USN-4458-1: Apache HTTP Server vulnerabilities
13 August 2020
Several security issues were fixed in Apache HTTP Server.
Releases
Packages
- apache2 - Apache HTTP server
Details
Fabrice Perez discovered that the Apache mod_rewrite module incorrectly
handled certain redirects. A remote attacker could possibly use this issue
to perform redirects to an unexpected URL. (CVE-2020-1927)
Chamal De Silva discovered that the Apache mod_proxy_ftp module incorrectly
handled memory when proxying to a malicious FTP server. A remote attacker
could possibly use this issue to obtain sensitive information.
(CVE-2020-1934)
Felix Wilhelm discovered that the HTTP/2 implementation in Apache did not
properly handle certain Cache-Digest headers. A remote attacker could
possibly use this issue to cause Apache to crash, resulting in a denial of
service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
(CVE-2020-9490)
Felix Wilhelm discovered that the Apache mod_proxy_uwsgi module incorrectly
handled large headers. A remote attacker could use this issue to obtain
sensitive information or possibly execute arbitrary code. This issue only
affected Ubuntu 20.04 LTS. (CVE-2020-11984)
Felix Wilhelm discovered that the HTTP/2 implementation in Apache did not
properly handle certain logging statements. A remote attacker could
possibly use this issue to cause Apache to crash, resulting in a denial of
service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
(CVE-2020-11993)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 20.04
-
apache2
-
2.4.41-4ubuntu3.1
-
apache2-bin
-
2.4.41-4ubuntu3.1
-
libapache2-mod-proxy-uwsgi
-
2.4.41-4ubuntu3.1
Ubuntu 18.04
Ubuntu 16.04
In general, a standard system update will make all the necessary changes.