Memory Pool Mismanagement in Apache HTTP Server 2.4.20 to 2.4.43
Summary
ALPINE-CVE-2020-11993: Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were made on the wrong connection, causing concurrent use of memory... Affects apache2 versions < 2.4.46-r0. Fixed in 2.4.46-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server is a widely-used open-source web server software that enables users to serve web content. It is known for its flexibility, power, and extensive feature set, including support for various protocols and modules. However, certain versions of Apache HTTP Server, specifically from 2.4.20 to 2.4.43, are vulnerable to a memory pool mismanagement issue when the HTTP/2 module's trace/debug feature is enabled.
Vulnerability Detail
The vulnerability arises when the trace/debug feature for the HTTP/2 module is enabled, leading to incorrect logging statements being made on the wrong connection. This mismanagement can cause concurrent use of memory pools, potentially leading to memory corruption and application instability. Attackers could exploit this vulnerability to disrupt service or execute arbitrary code, posing a significant risk to the integrity and availability of the web server.
How To Fix
Minimum fixed version
2.4.46-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, configure the LogLevel of mod_http2 to 'info' or lower. This can be done by adding the following line to your Apache configuration file: 'LogLevel mod_http2:info'. This adjustment will mitigate the vulnerability until the server can be updated.
Conclusion
The vulnerability in Apache HTTP Server versions 2.4.20 to 2.4.43 poses a significant risk due to memory pool mismanagement when the HTTP/2 module's trace/debug feature is enabled. It is crucial to update to version 2.4.46-r0 or later to mitigate this risk. In the meantime, adjusting the LogLevel can serve as a temporary workaround.
See every vulnerability recorded for apache2 →
FAQ
Apache HTTP Server versions 2.4.20 to 2.4.43 are affected by this vulnerability.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate update is not possible, configure the LogLevel of mod_http2 to 'info' to mitigate the risk temporarily.
Failing to address this vulnerability could lead to memory corruption, application instability, and potential exploitation by attackers.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
