Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.2735
Apache 2.4 vulnerabilities
10 August 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Apache HTTP Server
Publisher: The Apache Software Foundation
Operating System: UNIX variants (UNIX, Linux, OSX)
Impact/Access: Denial of Service -- Remote/Unauthenticated
Provide Misleading Information -- Remote/Unauthenticated
Access Confidential Data -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2020-11993 CVE-2020-11985 CVE-2020-11984
CVE-2020-9490
Original Bulletin:
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-9490
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-11993
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-11985
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-11984
Comment: This bulletin contains four (4) security advisories.
- --------------------------BEGIN INCLUDED TEXT--------------------
CVE-2020-11984: mod_uwsgi buffer overlow
Severity: moderate
Vendor: The Apache Software Foundation
Versions Affected:
httpd 2.4.32 to 2.4.44
Description:
Apache HTTP Server 2.4.32 to 2.4.44
mod_proxy_uwsgi info disclosure and possible RCE
Mitigation:
disable mod_uwsgi
Credit:
Discovered by Felix Wilhelm of Google Project Zero
References:
https://httpd.apache.org/security/vulnerabilities_24.html
- -----------------------------------------------------------------------------
CVE-2020-11985: CWE-345: Insufficient verification of data authenticity
Severity: low
Vendor: The Apache Software Foundation
Versions Affected:
httpd 2.4.1 to 2.4.23
Description:
Apache HTTP Server 2.4.1 to 2.4.23
IP address spoofing when proxying using mod_remoteip and mod_rewrite
Mitigation:
Disable mod_remoteip
Credit:
Initially reported at https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/1875299
References:
https://httpd.apache.org/security/vulnerabilities_24.html
- -----------------------------------------------------------------------------
CVE-2020-11993: Push Diary Crash on Specifically Crafted HTTP/2 Header
Severity: moderate
Vendor: Apache Software Foundation
Versions Affected:
Apache HTTP Server 2.4.20 to 2.4.43
Description:
Apache HTTP Server versions 2.4.20 to 2.4.43
When trace/debug was enabled for the HTTP/2 module and on
certain traffic edge patterns, logging statements were made on
the wrong connection, causing concurrent use of memory pools.
Configuring the LogLevel of mod_http2 above "info" will mitigate this vulnerability for unpatched servers.
Mitigation:
Credit:
Felix Wilhelm of Google Project Zero
References:
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-11993
- -----------------------------------------------------------------------------
CVE-2020-9490: Push Diary Crash on Specifically Crafted HTTP/2 Header
Severity: important
Vendor: Apache Software Foundation
Versions Affected:
Apache HTTP Server 2.4.20 to 2.4.43
Description:
Apache HTTP Server versions 2.4.20 to 2.4.43
A specially crafted value for the 'Cache-Digest' header in a HTTP/2
request would result in a crash when the server actually tries to HTTP/2
PUSH a resource afterwards.
Configuring the HTTP/2 feature via "H2Push off" will mitigate this vulnerability for unpatched servers.
Mitigation:
Credit:
Felix Wilhelm of Google Project Zero
References:
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-9490
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXzDSdONLKJtyKPYoAQib8Q//e0mO640NDZnCL4YetqSZTA/Di33pHoPi
tqFBKtDurippH0s6KThDXnlbAv+33uizJ0OgrBYCZ66jY1CoBkdg7SzmnYCjUaE3
SdyPdaGgX5IGTiF4V/PRiD1WWWMGi63so4ugKM6AS6K3TDt/+OIB+ZP1lgnAzCDy
ibhga+STMAEwhoj1t+2YcGrAs8rRqiW0Uw0OL1km223ZrzzobMa/tCwFIoYW95sb
/FT/o9l238I9NQVVadeinKjOZjf/5WsQOZ+PKdS6agLT5xPzza8E80SB7PKvqlCI
P0iLZ5E87po7DsO16Y/nOZyLS9dskM50aqiNk0T/dLPmUeyxyk0sSaZ/5Kt/AFGl
a2eAbHvd16wPmO99WkbXqEzY4PklCxV2JU0VcupXtCCdzZY4Z+PX49xXZcmz80NB
kd5DgBSoSsijOuqxRS3F8/4nIIiOjfMX4UtIBYBHLPmyIhgBxN7DdSnnhrdoZmO3
IfOglvLyel1/rvG3RyO8zUFndP2PbUmQfnkSNDhL4YrRzh4Jvas/kslMX/lksfzm
xdCjYGrIVWnnpzDzJhiGXtXLOozl5yvCMUNgofQqBIMLfgKNMO385LtIXWHYecpm
+kBtDoc2J8qtAXBtmE56LXnKCTgA/2+xI0BaD8B+vC5hGUFw1HnlwF7r1fUgUcaA
fDZ0TGTo0pk=
=X91C
-----END PGP SIGNATURE-----