Vulnerabilities with Apache 2.4.54 and older on SiteMinder Access Gateway 12.8.x

Products

• CA Single Sign On Secure Proxy Server (SiteMinder)

Issue/Introduction

Siteminder Access Gateway ships bundled with an instance of Apache HTTP Server.  The following is a list of Apache HTTP Server by Siteminder Access Gateway verion:

Access Gateway r12.8.4:  Apache HTTP Server 2.4.43
Access Gateway r12.8.5:  Apache HTTP Server 2.4.46
Access Gateway r12.8.6:  Apache HTTP Server 2.4.48
Access Gateway r12.8.6a:  Apache HTTP Server 2.4.52
Access Gateway r12.8.7:  Apache HTTP Server 2.4.54

KB 262099 delivers Apache HTTP Server 2.4.56 for Access Gateway Server.

KB 262099: Apache HTTP Server 2.4.56 for Access Gateway Server.

 

Vulnerabilities with Apache 2.4.54 and older on Siteminder Access Gateway 12.8.x

The following vulnerabilities and remediation's were published by apache.org.

Fixed in Apache HTTP Server 2.4.55 and higher

CVE-2006-20001
SEVERITY: High
AFFECTS: <=2.4.54
REMEDIATION: 2.4.55

CVE-2022-36760
SEVERITY: High
AFFECTS: <=2.4.54
REMEDIATION: 2.4.55

CVE-2022-37436
SEVERITY: Moderate
AFFECTS: <=2.4.54
REMEDIATION: 2.4.55

Environment

Release : 12.8.x

Component : Siteminder Access Gateway Server

Operating System: Linux / Windows

Resolution

This KB is superseded by KB 262099 which delivers Apache HTTP Server 2.4.56 for Access Gateway Server.

KB 262099: Apache HTTP Server 2.4.56 for Access Gateway Server.