Apache HTTP Server: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 8

• Unscored —
  CVE-2019-17567 EPSS 60%

  mod_proxy_wstunnel tunneling of non Upgraded connections

  Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the whole connection regardless, thus allowing for subsequent requests on the same connection to pass throu…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux
  Jun 10, 2021
• Unscored —
  CVE-2020-13938 EPSS 12%

  Improper Handling of Insufficient Privileges

  Apache HTTP Server versions 2.4.0 to 2.4.46 Unprivileged local users can stop httpd on Windows

  Apache Software Foundation Apache HTTP Server apache2 Alpine
  Jun 10, 2021
• Unscored —
  CVE-2020-13950 EPSS 50%

  mod_proxy_http NULL pointer dereference

  Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer dereference) with specially crafted requests using both Content-Length and Transfer-Encoding headers, leading to a Denial of Service

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jun 10, 2021
• Unscored —
  CVE-2020-35452 EPSS 53%

  mod_auth_digest possible stack overflow by one nul byte

  Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team could create one, though some particular compile…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jun 10, 2021
• Unscored —
  CVE-2021-20325

  Missing fixes for CVE-2021-40438 and CVE-2021-26691 in the versions of httpd, as shipped in Red Hat Enterprise Linux 8.…

  Feb 18, 2022
• Unscored —
  CVE-2021-26690 Public exploit EPSS 65%

  mod_session NULL pointer dereference

  Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jun 10, 2021
• Unscored —
  CVE-2021-26691 EPSS 68%

  Apache HTTP Server mod_session response handling heap overflow

  In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jun 10, 2021
• Unscored —
  CVE-2021-30641 EPSS 52%

  Unexpected URL matching with 'MergeSlashes OFF'

  Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jun 10, 2021

Revision history

1. 2024-05-26 #32

   Neue Updates von Debian aufgenommen

2. 2023-04-16 #31

   Neue Updates von F5 aufgenommen

3. 2023-04-04 #30

   Neue Updates von Oracle Linux aufgenommen

4. 2022-11-20 #29

   Neue Updates von IBM aufgenommen

5. 2022-11-15 #28

   Neue Updates von Oracle Linux aufgenommen

6. 2022-07-19 #27

   Neue Updates von AVAYA aufgenommen

7. 2022-06-26 #26

   Neue Updates von AVAYA und Oracle Linux aufgenommen

8. 2022-06-22 #25

   Neue Updates von Red Hat aufgenommen

9. 2022-05-17 #24

   Neue Updates von Oracle Linux aufgenommen

10. 2022-05-10 #23

    Neue Updates von Red Hat aufgenommen

11. 2022-03-24 #22

    Neue Updates von Oracle Linux aufgenommen

12. 2022-01-27 #21

    Neue Updates von AVAYA aufgenommen

13. 2022-01-25 #20

    Neue Updates von CentOS aufgenommen

14. 2022-01-19 #19

    Neue Updates von Oracle Linux aufgenommen

15. 2022-01-16 #18

    Neue Updates von Red Hat aufgenommen

16. 2021-11-18 #17

    Neue Updates von Oracle Linux aufgenommen

17. 2021-11-14 #16

    Neue Updates von Oracle Linux und AVAYA aufgenommen

18. 2021-11-10 #15

    Neue Updates von Red Hat aufgenommen

19. 2021-11-09 #14

    Neue Updates von Red Hat aufgenommen

20. 2021-11-03 #13

    Neue Updates von Oracle Linux aufgenommen

21. 2021-10-13 #12

    Neue Updates von Oracle Linux aufgenommen

22. 2021-10-12 #11

    Neue Updates von Red Hat aufgenommen

23. 2021-07-18 #10

    Neue Updates von Gentoo aufgenommen

24. 2021-07-12 #9

    Neue Updates von Amazon aufgenommen

25. 2021-07-11 #8

    Neue Updates von Debian aufgenommen

References

• Apache Security Advisory vom 2021-06-09
  https://httpd.apache.org/security/vulnerabilities_24.html
• SUSE Security Update SUSE-SU-2021:2006-1 vom 2021-06-17
  https://lists.suse.com/pipermail/sle-security-updates/2021-June/009032.html
• SUSE Security Update SUSE-SU-2021:2004-1 vom 2021-06-17
  https://lists.suse.com/pipermail/sle-security-updates/2021-June/009030.html
• SUSE Security Update SUSE-SU-2021:14749-1 vom 2021-06-17
  https://lists.suse.com/pipermail/sle-security-updates/2021-June/009024.html
• Ubuntu Security Notice USN-4994-1 vom 2021-06-21
  https://ubuntu.com/security/notices/USN-4994-1
• Ubuntu Security Notice USN-4994-1 vom 2021-06-21
  https://ubuntu.com/security/notices/USN-4994-2
• SUSE Security Update SUSE-SU-2021:2127-1 vom 2021-06-22
  https://lists.suse.com/pipermail/sle-security-updates/2021-June/009074.html
• Amazon Linux Security Advisory ALAS-2021-1659 vom 2021-06-23
  https://alas.aws.amazon.com/AL2/ALAS-2021-1659.html
• Amazon Linux Security Advisory ALAS-2021-1674 vom 2021-07-02
  https://alas.aws.amazon.com/AL2/ALAS-2021-1674.html
• Debian Security Advisory DSA-4937 vom 2021-07-09
  https://www.debian.org/security/2021/dsa-4937
• Debian Security Advisory DLA-2706 vom 2021-07-09
  https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html
• Amazon Linux Security Advisory ALAS-2021-1514 vom 2021-07-13
  https://alas.aws.amazon.com/ALAS-2021-1514.html
• Oracle Linux Security Advisory ELSA-2021-9541 vom 2021-11-04
  https://linux.oracle.com/errata/ELSA-2021-9541.html
• Gentoo Linux Security Advisory GLSA-202107-38 vom 2021-07-17
  https://security.gentoo.org/glsa/202107-38
• Red Hat Security Advisory RHSA-2021:3816 vom 2021-10-12
  https://access.redhat.com/errata/RHSA-2021:3816
• Oracle Linux Security Advisory ELSA-2021-3816 vom 2021-10-13
  http://linux.oracle.com/errata/ELSA-2021-3816.html
• Red Hat Security Advisory RHSA-2021:4537 vom 2021-11-10
  https://access.redhat.com/errata/RHSA-2021:4537
• Red Hat Security Advisory RHSA-2021:4257 vom 2021-11-09
  https://access.redhat.com/errata/RHSA-2021:4257
• Red Hat Security Advisory RHSA-2021:4613 vom 2021-11-10
  https://access.redhat.com/errata/RHSA-2021:4613
• Red Hat Security Advisory RHSA-2021:4614 vom 2021-11-10
  https://access.redhat.com/errata/RHSA-2021:4614
• Oracle Linux Security Advisory ELSA-2021-9545 vom 2021-11-12
  http://linux.oracle.com/errata/ELSA-2021-9545.html
• AVAYA Security Advisory ASA-2021-158 vom 2021-11-11
  https://downloads.avaya.com/css/P8/documents/101078543
• AVAYA Security Advisory ASA-2021-157 vom 2021-11-11
  https://downloads.avaya.com/css/P8/documents/101078542
• Oracle Linux Security Advisory ELSA-2021-4537 vom 2021-11-18
  https://linux.oracle.com/errata/ELSA-2021-4537.html
• Red Hat Security Advisory RHSA-2022:0143 vom 2022-01-17
  https://access.redhat.com/errata/RHSA-2022:0143
• Oracle Linux Security Advisory ELSA-2022-0143 vom 2022-01-19
  http://linux.oracle.com/errata/ELSA-2022-0143.html
• CentOS Security Advisory CESA-2022:0143 vom 2022-01-25
  https://lists.centos.org/pipermail/centos-announce/2022-January/073551.html
• AVAYA Security Advisory ASA-2022-003 vom 2027-01-18
  https://downloads.avaya.com/css/P8/documents/101079910
• Oracle Linux Security Advisory ELSA-2022-1915 vom 2022-05-17
  https://linux.oracle.com/errata/ELSA-2022-1915.html
• Oracle Linux Security Advisory ELSA-2022-1045 vom 2022-03-24
  http://linux.oracle.com/errata/ELSA-2022-1045.html
• Red Hat Security Advisory RHSA-2022:1915 vom 2022-05-10
  https://access.redhat.com/errata/RHSA-2022:1915
• Red Hat Security Advisory RHSA-2022:5163 vom 2022-06-22
  https://access.redhat.com/errata/RHSA-2022:5163
• AVAYA Security Advisory ASA-2022-083 vom 2022-06-24
  https://downloads.avaya.com/css/P8/documents/101082388
• Oracle Linux Security Advisory ELSA-2022-5163 vom 2022-06-24
  http://linux.oracle.com/errata/ELSA-2022-5163.html
• AVAYA Security Advisory ASA-2022-053 vom 2022-07-18
  https://downloads.avaya.com/css/P8/documents/101082704
• Oracle Linux Security Advisory ELSA-2022-7647 vom 2022-11-15
  https://linux.oracle.com/errata/ELSA-2022-7647.html
• IBM Security Bulletin
  https://www.ibm.com/support/pages/node/6840315
• Oracle Linux Security Advisory ELSA-2023-1593 vom 2023-04-05
  https://linux.oracle.com/errata/ELSA-2023-1593.html
• F5 stellt neue Informationen zur Verfügung
  https://my.f5.com/manage/s/article/K000133522
• Debian Security Advisory DLA-3818 vom 2024-05-25
  https://lists.debian.org/debian-lts-announce/2024/05/msg00013.html