Apache2 - Multiple Vulnerabilities
Summary
DSA-4757-1: apache2 - security update. Affects apache2 versions < 2.4.38-3+deb10u4. Fixed in 2.4.38-3+deb10u4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache2 is a widely used open-source web server software. It provides a robust and flexible platform for hosting websites and applications. The Apache HTTPD server is a key component of the Apache2 package. It handles incoming HTTP requests and serves web content to clients. However, several vulnerabilities have been discovered in the Apache HTTPD server, which could potentially compromise the security and stability of the server.
Vulnerability Detail
The Apache2 package is affected by multiple vulnerabilities:
- CVE-2020-1927: Certain mod_rewrite configurations are prone to an open redirect.
- CVE-2020-1934: The mod_proxy_ftp module uses uninitialized memory when proxying to a malicious FTP backend.
- CVE-2020-9490: A specially crafted value for the 'Cache-Digest' header in an HTTP/2 request could cause a crash when the server tries to HTTP/2 PUSH a resource afterwards.
- CVE-2020-11984: The mod_proxy_uwsgi module has a buffer overflow flaw that could result in information disclosure or remote code execution.
- CVE-2020-11993: Enabling trace/debug for the HTTP/2 module can cause logging statements on the wrong connection, leading to concurrent use of memory pools.
These vulnerabilities pose various risks, including open redirect attacks, uninitialized memory usage, server crashes, information disclosure, and potential remote code execution.
How To Fix
Minimum fixed version
2.4.38-3+deb10u4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Apache2 package is affected by multiple vulnerabilities that can have severe consequences for the security and stability of the server. It is crucial to upgrade to the latest version of the apache2 package (2.4.38-3+deb10u4 or later) to mitigate these vulnerabilities. Regularly updating and patching software is essential to ensure the security of your server and protect against potential attacks. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache2 →
FAQ
mod_rewrite is an Apache module that allows for URL rewriting. It is commonly used for creating search engine-friendly URLs or redirecting URLs. In the case of CVE-2020-1927, certain mod_rewrite configurations can be exploited to perform open redirects, which can be abused by attackers to redirect users to malicious websites.
mod_proxy_ftp is an Apache module that provides proxy support for FTP connections. In the case of CVE-2020-1934, when proxying to a malicious FTP backend, the module uses uninitialized memory, which can lead to unpredictable behavior and potential security vulnerabilities.
CVE-2020-9490 is related to the HTTP/2 protocol. By sending a specially crafted value for the 'Cache-Digest' header in an HTTP/2 request, an attacker can trigger a crash in the server when it attempts to HTTP/2 PUSH a resource afterwards. This can potentially disrupt the server's functionality and availability.
mod_proxy_uwsgi is an Apache module that provides proxy support for the uWSGI protocol. The buffer overflow vulnerability (CVE-2020-11984) in this module can be exploited by an attacker to disclose sensitive information or potentially execute remote code on the server. It is crucial to patch this vulnerability to prevent unauthorized access and potential compromise of the server.
CVE-2020-11993 is related to the HTTP/2 module in Apache2. Enabling trace/debug for this module can cause logging statements on the wrong connection, resulting in concurrent use of memory pools. This can lead to memory corruption and potential instability of the server. It is recommended to disable trace/debug or apply the necessary patches to mitigate this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
