Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 330

Export CSV
CVE-2020-35452

mod_auth_digest possible stack overflow by one nul byte

Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team could create one, though some particular compiler and/or compilation option might make it possible, with limited consequences anyway due to the size (a single byte) and the value (zero byte) of the overflow

CVSS 3.1 · 7.3 High EPSS 53.2% KEV · Not listed
Vendors
Apache Debian Fedoraproject and 2 more
Products
Http Server Debian Linux Fedora and 5 more
CVE-2020-25680

httpd: allow connecting via SSL to a backend worker when the backend keystore file's ID is 'unknown'

A flaw was found in JBCS httpd in version 2.4.37 SP3, where it uses a back-end worker SSL certificate with the keystore file's ID is 'unknown'. The validation of the certificate whether CN and hostname are matching stopped working and allow connecting to the back-end work. The highest threat from this vulnerability is to data integrity.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Core Services Jboss Core Services Httpd
CVE-2020-1927

httpd: mod_rewrite configurations vulnerable to open redirect

In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL.

CVSS 3.1 · 6.1 Medium EPSS 56.7% KEV · Not listed
Vendors
Apache Broadcom Canonical and 6 more
Products
Http Server Brocade Fabric Operating System Ubuntu Linux and 14 more
CVE-2020-13950

mod_proxy_http NULL pointer dereference

Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer dereference) with specially crafted requests using both Content-Length and Transfer-Encoding headers, leading to a Denial of Service

CVSS 3.1 · 7.5 High EPSS 50.0% KEV · Not listed
Vendors
Apache Debian Fedoraproject and 2 more
Products
Http Server Debian Linux Fedora and 5 more
CVE-2019-1549

Fork Protection

OpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).

CVSS 3.1 · 5.3 Medium EPSS 6.2% KEV · Not listed
Vendors
Openssl Redhat
Products
Openssl Enterprise Linux Jboss Core Services
CVE-2019-1547

ECDSA remote timing attack

Normally in OpenSSL EC groups always have a co-factor present and this is used in side channel resistant code paths. However, in some cases, it is possible to construct a group using explicit parameters (instead of using a named curve). In those cases it is possible that such a group does not have the cofactor present. This can occur even where all the parameters match a known named curve. If such a curve is used then OpenSSL falls back to non-side channel resistant code paths which may result in full key recovery during an ECDSA signature operation. In order to be vulnerable an attacker would have to have the ability to time the creation of a large number of signatures where explicit parameters with no co-factor present are in use by an application using libcrypto. For the avoidance of doubt libssl is not vulnerable because explicit parameters are never used. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).

CVSS 3.1 · 4.7 Medium EPSS 1.1% KEV · Not listed
Vendors
Openssl Redhat
Products
Openssl Enterprise Linux Jboss Core Services
CVE-2019-17567

mod_proxy_wstunnel tunneling of non Upgraded connections

Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the whole connection regardless, thus allowing for subsequent requests on the same connection to pass through with no HTTP validation, authentication or authorization possibly configured.

CVSS 3.1 · 5.3 Medium EPSS 59.7% KEV · Not listed
Vendors
Apache Fedoraproject Oracle and 1 more
Products
Http Server Fedora Enterprise Manager Ops Center and 3 more
CVE-2019-10098

httpd: mod_rewrite potential open redirect

In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL.

CVSS 3.1 · 6.1 Medium EPSS 74.0% KEV · Not listed
Vendors
Apache Redhat
Products
Http Server Enterprise Linux Jboss Core Services and 1 more
CVE-2019-10097

httpd: null-pointer dereference in mod_remoteip

In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could trigger a stack buffer overflow or NULL pointer deference. This vulnerability could only be triggered by a trusted proxy and not by untrusted HTTP clients.

CVSS 3.1 · 7.2 High EPSS 52.9% KEV · Not listed
Vendors
Apache Oracle Redhat
Products
Http Server Communications Element Manager Communications Session Report Manager and 8 more
CVE-2019-10092

httpd: limited cross-site scripting in mod_proxy error page

In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed.

CVSS 3.1 · 6.1 Medium EPSS 81.5% KEV · Not listed
Vendors
Apache Canonical Debian and 5 more
Products
Http Server Ubuntu Linux Debian Linux and 10 more
CVE-2019-10081

httpd: memory corruption on early pushes

HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client.

CVSS 3.0 · 7.5 High EPSS 14.0% KEV · Not listed
Vendors
Apache Debian Redhat
Products
Http Server Debian Linux Enterprise Linux and 1 more
CVE-2019-0220

httpd: URL normalization inconsistency

A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes ('/'), directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects of the servers processing will implicitly collapse them.

CVSS 3.0 · 5.3 Medium EPSS 17.9% KEV · Not listed
Vendors
Apache Canonical Debian and 3 more
Products
Http Server Ubuntu Linux Debian Linux and 5 more
CVE-2019-0217

httpd: mod_auth_digest: access control bypass due to race condition

In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.

CVSS 3.1 · 7.5 High EPSS 16.4% KEV · Not listed
Vendors
Apache Canonical Debian and 5 more
Products
Http Server Ubuntu Linux Debian Linux and 13 more
CVE-2019-0197

httpd: mod_http2: possible crash on late upgrade

A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set "H2Upgrade on" are unaffected by this issue.

CVSS 3.1 · 4.2 Medium EPSS 8.3% KEV · Not listed
Vendors
Apache Canonical Fedoraproject and 3 more
Products
Http Server Ubuntu Linux Fedora and 9 more
CVE-2019-0196

httpd: mod_http2: read-after-free on a string compare

A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly.

CVSS 3.0 · 5.3 Medium EPSS 19.3% KEV · Not listed
Vendors
Apache Canonical Debian and 1 more
Products
Http Server Ubuntu Linux Debian Linux and 2 more
CVE-2018-1333

DoS for HTTP/2 connections by crafted requests

By specially crafting HTTP/2 requests, workers would be allocated 60 seconds longer than necessary, leading to worker exhaustion and a denial of service. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.18-2.4.30,2.4.33).

CVSS 3.0 · 7.5 High EPSS 17.0% KEV · Not listed
Vendors
Apache Canonical Netapp and 1 more
Products
Http Server Ubuntu Linux Cloud Backup and 4 more
CVE-2018-1323

isapi_redirect: Mishandled HTTP request paths in jk_isapi_plugin.c can lead to unintended exposure of application resources via the reverse proxy

The IIS/ISAPI specific code in the Apache Tomcat JK ISAPI Connector 1.2.0 to 1.2.42 that normalised the requested path before matching it to the URI-worker map did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via IIS, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing Tomcat via the reverse proxy.

CVSS 3.0 · 7.5 High EPSS 46.4% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Jk Connector Jboss Core Services