PT-2020-5483 · Apache+8 · Apache Http Server+8

Published 2020-08-07 · Updated 2025-05-01 · CVE-2020-11993

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.20 through 2.4.43

Description The issue is related to the implementation of the HTTP/2 mechanism in the Apache HTTP Server, which can lead to inconsistent interpretation of HTTP requests. This can cause logging statements to be made on the wrong connection when trace/debug is enabled for the HTTP/2 module and certain traffic edge patterns are encountered, resulting in concurrent use of memory pools. Configuring the LogLevel of mod http2 above "info" can mitigate this issue for unpatched servers.

Recommendations For Apache HTTP Server versions 2.4.20 through 2.4.43, configure the LogLevel of mod http2 above "info" to mitigate the issue. As a temporary workaround, consider restricting the use of the HTTP/2 module until a patch is available.

Exploit

Fix

HTTP Request/Response Smuggling

Resource Exhaustion

Weakness Enumeration

CWE-444

CWE-400

Related Identifiers

ALSA-2021:1809

ALT-PU-2020-2594

ALT-PU-2020-3362

ALT-PU-2021-2035

BDU:2021-00779

BIT-APACHE-2020-11993

CESA-2021_1809

CVE-2020-11993

DSA-4757-1

MGASA-2020-0327

OPENSUSE-SU-2020:1285-1

OPENSUSE-SU-2020:1293-1

OPENSUSE-SU-2020:1792-1

OPENSUSE-SU-2020_1285-1

OPENSUSE-SU-2020_1293-1

OPENSUSE-SU-2020_1792-1

RHSA-2020:4384

RHSA-2021:1809

RHSA-2021_1809

RLSA-2021:1809

SUSE-SU-2020:2311-1

SUSE-SU-2020:2344-1

SUSE-SU-2020:2450-1

SUSE-SU-2020:3067-1

SUSE-SU-2020_3067-1

USN-4458-1

Affected Products

Alt Linux

Almalinux

Apache Http Server

Centos

Linuxmint

Red Hat

Rocky Linux

Suse

Ubuntu

References · 112

• 🔥 http://packetstormsecurity.com/files/160393/Apache-2-HTTP2-Module-Concurrent-Pool-Usage.html · Exploit
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00071.html · Vendor Advisory
• https://lists.apache.org/thread.html/rf71eb428714374a6f9ad68952e23611ec7807b029fd6a1b4f5f732d9%40%3Ccvs.httpd.apache.org%3E · Patch
• https://security-tracker.debian.org/tracker/CVE-2020-11993 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-9490 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/ITVFDBVM6E3JF3O7RYLRPRCH3RDRHJJY · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2020-11993 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00081.html · Vendor Advisory
• https://lists.apache.org/thread.html/r09bb998baee74a2c316446bd1a41ae7f8d7049d09d9ff991471e8775%40%3Ccvs.httpd.apache.org%3E · Patch
• https://lists.apache.org/thread.html/r623de9b2b2433a87f3f3a15900419fc9c00c77b26936dfea4060f672%40%3Cdev.httpd.apache.org%3E · Patch
• https://osv.dev/vulnerability/RLSA-2021:1809 · Vendor Advisory
• https://oracle.com/security-alerts/cpuoct2020.html · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/654734 · Security Note
• https://ubuntu.com/security/notices/USN-4458-1 · Vendor Advisory
• https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-11993 · Vendor Advisory