Login
Newsletter
Werbung

Sicherheit: Mehrere Probleme in Apache (Aktualisierung)
Aktuelle Meldungen Distributionen
Name: Mehrere Probleme in Apache (Aktualisierung)
ID: USN-4994-2
Distribution: Ubuntu
Plattformen: Ubuntu 14.04 ESM, Ubuntu 16.04 ESM
Datum: Di, 22. Juni 2021, 07:48
Referenzen: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26690
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26691
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-35452
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30641
Applikationen: Apache
Update von: Mehrere Probleme in Apache

Originalnachricht


--===============6750286334171789936==
Content-Type: multipart/signed; micalg=pgp-sha512;
protocol="application/pgp-signature";
boundary="bp/iNruPH9dso1Pn"
Content-Disposition: inline


--bp/iNruPH9dso1Pn
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

==========================================================================
Ubuntu Security Notice USN-4994-2
June 21, 2021

apache2 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 16.04 ESM
- Ubuntu 14.04 ESM

Summary:

Several security issues were fixed in Apache HTTP Server.

Software Description:
- apache2: Apache HTTP server

Details:

USN-4994-1 fixed several vulnerabilities in Apache. This update provides
the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.

Original advisory details:

Antonio Morales discovered that the Apache mod_auth_digest module
incorrectly handled certain Digest nonces. A remote attacker could possibly
use this issue to cause Apache to crash, resulting in a denial of service.
(CVE-2020-35452)

Antonio Morales discovered that the Apache mod_session module incorrectly
handled certain Cookie headers. A remote attacker could possibly use this
issue to cause Apache to crash, resulting in a denial of service.
(CVE-2021-26690)

Christophe Jaillet discovered that the Apache mod_session module
incorrectly handled certain SessionHeader values. A remote attacker could
use this issue to cause Apache to crash, resulting in a denial of service,
or possibly execute arbitrary code. (CVE-2021-26691)

Christoph Anton Mitterer discovered that the new MergeSlashes configuration
option resulted in unexpected behaviour in certain situations.
(CVE-2021-30641)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 ESM:
apache2 2.4.18-2ubuntu3.17+esm1
apache2-bin 2.4.18-2ubuntu3.17+esm1

Ubuntu 14.04 ESM:
apache2 2.4.7-1ubuntu4.22+esm1
apache2-bin 2.4.7-1ubuntu4.22+esm1

In general, a standard system update will make all the necessary changes.

References:
https://ubuntu.com/security/notices/USN-4994-2
https://ubuntu.com/security/notices/USN-4994-1
CVE-2020-35452, CVE-2021-26690, CVE-2021-26691, CVE-2021-30641

--bp/iNruPH9dso1Pn
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEf+ebRFcoyOoAQoOeRbznW4QLH2kFAmDQtlcACgkQRbznW4QL
H2li2xAAuaL7GK54C/aVguxbtl3KNJ3/p68cOPIAZOIMVFN4Qulelgg0UEmAPetP
D+wiWY2Hjubkr2B5lVqFnpJijpl07zNVVgghhdUCn36GlgnLizEXUqqG3ErthrPI
LejoFjWdq/AkAuPmLpX+2b7u4GNOA8oyV+D+Der8Lg3aFs4J97UnWCAm50etoUm8
r27dEdT5VP1xeBxsyxO24Sn27bSwOq3q7sBG1L/RiIniE9FTvdOxxcjveyc5kHHm
mTaku6iL5el6EKoURxj6nJLOqSi38KKPmDZep9kgE8Rs7mCssIMZztLttolUVCO+
9FM7eOYsACrkk/Z2V2so6LUtd6aO61UuliRcMyj6FNNKxhN34lmDUsrrnds25cZ3
+UhSjzhbmy82ekVYahivWpuA577CKOsLXgC778GqWKPf62WB/9AOZ0glbi190XUp
vp/0tDNvqvtfRTVPmWx2yIRLC7eOMrzqNd1F1xP/3+qmcUzv2Ty7Rtu539+fpPI0
fqnBpaqRp8MYQZMGrpiX5magojKDpgxtsIPAKk6sKE6yxTOJOmtKJZTjm8BnaGQg
1nZcDAkexVJlPLHXj85J4J/fFsRzbsHZ4u6qkX3oCnqXwmrQZPSzv5HOwuOSPTNn
DOavxLVvIk/2hMgRGWI2YtEGhbi9SYU+i5j0jJIjoGo0DRtR8CE=
=ov1l
-----END PGP SIGNATURE-----

--bp/iNruPH9dso1Pn--


--===============6750286334171789936==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
Pro-Linux
Pro-Linux @Facebook
Neue Nachrichten
Werbung