Several vulnerabilities have been found in the Apache HTTPD server.

  - CVE-2019-9517     Jonathan Looney reported that a malicious client could     perform a denial of service attack (exhausting h2     workers) by flooding a connection with requests and     basically never reading responses on the TCP connection.

  - CVE-2019-10081     Craig Young reported that HTTP/2 PUSHes could lead to an     overwrite of memory in the pushing request's pool,     leading to crashes.

  - CVE-2019-10082     Craig Young reported that the HTTP/2 session handling     could be made to read memory after being freed, during     connection shutdown.

  - CVE-2019-10092     Matei 'Mal' Badanoiu reported a limited cross-site     scripting vulnerability in the mod_proxy error page.

  - CVE-2019-10097     Daniel McCarney reported that when mod_remoteip was     configured to use a trusted intermediary proxy server     using the 'PROXY' protocol, a specially crafted PROXY     header could trigger a stack buffer overflow or NULL     pointer deference. This vulnerability could only be     triggered by a trusted proxy and not by untrusted HTTP     clients. The issue does not affect the stretch release.

  - CVE-2019-10098     Yukitsugu Sasaki reported a potential open redirect     vulnerability in the mod_rewrite module.

This update for apache2 fixes the following issues :

Security issues fixed :

CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to unconstrained interal data buffering (bsc#1145575).

CVE-2019-10081: Fixed mod_http2 that is vulnerable to memory corruption on early pushes (bsc#1145742).

CVE-2019-10082: Fixed mod_http2 that is vulnerable to read-after-free in h2 connection shutdown (bsc#1145741).

CVE-2019-10092: Fixed limited cross-site scripting in mod_proxy (bsc#1145740).

CVE-2019-10098: Fixed mod_rewrite configuration vulnerablility to open redirect (bsc#1145738).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4751 advisory.

    The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

    The following packages have been upgraded to a later upstream version: mod_http2 (1.15.7). (BZ#1814236)

    Security Fix(es):

    * httpd: memory corruption on early pushes (CVE-2019-10081)

    * httpd: read-after-free in h2 connection shutdown (CVE-2019-10082)

    * httpd: null-pointer dereference in mod_remoteip (CVE-2019-10097)

    * httpd: mod_rewrite configurations vulnerable to open redirect (CVE-2020-1927)

    * httpd: mod_http2: DoS via slow, unneeded request bodies (CVE-2018-17189)

    * httpd: mod_http2: read-after-free on a string compare (CVE-2019-0196)

    * httpd: mod_http2: possible crash on late upgrade (CVE-2019-0197)

    * httpd: limited cross-site scripting in mod_proxy error page (CVE-2019-10092)

    * httpd: mod_rewrite potential open redirect (CVE-2019-10098)

    * httpd: mod_proxy_ftp use of uninitialized value (CVE-2020-1934)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the httpd packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - In Apache HTTP Server 2.4 release 2.4.37 and prior,     mod_session checks the session expiry time before     decoding the session. This causes session expiry time     to be ignored for mod_session_cookie sessions since the     expiry time is loaded when the session is     decoded.(CVE-2018-17199)

  - In Apache HTTP Server 2.4.18-2.4.39, using fuzzed     network input, the http/2 session handling could be     made to read memory after being freed, during     connection shutdown.(CVE-2019-10082)

  - HTTP/2 (2.4.20 through 2.4.39) very early pushes, for     example configured with 'H2PushResource', could lead to     an overwrite of memory in the pushing request's pool,     leading to crashes. The memory copied is that of the     configured push link header values, not data supplied     by the client.(CVE-2019-10081)

  - Some HTTP/2 implementations are vulnerable to     unconstrained interal data buffering, potentially     leading to a denial of service. The attacker opens the     HTTP/2 window so the peer can send without constraint     however, they leave the TCP window closed so the peer     cannot actually write (many of) the bytes on the wire.
    The attacker then sends a stream of requests for a     large response object. Depending on how the servers     queue the responses, this can consume excess memory,     CPU, or both.(CVE-2019-9517)

  - In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip     was configured to use a trusted intermediary proxy     server using the 'PROXY' protocol, a specially crafted     PROXY header could trigger a stack buffer overflow or     NULL pointer deference. This vulnerability could only     be triggered by a trusted proxy and not by untrusted     HTTP clients.(CVE-2019-10097)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Apache httpd、mod_http2 中发现漏洞。在某些情况下，HTTP/2 过早推送可能导致内存损坏，造成服务器崩溃。(CVE-2019-10081)

Apache httpd、mod_http2 中发现释放后读取漏洞。特制的 http/2 客户端会话可能导致服务器在连接关闭期间读取之前释放的内存，可能导致崩溃。(CVE-2019-10082) 

在 Apache httpd 中发现跨站脚本漏洞，影响 mod_proxy 错误页面。在某些情况下，特制的链接可将内容注入错误页面显示的 HTML 中，可能导致客户端侧的漏洞利用。(CVE-2019-10092) 

Apache httpd、mod_remoteip 中发现一个漏洞。使用“代理”协议的受信任代理可发送特制的标头，造成 httpd 出现堆栈缓冲区溢出或空指针取消引用，导致崩溃或其他潜在后果。\n\n此问题仅能由配置的受信任中间代理服务器利用。HTTP 客户端（例如浏览器）无法利用此漏洞。(CVE-2019-10097)

Apache httpd、mod_rewrite 中发现一个漏洞。
某些自引用 mod_rewrite 规则可能被编码的换行符欺骗，导致其重定向至异常位置。攻击者可在钓鱼攻击或作为浏览器客户端攻击的一部分滥用此缺陷。(CVE-2019-10098)

一些 HTTP/2 实施容易受到不受限制的内部数据缓冲攻击，可能导致拒绝服务。攻击者打开 HTTP/2 窗口以便对等机可以不受限制地发送；但是它们会使 TCP 窗口关闭，因此对等机实际无法在线路上写入（许多）字节。然后，攻击者会针对大型响应对象发送请求流。根据服务器如何排序响应，这可能会消耗过多内存、CPU 或两者。(CVE-2019-9517)

远程 Redhat Enterprise Linux 6 / 7 主机上安装的程序包受到 RHSA-2020: 1337 公告中提及的多个漏洞的影响。

  - httpd：早期推送中的内存损坏 (CVE-2019-10081)

  - httpd：h2 连接关闭中的释放后读取 (CVE-2019-10082)

  - httpd：mod_proxy 错误页面中的有限跨站脚本 (CVE-2019-10092)

  - httpd：mod_remoteip 中的空指针取消引用 (CVE-2019-10097)

  - httpd：mod_rewrite 中可能存在开放重定向 (CVE-2019-10098)

  - openssl：边信道弱加密漏洞 (CVE-2019-1547)

  - openssl：fork() 中存在信息泄露 (CVE-2019-1549)

  - openssl：PKCS7_dataDecode 和 CMS_decrypt_set1_pkey 中存在信息泄露 (CVE-2019-1563)

  - httpd：mod_rewrite 配置容易受到开放重定向的影响 (CVE-2020-1927)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

Stefan Eissing 发现，Apache 中的 HTTP/2 实现在某些情况下未正确处理从 HTTP/1.1 到 HTTP/2 的升级请求。远程攻击者可利用此问题造成拒绝服务（守护程序崩溃）。此问题仅影响 Ubuntu 18.04 LTS 和 Ubuntu 19.04。(CVE-2019-0197)

Craig Young 发现，在某些情况下执行 HTTP/2 过早推送时，Apache 中存在一个内存覆盖错误。远程攻击者可利用此问题造成拒绝服务（守护程序崩溃）。
此问题仅影响 Ubuntu 18.04 LTS 和 Ubuntu 19.04。
(CVE-2019-10081)

Craig Young 发现，在连接关闭期间，Apache 中的 HTTP/2 实现中存在一个释放后读取错误。远程攻击者可能利用此问题造成拒绝服务（守护程序崩溃），或可能泄露敏感信息。此问题仅影响 Ubuntu 18.04 LTS 和 Ubuntu 19.04。(CVE-2019-10082)

Matei Badanoiu 发现，报告某些配置中的错误时，Apache 的 mod_proxy 组件未正确过滤 URL。
远程攻击者可能利用此问题进行跨站脚本 (XSS) 攻击。(CVE-2019-10092)

Daniel McCarney 发现，在某些情况下，解析来自受信任的中介代理标头时，Apache 的 mod_remoteip 组件包含堆栈缓冲区溢出。控制受信任代理的远程攻击者可利用此问题造成拒绝服务或可能执行任意代码。此问题仅影响 Ubuntu 19.04。
(CVE-2019-10097)

Yukitsugu Sasaki 发现，Apache 中的 mod_rewrite 组件在某些情况下易受到开放重定向攻击。远程攻击者可能利用此问题泄露敏感信息或绕过预期限制。(CVE-2019-10098)

Jonathan Looney 发现，Apache 中的 HTTP/2 实现在某些情况下未正确限制客户端连接缓冲数量。远程攻击者可利用此问题造成拒绝服务（无响应守护程序）。此问题仅影响 Ubuntu 18.04 LTS 和 Ubuntu 19.04。(CVE-2019-9517)

请注意，Tenable Network Security 已直接从 Ubuntu 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下，尽可能进行自动清理和排版。

远程 Redhat Enterprise Linux 8 主机上安装的程序包受到 RHSA-2020: 4751 公告中提及的多个漏洞的影响。

  - httpd：mod_http2: 通过缓慢、多余的请求正文造成 DoS (CVE-2018-17189)

  - httpd：mod_http2: 字符串比较的释放后读取 (CVE-2019-0196)

  - httpd：mod_http2: 最近更新的可能崩溃 (CVE-2019-0197)

  - httpd：早期推送中的内存损坏 (CVE-2019-10081)

  - httpd：h2 连接关闭中的释放后读取 (CVE-2019-10082)

  - httpd：mod_proxy 错误页面中的有限跨站脚本 (CVE-2019-10092)

  - httpd：mod_remoteip 中的空指针取消引用 (CVE-2019-10097)

  - httpd：mod_rewrite 中可能存在开放重定向 (CVE-2019-10098)

  - httpd：mod_rewrite 配置容易受到开放重定向的影响 (CVE-2020-1927)

  - httpd：mod_proxy_ftp 可使用未初始化值 (CVE-2020-1934)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

已发现 Apache HTTPD 服务器中存在多个漏洞。- CVE-2019-9517 Jonathan Looney 报告，恶意客户端可能会通过请求占满连接，且基本上从不读取 TCP 连接的响应，从而发动拒绝服务攻击（耗尽 h2 工作进程）。- CVE-2019-10081 Craig Young 报告，HTTP/2 PUSH 可能会造成推送请求池中内存覆写过度写入，从而导致崩溃。- CVE-2019-10082 Craig Young 报告，在连接关闭时，HTTP/2 会话处理可能会被用于读取释放后的内存。- CVE-2019-10092 Matei 'Mal' Badanoiu 报告，mod_proxy 错误页面中存在有限的跨站脚本漏洞。- CVE-2019-10097 Daniel McCarney 报告，当 mod_remoteip 配置为使用受信任的使用“PROXY”协议的中介代理服务器时，特别构建的 PROXY 标头可能会触发堆栈缓冲区溢出或空指针取消引用。此漏洞只能通过受信任的代理触发，而不能通过不受信任的 HTTP 客户端触发。此问题不会影响 stretch 版本。- CVE-2019-10098 Yukitsugu Sasaki 报告，mod_rewrite 模块中可能存在开放重定向漏洞。

ID	Name	Product	Family	Published	Updated	Severity
128182	Debian DSA-4509-1 : apache2 - security update (Internal Data Buffering)	Nessus	Debian Local Security Checks	8/27/2019	12/6/2022	critical
128612	SUSE SLES12 Security Update : apache2 (SUSE-SU-2019:2329-1) (Internal Data Buffering)	Nessus	SuSE Local Security Checks	9/9/2019	12/5/2022	critical
142397	RHEL 8 : httpd:2.4 (RHSA-2020:4751)	Nessus	Red Hat Local Security Checks	11/4/2020	6/3/2024	critical
135146	EulerOS Virtualization for ARM 64 3.0.6.0 : httpd (EulerOS-SA-2020-1359)	Nessus	Huawei Local Security Checks	4/2/2020	3/20/2024	critical
130281	Amazon Linux AMI：httpd24 (ALAS-2019-1311)（内部数据缓冲）	Nessus	Amazon Linux Local Security Checks	10/28/2019	12/6/2022	critical
135235	RHEL 6/7：Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP2 (RHSA-2020: 1337)	Nessus	Red Hat Local Security Checks	4/6/2020	4/28/2024	critical
128412	Ubuntu 16.04 LTS / 18.04 LTS：Apache HTTP Server 漏洞 (USN-4113-1)	Nessus	Ubuntu Local Security Checks	8/30/2019	8/27/2024	critical
142397	RHEL 8：httpd：2.4 (RHSA-2020: 4751)	Nessus	Red Hat Local Security Checks	11/4/2020	6/3/2024	critical
128182	Debian DSA-4509-1：apache2 - 安全更新（内部数据缓冲）	Nessus	Debian Local Security Checks	8/27/2019	12/6/2022	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical