9.el6 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | httpd24-httpd-0:2.4.25-9.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS | RedHat | httpd24-httpd-0:2.4.25-9.el7 | * |
| Apache2 | Ubuntu | trusty | * |
| Apache2 | Ubuntu | upstream | * |
| Apache2 | Ubuntu | xenial | * |
| Apache2 | Ubuntu | yakkety | * |