Login
Newsletter
Werbung

Sicherheit: Mehrere Probleme in Apache
Aktuelle Meldungen Distributionen
Name: Mehrere Probleme in Apache
ID: USN-4458-1
Distribution: Ubuntu
Plattformen: Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS
Datum: Fr, 14. August 2020, 00:19
Referenzen: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11993
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1927
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9490
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11984
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1934
Applikationen: Apache

Originalnachricht

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============7986022916067865731==
Content-Type: multipart/signed; micalg=pgp-sha512;
protocol="application/pgp-signature";
boundary="GJwnaaxWPj2dDieyVRQrRIREVRH28KwhZ"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--GJwnaaxWPj2dDieyVRQrRIREVRH28KwhZ
Content-Type: multipart/mixed;
boundary="QQmLBuZ5b7FZfoVwMkXTGUjCNiyQ7zlFs"

--QQmLBuZ5b7FZfoVwMkXTGUjCNiyQ7zlFs
Content-Type: text/plain; charset=utf-8
Content-Language: en-C
Content-Transfer-Encoding: quoted-printable

==========================================================================
Ubuntu Security Notice USN-4458-1
August 13, 2020

apache2 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in Apache HTTP Server.

Software Description:
- apache2: Apache HTTP server

Details:

Fabrice Perez discovered that the Apache mod_rewrite module incorrectly
handled certain redirects. A remote attacker could possibly use this issue
to perform redirects to an unexpected URL. (CVE-2020-1927)

Chamal De Silva discovered that the Apache mod_proxy_ftp module incorrectly
handled memory when proxying to a malicious FTP server. A remote attacker
could possibly use this issue to obtain sensitive information.
(CVE-2020-1934)

Felix Wilhelm discovered that the HTTP/2 implementation in Apache did not
properly handle certain Cache-Digest headers. A remote attacker could
possibly use this issue to cause Apache to crash, resulting in a denial of
service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
(CVE-2020-9490)

Felix Wilhelm discovered that the Apache mod_proxy_uwsgi module incorrectly
handled large headers. A remote attacker could use this issue to obtain
sensitive information or possibly execute arbitrary code. This issue only
affected Ubuntu 20.04 LTS. (CVE-2020-11984)

Felix Wilhelm discovered that the HTTP/2 implementation in Apache did not
properly handle certain logging statements. A remote attacker could
possibly use this issue to cause Apache to crash, resulting in a denial of
service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
(CVE-2020-11993)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS:
apache2 2.4.41-4ubuntu3.1
apache2-bin 2.4.41-4ubuntu3.1
libapache2-mod-proxy-uwsgi 2.4.41-4ubuntu3.1

Ubuntu 18.04 LTS:
apache2 2.4.29-1ubuntu4.14
apache2-bin 2.4.29-1ubuntu4.14

Ubuntu 16.04 LTS:
apache2 2.4.18-2ubuntu3.17
apache2-bin 2.4.18-2ubuntu3.17

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/4458-1
CVE-2020-11984, CVE-2020-11993, CVE-2020-1927, CVE-2020-1934,
CVE-2020-9490

Package Information:
https://launchpad.net/ubuntu/+source/apache2/2.4.41-4ubuntu3.1
https://launchpad.net/ubuntu/+source/apache2/2.4.29-1ubuntu4.14
https://launchpad.net/ubuntu/+source/apache2/2.4.18-2ubuntu3.17


--QQmLBuZ5b7FZfoVwMkXTGUjCNiyQ7zlFs--

--GJwnaaxWPj2dDieyVRQrRIREVRH28KwhZ
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAl81WTEACgkQZWnYVadE
vpMnmQ/7BPnq32uDMiFkmVP7awQyTHnH0YuXSpdn6bA9yLuwihuhEkV73wC4AMhe
3FHny52mTwTQ7FPGurZz2u7bHrNT/ytXaRu9z2/0TesFyWOQ+oKrxHqghFDKAKg2
9DeDzHOQEuSSfpZT5QMZPH2CHCg39iRVfy9RSc/w6vLQ2LZA0tYbD9OCtRd+eyKm
jSgzoaGrwobRfplUDtTjO1b5Y4QBW5mRWC+Ko4b96ca/ruIrbssHfPrcp7CJWxqS
d3tRzZLUm+oQ/dUbzNmEK793EsOAseQCODRNABwAI1gBh34IIZpO4Fi+Za2j6uKd
N/hD6y5npiOP5TW+MupNy4C13NdQ8eFhcFUCrroWyKJ1XFxf1Wi+MeDO5UBqu+UO
AvXnMmoXs2j0h59s7b29679Ro/wJ+Dzp8e+ITWzGiGJk5tQkXnCOa4mdDjM8qfN9
hRZIHq4+EqtEdhKFFgBhbD10QO4t2TDSF5c/xD7JH/f+6UcSmGnW5IrpwHKkTwHm
smffyDlEnBTC3kiGImz6nVZ1Q7Arfxct8EkaQ6kzGhYhscKZcmDGu2M56s2syH5A
uTaG11eORVVdhyTjqqQx+hF2TxIydg/M3bDWOBgPDU8XAKk1w0rrZuKGoxNSBDdR
ug2ZWSpN9uO54R7FrKRLQgiYW4+F7vjoAbHrhdTZ5A1Uyc2xcU8=
=tTub
-----END PGP SIGNATURE-----

--GJwnaaxWPj2dDieyVRQrRIREVRH28KwhZ--


--===============7986022916067865731==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

LS0gCnVidW50dS1zZWN1cml0eS1hbm5vdW5jZSBtYWlsaW5nIGxpc3QKdWJ1bnR1LXNlY3VyaXR5
LWFubm91bmNlQGxpc3RzLnVidW50dS5jb20KTW9kaWZ5IHNldHRpbmdzIG9yIHVuc3Vic2NyaWJl
IGF0OiBodHRwczovL2xpc3RzLnVidW50dS5jb20vbWFpbG1hbi9saXN0aW5mby91YnVudHUtc2Vj
dXJpdHktYW5ub3VuY2UK

--===============7986022916067865731==--
Pro-Linux
Pro-Linux @Facebook
Neue Nachrichten
Werbung