Read the docs
Red Hat Security Advisory

RHSA-2020:4751

httpd:2.4 security, bug fix, and enhancement update

Released 2020-11-04 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 10 records

TI-2019-07417 CVE-2019-10092 · GHSA-qrr6-fpf4-x3v4

Cross-site scripting in Apache HTTP Server

Priority HIGH 68

In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.81466 Published 2019-09-26 Partial fix CWE-79
TI-2019-07422 CVE-2019-10098 · GHSA-hm8m-x559-v4fw

Open redirect in Apache HTTP Server

Priority HIGH 66

In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.73981 Published 2019-09-25 Partial fix CWE-601
TI-2019-07421 CVE-2019-10097 · GHSA-x7xg-9vq9-q8xh

NULL pointer dereference in Apache HTTP Server

Priority MEDIUM 64

In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could trigger a stack buffer overflow or NULL…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.52873 Published 2019-09-26 Partial fix CWE-476
TI-2020-01851 CVE-2020-1927 · GHSA-h8gj-rgqf-fpq3

Open redirect in Apache HTTP Server

Priority MEDIUM 61

In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request U…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.56691 Published 2020-04-01 Fixed CWE-601
TI-2020-01858 CVE-2020-1934 · GHSA-x5pm-xqw2-5256

Use of uninitialized resource in Apache HTTP Server

Priority MEDIUM 56

In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.51951 Published 2020-04-01 Partial fix CWE-908
TI-2019-07407 CVE-2019-10082 · GHSA-28c2-r3qq-82vj

Use after free in Apache HTTP Server

Priority MEDIUM 56

In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection shutdown.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.16549 Published 2019-09-26 Partial fix CWE-416
TI-2019-07406 CVE-2019-10081 · GHSA-c2vp-q2q2-hm8m

Out-of-bounds write in Apache HTTP Server

Priority MEDIUM 48

HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.14563 Published 2019-08-15 Partial fix CWE-787
TI-2019-00173 CVE-2019-0196 · GHSA-vqc7-p7p7-97wf

Use after free in Apache HTTP Server

Priority MEDIUM 42

A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.193 Published 2019-06-11 Partial fix CWE-416
TI-2018-12288 CVE-2018-17189 · GHSA-xcwr-pcwv-7gm8

Uncontrolled resource consumption in Apache HTTP Server

Priority MEDIUM 42

In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.19404 Published 2019-01-30 Fixed CWE-400