SB2020110431 - Red Hat Enterprise Linux 8 update for the httpd:2.4 module
Published: November 4, 2020
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 10 secuirty vulnerabilities.
1) Input validation error (CVE-ID: CVE-2018-17189)
The vulnerability allows a remote attacker to cause DoS condition on the target system.The weakness exists due to an error when handling malicious input. A remote attacker can send a specially crafted request bodies in a slow loris way to plain resources and cause the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data.
2) Use-after-free (CVE-ID: CVE-2019-0196)
The vulnerability allows a remote attacker to perform denial of service attack.
The vulnerability exists due to a use-after-free error within the mod_http2 module when processing HTTP/2 requests. A remote attacker can make the application to access freed memory during string comparison when determining the method of a request and process the request incorrectly.
Successful exploitation of the vulnerability may allow an attacker to gain access to sensitive information or perform a denial of service attack.
3) Resource management error (CVE-ID: CVE-2019-0197)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to an error within the mod_http2 module when processing update requests from http/1.1 to http/2, if this was not the first request on a connection. A remote attacker can send specially crafted requests to the affected server and perform denial of service attack.
Successful exploitation of the vulnerability requires that HTTP/2 protocol is enabled for a "http:" host or H2Upgrade is enabled for h2 on a "https:" host.
4) Out-of-bounds write (CVE-ID: CVE-2019-10081)
The vulnerability allows a remote attacker to perform denial of service attack.
The vulnerability exists due to a boundary error when processing HTTP/2 requests within the mod_http2 module, configured with "H2PushResource". A remote attacker can send specially crafted HTTP/2 requests to the affected server and perform denial of service (DoS) attack.
5) Use-after-free (CVE-ID: CVE-2019-10082)
The vulnerability allows a remote attacker to perform denial of service (DoS) attack.
The vulnerability exists due to a use-after-free error within the mod_http2 when handling connection shutdown. A remote attacker can send specially crafted requests to the affected server and make the mod_http2 to read memory that was already freed.
6) Cross-site scripting (CVE-ID: CVE-2019-10092)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data on the mod_proxy error page. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
7) NULL pointer dereference (CVE-ID: CVE-2019-10097)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error when processing PROXY header within the mod_remoteip. A remote attacker that controls a trusted proxy server can send a specially crafted PROXY header, trigger stack overflow and perform a denial of service (DoS) attack.
8) Input validation error (CVE-ID: CVE-2019-10098)
The vulnerability allows a remote attacker to bypass certain security restrictions.
The vulnerability exists due to incorrect handling of encoded line break characters within rewrite rules. A remote attacker can send a specially crafted HTTP request and potentially bypass security restrictions.
9) Open redirect (CVE-ID: CVE-2020-1927)
The vulnerability allows a remote attacker to redirect victims to arbitrary URL.
The vulnerability exists due to improper sanitization of user-supplied data in some "mod_rewrite" configurations. A remote attacker can create a link that leads to a trusted website, however, when clicked, redirects the victim to arbitrary domain.
Successful exploitation of this vulnerability may allow a remote attacker to perform a phishing attack and steal potentially sensitive information.
10) Use of Uninitialized Variable (CVE-ID: CVE-2020-1934)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to the "mod_proxy_ftp" may use uninitialized memory when proxying to a malicious FTP server. A remote attacker can gain unauthorized access to sensitive information on the target system.
Remediation
Install update from vendor's website.