Most recent entries from all

bdu:2021-06310

Withdrawn: BELL-CVE-2020-13950 — CVE-2020-13950 does not affect BellSoft software

Withdrawn by the publisher.

BIT-apache-2020-13950 — mod_proxy_http NULL pointer dereference

Affected: Bitnami: apache

Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer dereference) with specially crafted requests using both Content-Length and Transfer-Encoding headers, leading to a Denial of Service

certfr-2024-avi-0575 — De multiples vulnérabilités ont été découvertes dans les produits Juniper Networks. Certaines d'entre elles permettent…

certfr-2024-avi-0575

EUVD-2026-42176

fkie_cve-2020-13950

GHSA-pqc6-p826-c5qw

gsd-2020-13950

msrc_CVE-2020-13950 — mod_proxy_http NULL pointer dereference

msrc_CVE-2020-13950

OESA-2021-1246 — httpd security update

Affected: openEuler:20.03-LTS-SP1: httpd

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fix(es): In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow(CVE-2021-26691) Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer dereference) with specially crafted requests using both Content-Length and Transfer-Encoding headers, leading to a Denial of Service(CVE-2020-13950) Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team could create one, though some particular compiler and/or compilation option might make it possible, with limited consequences anyway due to the size (a single byte) and the value (zero byte) of the overflow(CVE-2020-35452)

Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with MergeSlashes OFF(CVE-2021-30641)

openSUSE-SU-2021:0908-1 — Security update for apache2

Security update for apache2

RHSA-2021:4613 — Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP10 security update

httpd: mod_proxy_wstunnel tunneling of non Upgraded connection pcre: Buffer over-read in JIT when UTF is disabled and \X or \R has fixed quantifier greater than 1 httpd: mod_proxy NULL pointer dereference pcre: Integer overflow when parsing callout numeric arguments httpd: Single zero byte stack overflow in mod_auth_digest JBCS: URL normalization issue with dot-dot-semicolon(s) leads to information disclosure openssl: Read buffer overruns processing ASN.1 strings openssl: integer overflow in CipherUpdate openssl: NULL pointer dereference in X509_issuer_and_serial_hash() httpd: mod_session: NULL pointer dereference when parsing Cookie header httpd: mod_session: Heap overflow via a crafted SessionHeader value httpd: Unexpected URL matching with 'MergeSlashes OFF' httpd: NULL pointer dereference via malformed requests

SUSE-SU-2021:2127-1 — Security update for apache2

Security update for apache2

UBUNTU-CVE-2020-13950

Affected: Ubuntu:20.04:LTS: apache2

WID-SEC-W-2022-0438 — Apache HTTP Server: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apache HTTP Server ausnutzen, um einen Denial of Service Angriff durchzuführen, Sicherheitsvorkehrungen zu umgehen oder sonstige Auswirkungen zu verursachen.