Published: 10/06/2021 Updated: 07/11/2023

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

CVSS v3 Base Score: 7.3 | Impact Score: 3.4 | Exploitability Score: 3.9

VMScore: 607

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team could create one, though some particular compiler and/or compilation option might make it possible, with limited consequences anyway due to the size (a single byte) and the value (zero byte) of the overflow

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache http server
debian debian linux 9.0
debian debian linux 10.0
fedoraproject fedora 34
fedoraproject fedora 35
oracle instantis enterprisetrack 17.1
oracle instantis enterprisetrack 17.2
oracle instantis enterprisetrack 17.3
oracle enterprise manager ops center 12.4.0.0
oracle zfs storage appliance kit 8.8

Synopsis Moderate: httpd:24 security and bug fix update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the httpd:24 module is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated ...

Several vulnerabilities have been found in the Apache HTTP server, which could result in denial of service In addition the implementation of the MergeSlashes option could result in unexpected behaviour For the stable distribution (buster), these problems have been fixed in version 2438-3+deb10u5 We recommend that you upgrade your apache2 packa ...

A flaw was found in Apache httpd The mod_proxy_wstunnel module tunnels non-upgraded connections (CVE-2019-17567) A flaw was found in HTTPd In some Apache HTTP Server versions, unprivileged local users can stop HTTPd on Windows The highest threat from this vulnerability is to system availability (CVE-2020-13938) A flaw was found In Apache httpd ...

In Apache HTTP Server versions 240 to 2446, a specially crafted digest nonce can cause a stack overflow in mod_auth_digest There is no report of this overflow being exploitable, nor the Apache HTTP Server team could create one, though some particular compiler and/or compilation option might make it possible, with limited consequences anyway du ...

oss-sec mailing list archives   By Date By Thread </form>    CVE-2020-35452: Apache httpd: mod_auth_digest possible stack overflow by one nul byte  <!--X-Head-o ...

CWE-787 http://httpd.apache.org/security/vulnerabilities_24.html https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E http://www.openwall.com/lists/oss-security/2021/06/10/5 https://security.netapp.com/advisory/ntap-20210702-0001/https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html https://www.debian.org/security/2021/dsa-4937 https://security.gentoo.org/glsa/202107-38 https://www.oracle.com/security-alerts/cpuoct2021.html https://lists.apache.org/thread.html/rccb1b8225583a48c6360edc7a93cc97ae8b0215791e455dc607e7602%40%3Cannounce.httpd.apache.org%3E https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd%40%3Cdev.httpd.apache.org%3E https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/https://access.redhat.com/errata/RHSA-2022:1915 https://nvd.nist.gov https://www.debian.org/security/2021/dsa-4937

CVE-2020-35452

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Mailing Lists

References

Vulmon Search

About

Products

Connect