CVE-2006-20001

Published: 17 January 2023

A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash. This issue affects Apache HTTP Server 2.4.54 and earlier.

Priority

Cvss 3 Severity Score

7.5

Score breakdown

Status

Package	Release	Status
apache2 Launchpad, Ubuntu, Debian	focal	Released (2.4.41-4ubuntu3.13)
	lunar	Released (2.4.55-1ubuntu1)
	bionic	Released (2.4.29-1ubuntu4.26)
	jammy	Released (2.4.52-1ubuntu4.3)
	kinetic	Released (2.4.54-2ubuntu1.1)
	trusty	Needed
	upstream	Released (2.4.55-1)
	xenial	Released (2.4.18-2ubuntu3.17+esm8) Available with Ubuntu Pro or Ubuntu Pro (Infra-only)
	mantic	Released (2.4.55-1ubuntu1)
	Patches: upstream: https://github.com/apache/httpd/commit/7469547c3f617717ca545d0f7c56d01134703813

Severity score breakdown

Parameter	Value
Base score	7.5
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	None
Availability impact	High
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›