Skip to content
OpenAdvisories
Low ALAS2-2020-1427 2 CVEs

Low: httpd security update (Amazon Linux 2)

Published May 19, 2020 · Updated May 20, 2020

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-1934: In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server. 1820772: CVE-2020-1934 httpd: mod_proxy_ftp use of uninitialized value CVE-2020-1927: In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL. 1820761: CVE-2020-1927 httpd: mod_rewrite configurations vulnerable to open redirect

Fixed packages 11

ReleasePackageFixed in
Amazon Linux · 2 httpd 0:2.4.43-1.amzn2
Amazon Linux · 2 httpd-debuginfo 0:2.4.43-1.amzn2
Amazon Linux · 2 httpd-devel 0:2.4.43-1.amzn2
Amazon Linux · 2 httpd-filesystem 0:2.4.43-1.amzn2
Amazon Linux · 2 httpd-manual 0:2.4.43-1.amzn2
Amazon Linux · 2 httpd-tools 0:2.4.43-1.amzn2
Amazon Linux · 2 mod_ldap 0:2.4.43-1.amzn2
Amazon Linux · 2 mod_md 0:2.4.43-1.amzn2
Amazon Linux · 2 mod_proxy_html 1:2.4.43-1.amzn2
Amazon Linux · 2 mod_session 0:2.4.43-1.amzn2
Amazon Linux · 2 mod_ssl 1:2.4.43-1.amzn2

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-1927.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-1934.html