Summary
Fabrice Perez discovered that the Apache mod_rewrite module incorrectly
handled certain redirects. A remote attacker could possibly use this issue
to perform redirects to an unexpected URL. (CVE-2020-1927)
Chamal De Silva discovered that the Apache mod_proxy_ftp module incorrectly
handled memory when proxying to a malicious FTP server. A remote attacker
could possibly use this issue to obtain sensitive information.
(CVE-2020-1934)
Felix Wilhelm discovered that the HTTP/2 implementation in Apache did not
properly handle certain Cache-Digest headers. A remote attacker could
possibly use this issue to cause Apache to crash, resulting in a denial of
service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
(CVE-2020-9490)
Felix Wilhelm discovered that the Apache mod_proxy_uwsgi module incorrectly
handled large headers. A remote attacker could use this issue to obtain
sensitive information or possibly execute arbitrary code. This issue only
affected Ubuntu 20.04 LTS. (CVE-2020-11984)
Felix Wilhelm discovered that the HTTP/2 implementation in Apache did not
properly handle certain logging statements. A remote attacker could
possibly use this issue to cause Apache to crash, resulting in a denial of
service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
(CVE-2020-11993)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | apache2 | 2.4.18-2ubuntu3.17 |
| Ubuntu · 18.04 LTS 18.04:LTS | apache2 | 2.4.29-1ubuntu4.14 |
| Ubuntu · 20.04 LTS 20.04:LTS | apache2 | 2.4.41-4ubuntu3.1 |
Vulnerabilities 5
-
Unscored —
Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE
-
Unscored —CVE-2020-11993 EPSS 57%
Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic …
-
Unscored —CVE-2020-1927 EPSS 57%
In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential …
-
Unscored —CVE-2020-1934 EPSS 52%
In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP serv…
-
Unscored —CVE-2020-9490 EPSS 89%
Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 reque…