Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-30641: A flaw was found in Apache httpd. A possible regression from an earlier security fix broke behavior of MergeSlashes. The highest threat from this vulnerability is to data integrity. 1966743: CVE-2021-30641 httpd: MergeSlashes regression CVE-2021-26691: A heap overflow flaw was found In Apache httpd mod_session. The highest threat from this vulnerability is to system availability. 1966732: CVE-2021-26691 httpd: Heap overflow in mod_session CVE-2021-26690: A NULL pointer dereference was found in Apache httpd mod_session. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. 1966729: CVE-2021-26690 httpd: mod_session NULL pointer dereference in parser CVE-2020-35452: A flaw was found in Apache httpd. The mod_auth_digest has a single zero byte stack overflow. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. 1966724: CVE-2020-35452 httpd: Single zero byte stack overflow in mod_auth_digest CVE-2020-13950: A flaw was found In Apache httpd. The mod_proxy has a NULL pointer dereference. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. 1966738: CVE-2020-13950 httpd: mod_proxy NULL pointer dereference CVE-2020-13938: A flaw was found in HTTPd. In some Apache HTTP Server versions, unprivileged local users can stop HTTPd on Windows. The highest threat from this vulnerability is to system availability. 1970006: CVE-2020-13938 httpd: Improper Handling of Insufficient Privileges CVE-2019-17567: A flaw was found in Apache httpd. The mod_proxy_wstunnel module tunnels non-upgraded connections. 1966740: CVE-2019-17567 httpd: mod_proxy_wstunnel tunneling of non Upgraded connection
Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | httpd | 0:2.4.48-2.amzn2 |
| Amazon Linux · 2 | httpd-debuginfo | 0:2.4.48-2.amzn2 |
| Amazon Linux · 2 | httpd-devel | 0:2.4.48-2.amzn2 |
| Amazon Linux · 2 | httpd-filesystem | 0:2.4.48-2.amzn2 |
| Amazon Linux · 2 | httpd-manual | 0:2.4.48-2.amzn2 |
| Amazon Linux · 2 | httpd-tools | 0:2.4.48-2.amzn2 |
| Amazon Linux · 2 | mod_ldap | 0:2.4.48-2.amzn2 |
| Amazon Linux · 2 | mod_md | 0:2.4.48-2.amzn2 |
| Amazon Linux · 2 | mod_proxy_html | 1:2.4.48-2.amzn2 |
| Amazon Linux · 2 | mod_session | 0:2.4.48-2.amzn2 |
| Amazon Linux · 2 | mod_ssl | 1:2.4.48-2.amzn2 |
Vulnerabilities 7
-
Unscored —CVE-2019-17567 EPSS 60%
mod_proxy_wstunnel tunneling of non Upgraded connections
Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the whole connection regardless, thus allowing for subsequent requests on the same connection to pass throu…
-
Unscored —CVE-2020-13938 EPSS 12%
Improper Handling of Insufficient Privileges
Apache HTTP Server versions 2.4.0 to 2.4.46 Unprivileged local users can stop httpd on Windows
-
Unscored —CVE-2020-13950 EPSS 50%
mod_proxy_http NULL pointer dereference
Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer dereference) with specially crafted requests using both Content-Length and Transfer-Encoding headers, leading to a Denial of Service
-
Unscored —CVE-2020-35452 EPSS 53%
mod_auth_digest possible stack overflow by one nul byte
Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team could create one, though some particular compile…
-
Unscored —
mod_session NULL pointer dereference
Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service
-
Unscored —CVE-2021-26691 EPSS 68%
Apache HTTP Server mod_session response handling heap overflow
In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow
-
Unscored —CVE-2021-30641 EPSS 52%
Unexpected URL matching with 'MergeSlashes OFF'
Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2019-17567.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2020-13938.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2020-13950.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2020-35452.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-26690.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-26691.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-30641.html