Critical Vulnerabilities in Apache2 Package: Denial of Service Risks
Summary
USN-4994-2: apache2 vulnerabilities. Affects apache2 versions < 2.4.7-1ubuntu4.22+esm1. Fixed in 2.4.7-1ubuntu4.22+esm1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache2 is a widely used open-source web server software that enables the hosting of websites and web applications. It is known for its flexibility, scalability, and robust performance. However, recent vulnerabilities have been identified that could lead to denial of service attacks, affecting the availability of services hosted on Apache2.
Vulnerability Detail
The vulnerabilities stem from improper handling of certain modules within Apache2. Specifically, the mod_auth_digest and mod_session modules have been found to mishandle nonces and Cookie headers, respectively. This could allow remote attackers to exploit these weaknesses, potentially causing the server to crash and resulting in denial of service. The vulnerabilities are tracked under CVE-2020-35452, CVE-2021-26690, CVE-2021-26691, and CVE-2021-30641.
How To Fix
Minimum fixed version
2.4.7-1ubuntu4.22+esm1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider disabling the affected modules until the patch is applied. This can be done by running:
sudo a2dismod auth_digest
sudo a2dismod session
After disabling the modules, restart Apache2 with:
sudo systemctl restart apache2
Conclusion
The identified vulnerabilities in the Apache2 package pose significant risks, particularly in terms of denial of service. It is crucial for users to update their packages to the latest patched versions to ensure the security and availability of their web services.
See every vulnerability recorded for apache2 →
FAQ
The main vulnerabilities include improper handling of nonces in mod_auth_digest and issues with Cookie headers in mod_session, leading to potential denial of service.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
The impacted versions include Apache2 2.4.7 for Ubuntu 14.04 ESM and Apache2 2.4.18 for Ubuntu 16.04 ESM.
While the primary risk is denial of service, there is a potential for arbitrary code execution in some cases, which could lead to data loss.
It is recommended to regularly check for updates and apply patches as soon as they are available to minimize the risk of vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
