Веб-серверы: уязвимости стека · Страница 12

ap_escape_quotes buffer overflow

ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.

• Обновитесь до 2.4.18-2ubuntu3.17+esm2
• Обновитесь до 2.4.29-1ubuntu4.17
• Обновитесь до 2.4.41-4ubuntu3.5
• Обновитесь до 2.4.49-1
• Обновитесь до 2.4.7-1ubuntu4.22+esm2

mod_proxy_uwsgi out of bound read

A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 (inclusive).

• Обновитесь до 2.4.41-4ubuntu3.5
• Обновитесь до 2.4.49-1

NULL pointer dereference in httpd core

Malformed requests may cause the server to dereference a NULL pointer. This issue affects Apache HTTP Server 2.4.48 and earlier.

• Обновитесь до 2.4.18-2ubuntu3.17+esm2
• Обновитесь до 2.4.29-1ubuntu4.17
• Обновитесь до 2.4.41-4ubuntu3.5
• Обновитесь до 2.4.49-1
• Обновитесь до 2.4.7-1ubuntu4.22+esm2

Request splitting via HTTP/2 method injection and mod_proxy

A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.

• Обновитесь до 2.4.29-1ubuntu4.17
• Обновитесь до 2.4.41-4ubuntu3.5
• Обновитесь до 2.4.48-4

Drop Headers via Malicious Connection Header

Traefik is an HTTP reverse proxy and load balancer. Prior to version 2.4.13, there exists a potential header vulnerability in Traefik's handling of the Connection header. Active exploitation of this issue is unlikely, as it requires that a removed header would lead to a privilege escalation, however, the Traefik team has addressed this issue to prevent any potential abuse. If one has a chain of Traefik middlewares, and one of them sets a request header, then sending a request with a certain Connection header will cause it to be removed before the request is sent. In this case, the backend does not see the request header. A patch is available

NULL pointer dereference on specially crafted HTTP/2 request

Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. On violation of these restrictions and HTTP response is sent to the client with a status code indicating why the request was rejected. This rejection response was not fully initialised in the HTTP/2 protocol handler if the offending header was the very first one received or appeared in a a footer. This led to a NULL pointer dereference on initialised memory, crashing reliably the child process. Since such a triggering HTTP/2 request is easy to craft and

• Обновитесь до 2.4.46-5

Unexpected URL matching with 'MergeSlashes OFF'

Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'

• Обновитесь до 2.4.18-2ubuntu3.17+esm1
• Обновитесь до 2.4.29-1ubuntu4.16
• Обновитесь до 2.4.41-4ubuntu3.3
• Обновитесь до 2.4.46-6
• Обновитесь до 2.4.7-1ubuntu4.22+esm1

Apache HTTP Server mod_session response handling heap overflow

In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow

• Обновитесь до 2.4.18-2ubuntu3.17+esm1
• Обновитесь до 2.4.29-1ubuntu4.16
• Обновитесь до 2.4.41-4ubuntu3.3
• Обновитесь до 2.4.46-6
• Обновитесь до 2.4.7-1ubuntu4.22+esm1

mod_session NULL pointer dereference

Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service

• Обновитесь до 2.4.18-2ubuntu3.17+esm1
• Обновитесь до 2.4.29-1ubuntu4.16
• Обновитесь до 2.4.41-4ubuntu3.3
• Обновитесь до 2.4.46-6
• Обновитесь до 2.4.7-1ubuntu4.22+esm1

mod_auth_digest possible stack overflow by one nul byte

Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team could create one, though some particular compiler and/or compilation option might make it possible, with limited consequences anyway due to the size (a single byte) and the value (zero byte) of the overflow

• Обновитесь до 2.4.18-2ubuntu3.17+esm1
• Обновитесь до 2.4.29-1ubuntu4.16
• Обновитесь до 2.4.41-4ubuntu3.3
• Обновитесь до 2.4.46-6
• Обновитесь до 2.4.7-1ubuntu4.22+esm1

mod_proxy_http NULL pointer dereference

Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer dereference) with specially crafted requests using both Content-Length and Transfer-Encoding headers, leading to a Denial of Service

• Обновитесь до 2.4.41-4ubuntu3.3
• Обновитесь до 2.4.46-6

Improper Handling of Insufficient Privileges

Apache HTTP Server versions 2.4.0 to 2.4.46 Unprivileged local users can stop httpd on Windows

mod_proxy_wstunnel tunneling of non Upgraded connections

Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the whole connection regardless, thus allowing for subsequent requests on the same connection to pass through with no HTTP validation, authentication or authorization possibly configured.

• Обновитесь до 2.4.48-2

CVE-2011-4968

nginx http proxy module does not verify peer identity of https origin server which could facilitate man-in-the-middle attack (MITM)

• Обновитесь до 1.9.1-1

CVE-2019-0197

A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set "H2Upgrade on" are unaffected by this issue.

• Обновитесь до 2.4.29-1ubuntu4.10
• Обновитесь до 2.4.38-3

CVE-2019-0196

A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly.

• Обновитесь до 2.4.29-1ubuntu4.6
• Обновитесь до 2.4.38-3

CVE-2019-0220

A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes ('/'), directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects of the servers processing will implicitly collapse them.

• Обновитесь до 2.4.18-2ubuntu3.10
• Обновитесь до 2.4.29-1ubuntu4.6
• Обновитесь до 2.4.38-3
• Обновитесь до 2.4.7-1ubuntu4.22

CVE-2019-0190

A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request that would cause mod_ssl to enter a loop leading to a denial of service. This bug can be only triggered with Apache HTTP Server version 2.4.37 when using OpenSSL version 1.1.1 or later, due to an interaction in changes to handling of renegotiation attempts.

• Обновитесь до 2.4.38-1

CVE-2018-17199

In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since the expiry time is loaded when the session is decoded.

• Обновитесь до 2.4.18-2ubuntu3.10
• Обновитесь до 2.4.29-1ubuntu4.6
• Обновитесь до 2.4.38-1
• Обновитесь до 2.4.7-1ubuntu4.22

CVE-2018-17189

In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections.

• Обновитесь до 2.4.29-1ubuntu4.6
• Обновитесь до 2.4.38-1