Re: CVE-2020-11984: Apache httpd: mod_uwsgi buffer overlow

                							

                <!--X-Body-Begin-->
<!--X-User-Header-->

oss-sec
mailing list archives
<!--X-User-Header-End-->
<!--X-TopPNI-->

By Date

By Thread

</form>

<!--X-TopPNI-End-->
<!--X-MsgBody-->
<!--X-Subject-Header-Begin-->
Re: CVE-2020-11984: Apache httpd: mod_uwsgi buffer overlow

<!--X-Subject-Header-End-->
<!--X-Head-of-Message-->

From: Daniel Ruggeri &lt;druggeri () apache org&gt;

Date: Sat, 8 Aug 2020 07:21:35 -0500

<!--X-Head-of-Message-End-->
<!--X-Head-Body-Sep-Begin-->

<!--X-Head-Body-Sep-End-->
<!--X-Body-of-Message-->

On 8/7/2020 8:20 PM, Seth Arnold wrote:
On Fri, Aug 07, 2020 at 06:31:38AM -0500, Daniel Ruggeri wrote:
CVE-2020-11984: mod_uwsgi buffer overlow
Versions Affected:
httpd 2.4.32 to 2.4.44
Description:
Apache HTTP Server 2.4.32 to 2.4.44
mod_proxy_uwsgi info disclosure and possible RCE
References:
https://httpd.apache.org/security/vulnerabilities_24.html
Hello Daniel, all,

I'm confused: this english description of affected versions
reads like 2.4.44 is affected. However, there is a heading on the
vulnerabilities_24.html page that says this CVE is fixed in 2.4.44.
Hi, Seth;

&nbsp;&nbsp; You're correct. That was an error on our part. We try to double check
this data (since sometimes we burn a release number as we test the
candidate) and things can get out of sync. I have it in my personal TODO
list to add some tooling around automating this particular part of the
release management process.

I've fixed this in a recent patch and the the site should now show the
correct data - many thanks for the correction

Many projects include a "fixed in versions ..." list to indicate when
something is fixed; I think this is less ambiguous.

The "affects versions" don't always line up with the heading that claims
to be fixed, eg CVE-2019-10092 claims to be fixed in 2.4.41, but the
Affects entry doesn't mention 2.4.40.

Right - sometimes this will happen when we don't release a version. This
particular example is because 2.4.40 was not released (see below for a
bit more info).

The headings are out of order:

$ curl -sq https://httpd.apache.org/security/vulnerabilities_24.html | grep "Fixed in Apache"
Fixed in Apache httpd 2.4.44&lt;/h1&gt;&lt;dl&gt;
Fixed in Apache httpd 2.4.25&lt;/h1&gt;&lt;dl&gt;  # 2.4.25 is between 2.4.42 and 2.4.44
Fixed in Apache httpd 2.4.42&lt;/h1&gt;&lt;dl&gt;
Fixed in Apache httpd 2.4.41&lt;/h1&gt;&lt;dl&gt;
Fixed in Apache httpd 2.4.39&lt;/h1&gt;&lt;dl&gt;
[..]

No problem - I thought about this as I was putting together the
announcement but didn't adjust it at the time. I've fixed this as well

The download site doesn't have a 2.4.40 download:
https://archive.apache.org/dist/httpd/

But the CHANGES_2.4.41 file shows a 2.4.40 release:
https://archive.apache.org/dist/httpd/CHANGES_2.4.41

Correct - 2.4.40 was not released. We made a number of changes leading
up to it, but ultimately found an issue in the release candidate that we
fixed between then and a release that we were comfortable with.

If you're interested, you can see a bit more history (and even what's
coming in future release) by taking a look at this file:
http://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x/STATUS

We always note when we tag a release and then the final release date for
every version. You can find similar files for the old 2.2, 2.0, and 1.3
branches too.

I don't actually care that much about CVE-2019-10092 -- I just tried to
figure out the status of CVE-2020-11984 by looking at other examples on
the page and found the page difficult to understand.

And, something is a bit off with the CURRENT-IS-$version markers:

$ curl -sq https://archive.apache.org/dist/httpd/ | grep -c CURRENT
47
I can see how that appears odd. This URL is our archive distribution
point, so anything we release to the formal distribution point will be
added here automatically to preserve history. It's best to use the
current distribution point:
https://dist.apache.org/repos/dist/release/httpd/

We always maintain the zero-length CURRNT-IS-foo file here and remove
non-current releases.

I expected one in each of the 2.0, 2.2, and 2.4 series, or perhaps just
one for the newest 2.4 release.

Thanks

Thanks for taking the time to provide feedback! Have a great weekend

<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->

<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->

By Date

By Thread

Current thread:

CVE-2020-11984: Apache httpd: mod_uwsgi buffer overlow Daniel Ruggeri (Aug 07)

Re: CVE-2020-11984: Apache httpd: mod_uwsgi buffer overlow Solar Designer (Aug 07)

Re: CVE-2020-11984: Apache httpd: mod_uwsgi buffer overlow Daniel Ruggeri (Aug 08)

Re: CVE-2020-11984: Apache httpd: mod_uwsgi buffer overlow Solar Designer (Aug 08)
Re: CVE-2020-11984: Apache httpd: mod_uwsgi buffer overlow Joe Orton (Aug 17)

Re: CVE-2020-11984: Apache httpd: mod_uwsgi buffer overlow Seth Arnold (Aug 07)

Re: CVE-2020-11984: Apache httpd: mod_uwsgi buffer overlow Daniel Ruggeri (Aug 08)

Re: CVE-2020-11984: Apache httpd: mod_uwsgi buffer overlow Seth Arnold (Aug 10)

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->