Denial of Service Vulnerability in Apache2 Package (CVE-2020-13950)
Summary
ALPINE-CVE-2020-13950: Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer dereference) with specially crafted requests using both Content-Length and Transfer-Encoding headers, leading to a Denial of... Affects apache2 versions < 2.4.48-r0. Fixed in 2.4.48-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server, commonly referred to as Apache2, is one of the most widely used web server software packages. It provides a robust, flexible, and secure platform for hosting websites and applications. Apache2 supports various features including customizable error messages, authentication configurations, and URL redirection. However, certain versions of Apache2 are vulnerable to a Denial of Service (DoS) attack due to improper handling of HTTP requests, specifically when both Content-Length and Transfer-Encoding headers are present.
Vulnerability Detail
The vulnerability identified as CVE-2020-13950 affects Apache HTTP Server versions 2.4.41 to 2.4.46. It can be exploited by sending specially crafted HTTP requests that include both Content-Length and Transfer-Encoding headers, leading to a NULL pointer dereference. This results in the server crashing, causing a Denial of Service. The vulnerability poses a significant risk as it can disrupt service availability, impacting users and applications relying on the affected server.
How To Fix
Minimum fixed version
2.4.48-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can configure your server to reject requests that contain both Content-Length and Transfer-Encoding headers. This can be done by modifying the server configuration to filter out such requests, although this may not be a comprehensive solution.
Conclusion
CVE-2020-13950 is a critical vulnerability in Apache2 that can lead to Denial of Service attacks. It is essential for users of affected versions to update their packages to mitigate the risk. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain the security of your applications.
See every vulnerability recorded for apache2 →
FAQ
CVE-2020-13950 is a vulnerability in Apache HTTP Server that allows for Denial of Service attacks due to improper handling of HTTP requests.
Apache2 versions 2.4.41 to 2.4.46 are affected by this vulnerability.
Exploitation of this vulnerability can lead to server crashes, resulting in service unavailability for users and applications.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2020-13950 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
