USN-4458-1: Apache HTTP Server vulnerabilities
13 August 2020
Several security issues were fixed in Apache HTTP Server.
Releases
Packages
- apache2 - Apache HTTP server
Details
Fabrice Perez discovered that the Apache mod_rewrite module incorrectly
handled certain redirects. A remote attacker could possibly use this issue
to perform redirects to an unexpected URL. (CVE-2020-1927)
Chamal De Silva discovered that the Apache mod_proxy_ftp module incorrectly
handled memory when proxying to a malicious FTP server. A remote attacker
could possibly use this issue to obtain sensitive information.
(CVE-2020-1934)
Felix Wilhelm discovered that the HTTP/2 implementation in Apache did not
properly handle certain Cache-Digest headers. A remote attacker could
possibly use this issue to cause Apache to crash, resulting in a denial of
service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
(CVE-2020-9490)
Felix Wilhelm discovered that the Apache mod_proxy_uwsgi module incorrectly
handled large headers. A remote attacker could use this issue to obtain
sensitive information or possibly execute arbitrary code. This issue only
affected Ubuntu 20.04 LTS. (CVE-2020-11984)
Felix Wilhelm discovered that the HTTP/2 implementation in Apache did not
properly handle certain logging statements. A remote attacker could
possibly use this issue to cause Apache to crash, resulting in a denial of
service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
(CVE-2020-11993)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 20.04
-
apache2
-
2.4.41-4ubuntu3.1
-
apache2-bin
-
2.4.41-4ubuntu3.1
-
libapache2-mod-proxy-uwsgi
-
2.4.41-4ubuntu3.1
Ubuntu 18.04
Ubuntu 16.04
In general, a standard system update will make all the necessary changes.
Related notices
- USN-5054-1: uwsgi-app-integration-plugins, uwsgi-plugin-psgi, uwsgi-extra, uwsgi-plugin-rbthreads, uwsgi-src, uwsgi-plugin-gevent-python, uwsgi-plugin-geoip, uwsgi-plugin-servlet-openjdk-8, uwsgi-plugin-ldap, python3-uwsgidecorators, uwsgi-plugin-fiber, libapache2-mod-ruwsgi, uwsgi-plugin-glusterfs, python-uwsgidecorators, uwsgi-plugin-rack-ruby2.5, uwsgi-plugin-graylog2, uwsgi-plugin-asyncio-python3, uwsgi-plugin-emperor-pg, uwsgi-plugin-lua5.1, libapache2-mod-proxy-uwsgi, uwsgi-plugin-sqlite3, uwsgi-plugin-alarm-curl, uwsgi-plugin-router-access, uwsgi-plugin-alarm-xmpp, uwsgi-plugin-rados, uwsgi-plugin-mono, uwsgi-plugin-xslt, uwsgi-emperor, uwsgi-plugin-jwsgi-openjdk-8, uwsgi-dev, uwsgi, uwsgi-plugin-lua5.2, uwsgi-plugins-all, uwsgi-plugin-greenlet-python, libapache2-mod-uwsgi, uwsgi-plugin-gccgo, uwsgi-plugin-ring-openjdk-8, uwsgi-core, uwsgi-plugin-python, uwsgi-plugin-jvm-openjdk-8, uwsgi-plugin-python3, uwsgi-plugin-curl-cron, uwsgi-plugin-tornado-python, uwsgi-infrastructure-plugins, uwsgi-plugin-asyncio-python
- USN-5054-2: uwsgi-app-integration-plugins, uwsgi-plugin-psgi, uwsgi-extra, uwsgi-plugin-rbthreads, uwsgi-src, uwsgi-plugin-gevent-python, uwsgi-plugin-geoip, uwsgi-plugin-servlet-openjdk-8, uwsgi-plugin-ldap, python3-uwsgidecorators, uwsgi-plugin-fiber, uwsgi-plugin-php, uwsgi-plugin-jvm-openjdk-6, uwsgi-plugin-rack-ruby1.9.1, libapache2-mod-ruwsgi, uwsgi-plugin-glusterfs, uwsgi-plugin-jwsgi-openjdk-7, python-uwsgidecorators, uwsgi-plugin-graylog2, uwsgi-plugin-asyncio-python3, uwsgi-plugin-luajit, uwsgi-plugin-emperor-pg, uwsgi-plugin-lua5.1, uwsgi-plugin-jvm-openjdk-7, uwsgi-plugin-rack-ruby2.3, libapache2-mod-proxy-uwsgi, uwsgi-plugin-pyerl-python3, uwsgi-plugin-sqlite3, uwsgi-plugin-alarm-curl, uwsgi-plugin-router-access, uwsgi-plugin-jwsgi-openjdk-6, uwsgi-plugin-alarm-xmpp, uwsgi-plugin-pyerl-python, uwsgi-plugin-rados, uwsgi-plugin-mono, uwsgi-plugin-v8, uwsgi-plugin-xslt, uwsgi-emperor, uwsgi-plugin-jwsgi-openjdk-8, uwsgi, uwsgi-plugin-erlang, uwsgi-plugin-lua5.2, uwsgi-plugins-all, uwsgi-plugin-greenlet-python, libapache2-mod-uwsgi, uwsgi-plugin-gccgo, uwsgi-plugin-ring-openjdk-8, uwsgi-core, uwsgi-plugin-python, uwsgi-plugin-jvm-openjdk-8, uwsgi-plugin-python3, uwsgi-plugin-curl-cron, uwsgi-plugin-tornado-python, uwsgi-infrastructure-plugins, uwsgi-plugin-asyncio-python