PT-2020-5444 · Apache+6 · Apache Http Server+6

Alexander Kornbrust · Published 2020-08-07 · Updated 2024-04-23 · CVE-2020-9490

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.20 through 2.4.43

Description The issue is related to the implementation of the HTTP/2 mechanism in the Apache HTTP Server, which is associated with inconsistent interpretation of HTTP requests. This can allow a remote attacker to cause a denial of service. A specially crafted value for the Cache-Digest header in a HTTP/2 request would result in a crash when the server tries to HTTP/2 PUSH a resource afterwards.

Recommendations For Apache HTTP Server versions 2.4.20 through 2.4.43, configuring the HTTP/2 feature via "H2Push off" will mitigate this issue for unpatched servers. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

HTTP Request/Response Smuggling

Resource Exhaustion

Weakness Enumeration

CWE-444

CWE-400

Related Identifiers

ALT-PU-2020-2594

ALT-PU-2020-3362

ALT-PU-2021-2035

BDU:2021-00585

BIT-APACHE-2020-9490

CESA-2020_3714

CVE-2020-9490

DSA-4757-1

MGASA-2020-0327

OPENSUSE-SU-2020:1285-1

OPENSUSE-SU-2020:1293-1

OPENSUSE-SU-2020:1792-1

OPENSUSE-SU-2020_1285-1

OPENSUSE-SU-2020_1293-1

OPENSUSE-SU-2020_1792-1

RHSA-2020:3714

RHSA-2020:3726

RHSA-2020:3733

RHSA-2020:3734

RHSA-2020_3714

SUSE-SU-2020:2311-1

SUSE-SU-2020:2344-1

SUSE-SU-2020:2450-1

SUSE-SU-2020:3067-1

USN-4458-1

Affected Products

Alt Linux

Apache Http Server

Centos

Linuxmint

Red Hat

Suse

Ubuntu

References · 98

• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00071.html · Vendor Advisory
• https://oracle.com/security-alerts/cpujan2021.html · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-9490 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-apache-2020-9490 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-9490 · Vendor Advisory
• https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-9490 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/ITVFDBVM6E3JF3O7RYLRPRCH3RDRHJJY · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9490 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00081.html · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/654734 · Security Note
• https://ubuntu.com/security/notices/USN-4458-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0327.html · Security Note
• https://cve.org/CVERecord?id=CVE-2020-9490 · Security Note
• https://ubuntu.com/security/CVE-2020-11984 · Vendor Advisory
• https://debian.org/security/2020/dsa-4757 · Vendor Advisory