httpd-2.4.6-99.1.0.9.el7.AXS7

The Apache HTTP Server is a powerful, efficient, and extensible
web server.

Security Fix(es):

* CVE-2014-8109: mod_lua: fix LuaAuthzProvider argument handling issue
* CVE-2019-10092: mod_proxy: fix limited cross-site scripting in mod_proxy error
page

CVE(s):
CVE-2019-10092
In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed.
CVE-2014-8109
mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory.