Not rated
CVE-2019-10081 HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an…
Description
HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache HTTP Server | Versions not published |
References
- DSA-4509 www.debian.org
- 20190826 [SECURITY] [DSA 4509-1] apache2 security update seclists.org
- USN-4113-1 usn.ubuntu.com
- openSUSE-SU-2019:2051 lists.opensuse.org
- GLSA-201909-04 security.gentoo.org
- [httpd-cvs] 20200401 svn commit: r1058586 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html lists.apache.org
- [httpd-cvs] 20200401 svn commit: r1058587 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html lists.apache.org
- www.oracle.com www.oracle.com
- www.oracle.com www.oracle.com
- www.oracle.com www.oracle.com
- httpd.apache.org httpd.apache.org
- security.netapp.com security.netapp.com
- support.f5.com support.f5.com
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ lists.apache.org
- [httpd-cvs] 20210330 svn commit: r1073143 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/ lists.apache.org
- [httpd-cvs] 20210330 svn commit: r1073140 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html lists.apache.org
- [httpd-cvs] 20210330 svn commit: r1073139 [12/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ lists.apache.org
- [httpd-cvs] 20210330 svn commit: r1888194 [12/13] - /httpd/site/trunk/content/security/json/ lists.apache.org
- [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ lists.apache.org
- [httpd-cvs] 20210330 svn commit: r1073149 [13/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ lists.apache.org
- [httpd-cvs] 20210606 svn commit: r1075470 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache HTTP Server
The 9 CVEs of Apache HTTP Server →
CVE-2020-11985
IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip…
Not rated
CVE-2020-11993
Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic…
Not rated
CVE-2020-11984
Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE
Not rated
CVE-2020-9490
Apache HTTP Server versions 2.4.20 to 2.4.43
Not rated