p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in apache2

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für apache2: 0. Davon im KEV-Katalog: 0.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 52

  1. ALPINE-CVE-2021-42013

    Kritisch · CVSS 9.8Korrektur verfügbar

    ALPINE-CVE-2021-42013

    It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.

    apache2Betriebssysteme
    • Auf 2.4.51-r0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  2. ALPINE-CVE-2021-41773

    Kritisch · CVSS 9.8Korrektur verfügbar

    ALPINE-CVE-2021-41773

    A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42

    apache2Betriebssysteme
    • Auf 2.4.50-r0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  3. ALPINE-CVE-2021-41524

    Hoch · CVSS 7.5Korrektur verfügbar

    ALPINE-CVE-2021-41524

    While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to DoS the server. This requires a specially crafted request. The vulnerability was recently introduced in version 2.4.49. No exploit is known to the project.

    apache2Betriebssysteme
    • Auf 2.4.50-r0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  5. ALPINE-CVE-2021-39275

    Kritisch · CVSS 9.8Korrektur verfügbar

    ALPINE-CVE-2021-39275

    ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.

    apache2Betriebssysteme
    • Auf 2.4.49-r0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  8. ALPINE-CVE-2021-33193

    Hoch · CVSS 7.5Korrektur verfügbar

    ALPINE-CVE-2021-33193

    A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.

    apache2Betriebssysteme
    • Auf 2.4.49-r0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  9. ALPINE-CVE-2021-31618

    Hoch · CVSS 7.5Korrektur verfügbar

    ALPINE-CVE-2021-31618

    Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the client with a status code indicating why the request was rejected. This rejection response was not fully initialised in the HTTP/2 protocol handler if the offending header was the very first one received or appeared in a a footer. This led to a NULL pointer dereference on initialised memory, crashing reliably the child process. Since such a triggering HTTP/2 request is easy to craft and

    apache2Betriebssysteme
    • Auf 2.4.48-r0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  13. ALPINE-CVE-2020-35452

    Hoch · CVSS 7.3Korrektur verfügbar

    ALPINE-CVE-2020-35452

    Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team could create one, though some particular compiler and/or compilation option might make it possible, with limited consequences anyway due to the size (a single byte) and the value (zero byte) of the overflow

    apache2Betriebssysteme
    • Auf 2.4.48-r0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  14. ALPINE-CVE-2020-13950

    Hoch · CVSS 7.5Korrektur verfügbar

    ALPINE-CVE-2020-13950

    Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer dereference) with specially crafted requests using both Content-Length and Transfer-Encoding headers, leading to a Denial of Service

    apache2Betriebssysteme
    • Auf 2.4.48-r0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  16. ALPINE-CVE-2020-9490

    Hoch · CVSS 7.5Korrektur verfügbar

    ALPINE-CVE-2020-9490

    Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via "H2Push off" will mitigate this vulnerability for unpatched servers.

    apache2Betriebssysteme
    • Auf 2.4.46-r0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  17. ALPINE-CVE-2020-11993

    Hoch · CVSS 7.5Korrektur verfügbar

    ALPINE-CVE-2020-11993

    Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were made on the wrong connection, causing concurrent use of memory pools. Configuring the LogLevel of mod_http2 above "info" will mitigate this vulnerability for unpatched servers.

    apache2Betriebssysteme
    • Auf 2.4.46-r0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  19. ALPINE-CVE-2019-17657

    Hoch · CVSS 7.5Korrektur verfügbar

    ALPINE-CVE-2019-17657

    An Uncontrolled Resource Consumption vulnerability in Fortinet FortiSwitch below 3.6.11, 6.0.6 and 6.2.2, FortiAnalyzer below 6.2.3, FortiManager below 6.2.3 and FortiAP-S/W2 below 6.2.2 may allow an attacker to cause admin webUI denial of service (DoS) via handling special crafted HTTP requests/responses in pieces slowly, as demonstrated by Slow HTTP DoS Attacks.

    apache2Betriebssysteme
    • Auf 2.4.48-r0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  20. ALPINE-CVE-2020-1927

    Mittel · CVSS 6.1Korrektur verfügbar

    ALPINE-CVE-2020-1927

    In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL.

    apache2Betriebssysteme
    • Auf 2.4.43-r0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →