csaf_suse - suse-su-2020:1111-1

Vulnerability from csaf_suse

Published

2020-04-24 14:41

Modified

2020-04-24 14:41

Summary

Security update for apache2

Notes

Title of the patch

Security update for apache2

Description of the patch

This update for apache2 fixes the following issues: - CVE-2020-1934: mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server (bsc#1168404). - CVE-2020-1927: mod_rewrite configurations vulnerable to open redirect (bsc#1168407). - CVE-2020-1938: mod_proxy_ajp: Add 'secret' parameter to proxy workers to implement legacy AJP13 authentication (bsc#1169066).

Patchnames

SUSE-2020-1111,SUSE-SLE-SAP-12-SP1-2020-1111,SUSE-SLE-SERVER-12-SP1-2020-1111

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "important",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Security update for apache2",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "This update for apache2 fixes the following issues:\n\n- CVE-2020-1934: mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server (bsc#1168404).\n- CVE-2020-1927: mod_rewrite configurations vulnerable to open redirect (bsc#1168407).\n- CVE-2020-1938: mod_proxy_ajp: Add 'secret' parameter to proxy workers to implement legacy AJP13 authentication (bsc#1169066).\n",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "SUSE-2020-1111,SUSE-SLE-SAP-12-SP1-2020-1111,SUSE-SLE-SERVER-12-SP1-2020-1111",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2020_1111-1.json",
         },
         {
            category: "self",
            summary: "URL for SUSE-SU-2020:1111-1",
            url: "https://www.suse.com/support/update/announcement/2020/suse-su-20201111-1/",
         },
         {
            category: "self",
            summary: "E-Mail link for SUSE-SU-2020:1111-1",
            url: "https://lists.suse.com/pipermail/sle-security-updates/2020-April/006738.html",
         },
         {
            category: "self",
            summary: "SUSE Bug 1168404",
            url: "https://bugzilla.suse.com/1168404",
         },
         {
            category: "self",
            summary: "SUSE Bug 1168407",
            url: "https://bugzilla.suse.com/1168407",
         },
         {
            category: "self",
            summary: "SUSE Bug 1169066",
            url: "https://bugzilla.suse.com/1169066",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-1927 page",
            url: "https://www.suse.com/security/cve/CVE-2020-1927/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-1934 page",
            url: "https://www.suse.com/security/cve/CVE-2020-1934/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2020-1938 page",
            url: "https://www.suse.com/security/cve/CVE-2020-1938/",
         },
      ],
      title: "Security update for apache2",
      tracking: {
         current_release_date: "2020-04-24T14:41:06Z",
         generator: {
            date: "2020-04-24T14:41:06Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "SUSE-SU-2020:1111-1",
         initial_release_date: "2020-04-24T14:41:06Z",
         revision_history: [
            {
               date: "2020-04-24T14:41:06Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "apache2-2.4.16-20.29.1.aarch64",
                        product: {
                           name: "apache2-2.4.16-20.29.1.aarch64",
                           product_id: "apache2-2.4.16-20.29.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-devel-2.4.16-20.29.1.aarch64",
                        product: {
                           name: "apache2-devel-2.4.16-20.29.1.aarch64",
                           product_id: "apache2-devel-2.4.16-20.29.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-event-2.4.16-20.29.1.aarch64",
                        product: {
                           name: "apache2-event-2.4.16-20.29.1.aarch64",
                           product_id: "apache2-event-2.4.16-20.29.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-example-pages-2.4.16-20.29.1.aarch64",
                        product: {
                           name: "apache2-example-pages-2.4.16-20.29.1.aarch64",
                           product_id: "apache2-example-pages-2.4.16-20.29.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-prefork-2.4.16-20.29.1.aarch64",
                        product: {
                           name: "apache2-prefork-2.4.16-20.29.1.aarch64",
                           product_id: "apache2-prefork-2.4.16-20.29.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-utils-2.4.16-20.29.1.aarch64",
                        product: {
                           name: "apache2-utils-2.4.16-20.29.1.aarch64",
                           product_id: "apache2-utils-2.4.16-20.29.1.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-worker-2.4.16-20.29.1.aarch64",
                        product: {
                           name: "apache2-worker-2.4.16-20.29.1.aarch64",
                           product_id: "apache2-worker-2.4.16-20.29.1.aarch64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "aarch64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "apache2-2.4.16-20.29.1.i586",
                        product: {
                           name: "apache2-2.4.16-20.29.1.i586",
                           product_id: "apache2-2.4.16-20.29.1.i586",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-devel-2.4.16-20.29.1.i586",
                        product: {
                           name: "apache2-devel-2.4.16-20.29.1.i586",
                           product_id: "apache2-devel-2.4.16-20.29.1.i586",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-event-2.4.16-20.29.1.i586",
                        product: {
                           name: "apache2-event-2.4.16-20.29.1.i586",
                           product_id: "apache2-event-2.4.16-20.29.1.i586",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-example-pages-2.4.16-20.29.1.i586",
                        product: {
                           name: "apache2-example-pages-2.4.16-20.29.1.i586",
                           product_id: "apache2-example-pages-2.4.16-20.29.1.i586",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-prefork-2.4.16-20.29.1.i586",
                        product: {
                           name: "apache2-prefork-2.4.16-20.29.1.i586",
                           product_id: "apache2-prefork-2.4.16-20.29.1.i586",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-utils-2.4.16-20.29.1.i586",
                        product: {
                           name: "apache2-utils-2.4.16-20.29.1.i586",
                           product_id: "apache2-utils-2.4.16-20.29.1.i586",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-worker-2.4.16-20.29.1.i586",
                        product: {
                           name: "apache2-worker-2.4.16-20.29.1.i586",
                           product_id: "apache2-worker-2.4.16-20.29.1.i586",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "i586",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "apache2-doc-2.4.16-20.29.1.noarch",
                        product: {
                           name: "apache2-doc-2.4.16-20.29.1.noarch",
                           product_id: "apache2-doc-2.4.16-20.29.1.noarch",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "noarch",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "apache2-2.4.16-20.29.1.ppc64le",
                        product: {
                           name: "apache2-2.4.16-20.29.1.ppc64le",
                           product_id: "apache2-2.4.16-20.29.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-devel-2.4.16-20.29.1.ppc64le",
                        product: {
                           name: "apache2-devel-2.4.16-20.29.1.ppc64le",
                           product_id: "apache2-devel-2.4.16-20.29.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-event-2.4.16-20.29.1.ppc64le",
                        product: {
                           name: "apache2-event-2.4.16-20.29.1.ppc64le",
                           product_id: "apache2-event-2.4.16-20.29.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-example-pages-2.4.16-20.29.1.ppc64le",
                        product: {
                           name: "apache2-example-pages-2.4.16-20.29.1.ppc64le",
                           product_id: "apache2-example-pages-2.4.16-20.29.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-prefork-2.4.16-20.29.1.ppc64le",
                        product: {
                           name: "apache2-prefork-2.4.16-20.29.1.ppc64le",
                           product_id: "apache2-prefork-2.4.16-20.29.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-utils-2.4.16-20.29.1.ppc64le",
                        product: {
                           name: "apache2-utils-2.4.16-20.29.1.ppc64le",
                           product_id: "apache2-utils-2.4.16-20.29.1.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-worker-2.4.16-20.29.1.ppc64le",
                        product: {
                           name: "apache2-worker-2.4.16-20.29.1.ppc64le",
                           product_id: "apache2-worker-2.4.16-20.29.1.ppc64le",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "ppc64le",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "apache2-2.4.16-20.29.1.s390",
                        product: {
                           name: "apache2-2.4.16-20.29.1.s390",
                           product_id: "apache2-2.4.16-20.29.1.s390",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-devel-2.4.16-20.29.1.s390",
                        product: {
                           name: "apache2-devel-2.4.16-20.29.1.s390",
                           product_id: "apache2-devel-2.4.16-20.29.1.s390",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-event-2.4.16-20.29.1.s390",
                        product: {
                           name: "apache2-event-2.4.16-20.29.1.s390",
                           product_id: "apache2-event-2.4.16-20.29.1.s390",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-example-pages-2.4.16-20.29.1.s390",
                        product: {
                           name: "apache2-example-pages-2.4.16-20.29.1.s390",
                           product_id: "apache2-example-pages-2.4.16-20.29.1.s390",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-prefork-2.4.16-20.29.1.s390",
                        product: {
                           name: "apache2-prefork-2.4.16-20.29.1.s390",
                           product_id: "apache2-prefork-2.4.16-20.29.1.s390",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-utils-2.4.16-20.29.1.s390",
                        product: {
                           name: "apache2-utils-2.4.16-20.29.1.s390",
                           product_id: "apache2-utils-2.4.16-20.29.1.s390",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-worker-2.4.16-20.29.1.s390",
                        product: {
                           name: "apache2-worker-2.4.16-20.29.1.s390",
                           product_id: "apache2-worker-2.4.16-20.29.1.s390",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "apache2-2.4.16-20.29.1.s390x",
                        product: {
                           name: "apache2-2.4.16-20.29.1.s390x",
                           product_id: "apache2-2.4.16-20.29.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-devel-2.4.16-20.29.1.s390x",
                        product: {
                           name: "apache2-devel-2.4.16-20.29.1.s390x",
                           product_id: "apache2-devel-2.4.16-20.29.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-event-2.4.16-20.29.1.s390x",
                        product: {
                           name: "apache2-event-2.4.16-20.29.1.s390x",
                           product_id: "apache2-event-2.4.16-20.29.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-example-pages-2.4.16-20.29.1.s390x",
                        product: {
                           name: "apache2-example-pages-2.4.16-20.29.1.s390x",
                           product_id: "apache2-example-pages-2.4.16-20.29.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-prefork-2.4.16-20.29.1.s390x",
                        product: {
                           name: "apache2-prefork-2.4.16-20.29.1.s390x",
                           product_id: "apache2-prefork-2.4.16-20.29.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-utils-2.4.16-20.29.1.s390x",
                        product: {
                           name: "apache2-utils-2.4.16-20.29.1.s390x",
                           product_id: "apache2-utils-2.4.16-20.29.1.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-worker-2.4.16-20.29.1.s390x",
                        product: {
                           name: "apache2-worker-2.4.16-20.29.1.s390x",
                           product_id: "apache2-worker-2.4.16-20.29.1.s390x",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "apache2-2.4.16-20.29.1.x86_64",
                        product: {
                           name: "apache2-2.4.16-20.29.1.x86_64",
                           product_id: "apache2-2.4.16-20.29.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-devel-2.4.16-20.29.1.x86_64",
                        product: {
                           name: "apache2-devel-2.4.16-20.29.1.x86_64",
                           product_id: "apache2-devel-2.4.16-20.29.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-event-2.4.16-20.29.1.x86_64",
                        product: {
                           name: "apache2-event-2.4.16-20.29.1.x86_64",
                           product_id: "apache2-event-2.4.16-20.29.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-example-pages-2.4.16-20.29.1.x86_64",
                        product: {
                           name: "apache2-example-pages-2.4.16-20.29.1.x86_64",
                           product_id: "apache2-example-pages-2.4.16-20.29.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-prefork-2.4.16-20.29.1.x86_64",
                        product: {
                           name: "apache2-prefork-2.4.16-20.29.1.x86_64",
                           product_id: "apache2-prefork-2.4.16-20.29.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-utils-2.4.16-20.29.1.x86_64",
                        product: {
                           name: "apache2-utils-2.4.16-20.29.1.x86_64",
                           product_id: "apache2-utils-2.4.16-20.29.1.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "apache2-worker-2.4.16-20.29.1.x86_64",
                        product: {
                           name: "apache2-worker-2.4.16-20.29.1.x86_64",
                           product_id: "apache2-worker-2.4.16-20.29.1.x86_64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
                        product: {
                           name: "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
                           product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sles_sap:12:sp1",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Server 12 SP1-LTSS",
                        product: {
                           name: "SUSE Linux Enterprise Server 12 SP1-LTSS",
                           product_id: "SUSE Linux Enterprise Server 12 SP1-LTSS",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:sles-ltss:12:sp1",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-2.4.16-20.29.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-2.4.16-20.29.1.x86_64",
            },
            product_reference: "apache2-2.4.16-20.29.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-doc-2.4.16-20.29.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-doc-2.4.16-20.29.1.noarch",
            },
            product_reference: "apache2-doc-2.4.16-20.29.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-example-pages-2.4.16-20.29.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-example-pages-2.4.16-20.29.1.x86_64",
            },
            product_reference: "apache2-example-pages-2.4.16-20.29.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-prefork-2.4.16-20.29.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-prefork-2.4.16-20.29.1.x86_64",
            },
            product_reference: "apache2-prefork-2.4.16-20.29.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-utils-2.4.16-20.29.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-utils-2.4.16-20.29.1.x86_64",
            },
            product_reference: "apache2-utils-2.4.16-20.29.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-worker-2.4.16-20.29.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
               product_id: "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-worker-2.4.16-20.29.1.x86_64",
            },
            product_reference: "apache2-worker-2.4.16-20.29.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-2.4.16-20.29.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP1-LTSS",
               product_id: "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-2.4.16-20.29.1.ppc64le",
            },
            product_reference: "apache2-2.4.16-20.29.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP1-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-2.4.16-20.29.1.s390x as component of SUSE Linux Enterprise Server 12 SP1-LTSS",
               product_id: "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-2.4.16-20.29.1.s390x",
            },
            product_reference: "apache2-2.4.16-20.29.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP1-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-2.4.16-20.29.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP1-LTSS",
               product_id: "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-2.4.16-20.29.1.x86_64",
            },
            product_reference: "apache2-2.4.16-20.29.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP1-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-doc-2.4.16-20.29.1.noarch as component of SUSE Linux Enterprise Server 12 SP1-LTSS",
               product_id: "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-doc-2.4.16-20.29.1.noarch",
            },
            product_reference: "apache2-doc-2.4.16-20.29.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP1-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-example-pages-2.4.16-20.29.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP1-LTSS",
               product_id: "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-example-pages-2.4.16-20.29.1.ppc64le",
            },
            product_reference: "apache2-example-pages-2.4.16-20.29.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP1-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-example-pages-2.4.16-20.29.1.s390x as component of SUSE Linux Enterprise Server 12 SP1-LTSS",
               product_id: "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-example-pages-2.4.16-20.29.1.s390x",
            },
            product_reference: "apache2-example-pages-2.4.16-20.29.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP1-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-example-pages-2.4.16-20.29.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP1-LTSS",
               product_id: "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-example-pages-2.4.16-20.29.1.x86_64",
            },
            product_reference: "apache2-example-pages-2.4.16-20.29.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP1-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-prefork-2.4.16-20.29.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP1-LTSS",
               product_id: "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-prefork-2.4.16-20.29.1.ppc64le",
            },
            product_reference: "apache2-prefork-2.4.16-20.29.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP1-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-prefork-2.4.16-20.29.1.s390x as component of SUSE Linux Enterprise Server 12 SP1-LTSS",
               product_id: "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-prefork-2.4.16-20.29.1.s390x",
            },
            product_reference: "apache2-prefork-2.4.16-20.29.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP1-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-prefork-2.4.16-20.29.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP1-LTSS",
               product_id: "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-prefork-2.4.16-20.29.1.x86_64",
            },
            product_reference: "apache2-prefork-2.4.16-20.29.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP1-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-utils-2.4.16-20.29.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP1-LTSS",
               product_id: "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-utils-2.4.16-20.29.1.ppc64le",
            },
            product_reference: "apache2-utils-2.4.16-20.29.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP1-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-utils-2.4.16-20.29.1.s390x as component of SUSE Linux Enterprise Server 12 SP1-LTSS",
               product_id: "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-utils-2.4.16-20.29.1.s390x",
            },
            product_reference: "apache2-utils-2.4.16-20.29.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP1-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-utils-2.4.16-20.29.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP1-LTSS",
               product_id: "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-utils-2.4.16-20.29.1.x86_64",
            },
            product_reference: "apache2-utils-2.4.16-20.29.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP1-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-worker-2.4.16-20.29.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP1-LTSS",
               product_id: "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-worker-2.4.16-20.29.1.ppc64le",
            },
            product_reference: "apache2-worker-2.4.16-20.29.1.ppc64le",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP1-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-worker-2.4.16-20.29.1.s390x as component of SUSE Linux Enterprise Server 12 SP1-LTSS",
               product_id: "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-worker-2.4.16-20.29.1.s390x",
            },
            product_reference: "apache2-worker-2.4.16-20.29.1.s390x",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP1-LTSS",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "apache2-worker-2.4.16-20.29.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP1-LTSS",
               product_id: "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-worker-2.4.16-20.29.1.x86_64",
            },
            product_reference: "apache2-worker-2.4.16-20.29.1.x86_64",
            relates_to_product_reference: "SUSE Linux Enterprise Server 12 SP1-LTSS",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2020-1927",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-1927",
            },
         ],
         notes: [
            {
               category: "general",
               text: "In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-2.4.16-20.29.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-2.4.16-20.29.1.s390x",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-2.4.16-20.29.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-doc-2.4.16-20.29.1.noarch",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-example-pages-2.4.16-20.29.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-example-pages-2.4.16-20.29.1.s390x",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-example-pages-2.4.16-20.29.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-prefork-2.4.16-20.29.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-prefork-2.4.16-20.29.1.s390x",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-prefork-2.4.16-20.29.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-utils-2.4.16-20.29.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-utils-2.4.16-20.29.1.s390x",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-utils-2.4.16-20.29.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-worker-2.4.16-20.29.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-worker-2.4.16-20.29.1.s390x",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-worker-2.4.16-20.29.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-2.4.16-20.29.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-doc-2.4.16-20.29.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-example-pages-2.4.16-20.29.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-prefork-2.4.16-20.29.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-utils-2.4.16-20.29.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-worker-2.4.16-20.29.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-1927",
               url: "https://www.suse.com/security/cve/CVE-2020-1927",
            },
            {
               category: "external",
               summary: "SUSE Bug 1145738 for CVE-2020-1927",
               url: "https://bugzilla.suse.com/1145738",
            },
            {
               category: "external",
               summary: "SUSE Bug 1168407 for CVE-2020-1927",
               url: "https://bugzilla.suse.com/1168407",
            },
            {
               category: "external",
               summary: "SUSE Bug 1170718 for CVE-2020-1927",
               url: "https://bugzilla.suse.com/1170718",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-2.4.16-20.29.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-2.4.16-20.29.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-doc-2.4.16-20.29.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-example-pages-2.4.16-20.29.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-example-pages-2.4.16-20.29.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-example-pages-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-prefork-2.4.16-20.29.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-prefork-2.4.16-20.29.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-prefork-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-utils-2.4.16-20.29.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-utils-2.4.16-20.29.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-utils-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-worker-2.4.16-20.29.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-worker-2.4.16-20.29.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-worker-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-doc-2.4.16-20.29.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-example-pages-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-prefork-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-utils-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-worker-2.4.16-20.29.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.1,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-2.4.16-20.29.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-2.4.16-20.29.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-doc-2.4.16-20.29.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-example-pages-2.4.16-20.29.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-example-pages-2.4.16-20.29.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-example-pages-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-prefork-2.4.16-20.29.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-prefork-2.4.16-20.29.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-prefork-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-utils-2.4.16-20.29.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-utils-2.4.16-20.29.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-utils-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-worker-2.4.16-20.29.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-worker-2.4.16-20.29.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-worker-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-doc-2.4.16-20.29.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-example-pages-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-prefork-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-utils-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-worker-2.4.16-20.29.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-04-24T14:41:06Z",
               details: "moderate",
            },
         ],
         title: "CVE-2020-1927",
      },
      {
         cve: "CVE-2020-1934",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-1934",
            },
         ],
         notes: [
            {
               category: "general",
               text: "In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-2.4.16-20.29.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-2.4.16-20.29.1.s390x",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-2.4.16-20.29.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-doc-2.4.16-20.29.1.noarch",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-example-pages-2.4.16-20.29.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-example-pages-2.4.16-20.29.1.s390x",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-example-pages-2.4.16-20.29.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-prefork-2.4.16-20.29.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-prefork-2.4.16-20.29.1.s390x",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-prefork-2.4.16-20.29.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-utils-2.4.16-20.29.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-utils-2.4.16-20.29.1.s390x",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-utils-2.4.16-20.29.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-worker-2.4.16-20.29.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-worker-2.4.16-20.29.1.s390x",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-worker-2.4.16-20.29.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-2.4.16-20.29.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-doc-2.4.16-20.29.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-example-pages-2.4.16-20.29.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-prefork-2.4.16-20.29.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-utils-2.4.16-20.29.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-worker-2.4.16-20.29.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-1934",
               url: "https://www.suse.com/security/cve/CVE-2020-1934",
            },
            {
               category: "external",
               summary: "SUSE Bug 1168404 for CVE-2020-1934",
               url: "https://bugzilla.suse.com/1168404",
            },
            {
               category: "external",
               summary: "SUSE Bug 1170718 for CVE-2020-1934",
               url: "https://bugzilla.suse.com/1170718",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-2.4.16-20.29.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-2.4.16-20.29.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-doc-2.4.16-20.29.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-example-pages-2.4.16-20.29.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-example-pages-2.4.16-20.29.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-example-pages-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-prefork-2.4.16-20.29.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-prefork-2.4.16-20.29.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-prefork-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-utils-2.4.16-20.29.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-utils-2.4.16-20.29.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-utils-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-worker-2.4.16-20.29.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-worker-2.4.16-20.29.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-worker-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-doc-2.4.16-20.29.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-example-pages-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-prefork-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-utils-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-worker-2.4.16-20.29.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-2.4.16-20.29.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-2.4.16-20.29.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-doc-2.4.16-20.29.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-example-pages-2.4.16-20.29.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-example-pages-2.4.16-20.29.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-example-pages-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-prefork-2.4.16-20.29.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-prefork-2.4.16-20.29.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-prefork-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-utils-2.4.16-20.29.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-utils-2.4.16-20.29.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-utils-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-worker-2.4.16-20.29.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-worker-2.4.16-20.29.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-worker-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-doc-2.4.16-20.29.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-example-pages-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-prefork-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-utils-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-worker-2.4.16-20.29.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-04-24T14:41:06Z",
               details: "moderate",
            },
         ],
         title: "CVE-2020-1934",
      },
      {
         cve: "CVE-2020-1938",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2020-1938",
            },
         ],
         notes: [
            {
               category: "general",
               text: "When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-2.4.16-20.29.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-2.4.16-20.29.1.s390x",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-2.4.16-20.29.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-doc-2.4.16-20.29.1.noarch",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-example-pages-2.4.16-20.29.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-example-pages-2.4.16-20.29.1.s390x",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-example-pages-2.4.16-20.29.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-prefork-2.4.16-20.29.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-prefork-2.4.16-20.29.1.s390x",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-prefork-2.4.16-20.29.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-utils-2.4.16-20.29.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-utils-2.4.16-20.29.1.s390x",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-utils-2.4.16-20.29.1.x86_64",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-worker-2.4.16-20.29.1.ppc64le",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-worker-2.4.16-20.29.1.s390x",
               "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-worker-2.4.16-20.29.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-2.4.16-20.29.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-doc-2.4.16-20.29.1.noarch",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-example-pages-2.4.16-20.29.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-prefork-2.4.16-20.29.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-utils-2.4.16-20.29.1.x86_64",
               "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-worker-2.4.16-20.29.1.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2020-1938",
               url: "https://www.suse.com/security/cve/CVE-2020-1938",
            },
            {
               category: "external",
               summary: "SUSE Bug 1164692 for CVE-2020-1938",
               url: "https://bugzilla.suse.com/1164692",
            },
            {
               category: "external",
               summary: "SUSE Bug 1166559 for CVE-2020-1938",
               url: "https://bugzilla.suse.com/1166559",
            },
            {
               category: "external",
               summary: "SUSE Bug 1169066 for CVE-2020-1938",
               url: "https://bugzilla.suse.com/1169066",
            },
            {
               category: "external",
               summary: "SUSE Bug 1175170 for CVE-2020-1938",
               url: "https://bugzilla.suse.com/1175170",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-2.4.16-20.29.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-2.4.16-20.29.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-doc-2.4.16-20.29.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-example-pages-2.4.16-20.29.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-example-pages-2.4.16-20.29.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-example-pages-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-prefork-2.4.16-20.29.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-prefork-2.4.16-20.29.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-prefork-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-utils-2.4.16-20.29.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-utils-2.4.16-20.29.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-utils-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-worker-2.4.16-20.29.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-worker-2.4.16-20.29.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-worker-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-doc-2.4.16-20.29.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-example-pages-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-prefork-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-utils-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-worker-2.4.16-20.29.1.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.6,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-2.4.16-20.29.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-2.4.16-20.29.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-doc-2.4.16-20.29.1.noarch",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-example-pages-2.4.16-20.29.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-example-pages-2.4.16-20.29.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-example-pages-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-prefork-2.4.16-20.29.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-prefork-2.4.16-20.29.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-prefork-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-utils-2.4.16-20.29.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-utils-2.4.16-20.29.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-utils-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-worker-2.4.16-20.29.1.ppc64le",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-worker-2.4.16-20.29.1.s390x",
                  "SUSE Linux Enterprise Server 12 SP1-LTSS:apache2-worker-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-doc-2.4.16-20.29.1.noarch",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-example-pages-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-prefork-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-utils-2.4.16-20.29.1.x86_64",
                  "SUSE Linux Enterprise Server for SAP Applications 12 SP1:apache2-worker-2.4.16-20.29.1.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2020-04-24T14:41:06Z",
               details: "important",
            },
         ],
         title: "CVE-2020-1938",
      },
   ],
}

cve-2020-1934

Vulnerability from cvelistv5

Published

2020-04-01 19:22

Modified

2024-08-04 06:54

Severity ?

Summary

In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server.

References

▼	URL	Tags
	https://lists.apache.org/thread.html/r52a52fd60a258f5999a8fa5424b30d9fd795885f9ff4828d889cd201%40%3Cdev.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r1719675306dfbeaceff3dc63ccad3de2d5615919ca3c13276948b9ac%40%3Cdev.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r5d12ffc80685b0df1d6801e68000a7707dd694fe32e4f221de67c210%40%3Ccvs.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html	vendor-advisory, x_refsource_SUSE
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	https://httpd.apache.org/security/vulnerabilities_24.html	x_refsource_CONFIRM
	https://security.netapp.com/advisory/ntap-20200413-0002/	x_refsource_CONFIRM
	https://usn.ubuntu.com/4458-1/	vendor-advisory, x_refsource_UBUNTU
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYVYE2ZERFXDV6RMKK3I5SDSDQLPSEIQ/	vendor-advisory, x_refsource_FEDORA
	https://www.debian.org/security/2020/dsa-4757	vendor-advisory, x_refsource_DEBIAN
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A2RN46PRBJE7E7OPD4YZX5SVWV5QKGV5/	vendor-advisory, x_refsource_FEDORA
	https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r09bb998baee74a2c316446bd1a41ae7f8d7049d09d9ff991471e8775%40%3Ccvs.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rdf3e5d0a5f5c3d90d6013bccc6c4d5af59cf1f8c8dea5d9a283d13ce%40%3Ccvs.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36%40%3Ccvs.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r33e626224386d2851a83c352f784ba90dedee5dc7fcfcc221d5d7527%40%3Ccvs.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r26706d75f6b9080ca6a29955aeb8de98ec71bbea6e9f05809c46bca4%40%3Ccvs.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	Apache	Apache HTTP Server	Version: 2.4.0 to 2.4.41

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T06:54:00.049Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "[httpd-dev] 20200404 Odd vulnerabilities_24.html output",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r52a52fd60a258f5999a8fa5424b30d9fd795885f9ff4828d889cd201%40%3Cdev.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-dev] 20200404 Re: Odd vulnerabilities_24.html output",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r1719675306dfbeaceff3dc63ccad3de2d5615919ca3c13276948b9ac%40%3Cdev.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-cvs] 20200420 svn commit: r1876764 - /httpd/httpd/branches/2.4.x/CHANGES",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r5d12ffc80685b0df1d6801e68000a7707dd694fe32e4f221de67c210%40%3Ccvs.httpd.apache.org%3E",
               },
               {
                  name: "openSUSE-SU-2020:0597",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2020.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://httpd.apache.org/security/vulnerabilities_24.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20200413-0002/",
               },
               {
                  name: "USN-4458-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/4458-1/",
               },
               {
                  name: "FEDORA-2020-189a1e6c3e",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYVYE2ZERFXDV6RMKK3I5SDSDQLPSEIQ/",
               },
               {
                  name: "DSA-4757",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2020/dsa-4757",
               },
               {
                  name: "FEDORA-2020-0d3d3f5072",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A2RN46PRBJE7E7OPD4YZX5SVWV5QKGV5/",
               },
               {
                  name: "[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-cvs] 20210330 svn commit: r1073143 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-cvs] 20210330 svn commit: r1888194 [13/13] - /httpd/site/trunk/content/security/json/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r09bb998baee74a2c316446bd1a41ae7f8d7049d09d9ff991471e8775%40%3Ccvs.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-cvs] 20210330 svn commit: r1073140 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-cvs] 20210330 svn commit: r1073139 [13/13] - in /websites/staging/httpd/trunk/content: ./ security/json/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/rdf3e5d0a5f5c3d90d6013bccc6c4d5af59cf1f8c8dea5d9a283d13ce%40%3Ccvs.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-cvs] 20210330 svn commit: r1073149 [13/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36%40%3Ccvs.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-cvs] 20210330 svn commit: r1073157 - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-1934.json security/vulnerabilities_24.html",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r33e626224386d2851a83c352f784ba90dedee5dc7fcfcc221d5d7527%40%3Ccvs.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-cvs] 20210330 svn commit: r1888213 - /httpd/site/trunk/content/security/json/CVE-2020-1934.json",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r26706d75f6b9080ca6a29955aeb8de98ec71bbea6e9f05809c46bca4%40%3Ccvs.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-cvs] 20210603 svn commit: r1075360 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-cvs] 20210606 svn commit: r1075470 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E",
               },
               {
                  name: "[debian-lts-announce] 20210709 [SECURITY] [DLA 2706-1] apache2 security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Apache HTTP Server",
               vendor: "Apache",
               versions: [
                  {
                     status: "affected",
                     version: "2.4.0 to 2.4.41",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "mod_proxy_ftp use of uninitialized value",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-07-09T10:06:16",
            orgId: "f0158376-9dc2-43b6-827c-5f631a4d8d09",
            shortName: "apache",
         },
         references: [
            {
               name: "[httpd-dev] 20200404 Odd vulnerabilities_24.html output",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r52a52fd60a258f5999a8fa5424b30d9fd795885f9ff4828d889cd201%40%3Cdev.httpd.apache.org%3E",
            },
            {
               name: "[httpd-dev] 20200404 Re: Odd vulnerabilities_24.html output",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r1719675306dfbeaceff3dc63ccad3de2d5615919ca3c13276948b9ac%40%3Cdev.httpd.apache.org%3E",
            },
            {
               name: "[httpd-cvs] 20200420 svn commit: r1876764 - /httpd/httpd/branches/2.4.x/CHANGES",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r5d12ffc80685b0df1d6801e68000a7707dd694fe32e4f221de67c210%40%3Ccvs.httpd.apache.org%3E",
            },
            {
               name: "openSUSE-SU-2020:0597",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujul2020.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://httpd.apache.org/security/vulnerabilities_24.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20200413-0002/",
            },
            {
               name: "USN-4458-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/4458-1/",
            },
            {
               name: "FEDORA-2020-189a1e6c3e",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYVYE2ZERFXDV6RMKK3I5SDSDQLPSEIQ/",
            },
            {
               name: "DSA-4757",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2020/dsa-4757",
            },
            {
               name: "FEDORA-2020-0d3d3f5072",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A2RN46PRBJE7E7OPD4YZX5SVWV5QKGV5/",
            },
            {
               name: "[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
            },
            {
               name: "[httpd-cvs] 20210330 svn commit: r1073143 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E",
            },
            {
               name: "[httpd-cvs] 20210330 svn commit: r1888194 [13/13] - /httpd/site/trunk/content/security/json/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r09bb998baee74a2c316446bd1a41ae7f8d7049d09d9ff991471e8775%40%3Ccvs.httpd.apache.org%3E",
            },
            {
               name: "[httpd-cvs] 20210330 svn commit: r1073140 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
            },
            {
               name: "[httpd-cvs] 20210330 svn commit: r1073139 [13/13] - in /websites/staging/httpd/trunk/content: ./ security/json/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/rdf3e5d0a5f5c3d90d6013bccc6c4d5af59cf1f8c8dea5d9a283d13ce%40%3Ccvs.httpd.apache.org%3E",
            },
            {
               name: "[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
            },
            {
               name: "[httpd-cvs] 20210330 svn commit: r1073149 [13/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36%40%3Ccvs.httpd.apache.org%3E",
            },
            {
               name: "[httpd-cvs] 20210330 svn commit: r1073157 - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-1934.json security/vulnerabilities_24.html",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r33e626224386d2851a83c352f784ba90dedee5dc7fcfcc221d5d7527%40%3Ccvs.httpd.apache.org%3E",
            },
            {
               name: "[httpd-cvs] 20210330 svn commit: r1888213 - /httpd/site/trunk/content/security/json/CVE-2020-1934.json",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r26706d75f6b9080ca6a29955aeb8de98ec71bbea6e9f05809c46bca4%40%3Ccvs.httpd.apache.org%3E",
            },
            {
               name: "[httpd-cvs] 20210603 svn commit: r1075360 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E",
            },
            {
               name: "[httpd-cvs] 20210606 svn commit: r1075470 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E",
            },
            {
               name: "[debian-lts-announce] 20210709 [SECURITY] [DLA 2706-1] apache2 security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@apache.org",
               ID: "CVE-2020-1934",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Apache HTTP Server",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "2.4.0 to 2.4.41",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Apache",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "mod_proxy_ftp use of uninitialized value",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "[httpd-dev] 20200404 Odd vulnerabilities_24.html output",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r52a52fd60a258f5999a8fa5424b30d9fd795885f9ff4828d889cd201@%3Cdev.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-dev] 20200404 Re: Odd vulnerabilities_24.html output",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r1719675306dfbeaceff3dc63ccad3de2d5615919ca3c13276948b9ac@%3Cdev.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-cvs] 20200420 svn commit: r1876764 - /httpd/httpd/branches/2.4.x/CHANGES",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r5d12ffc80685b0df1d6801e68000a7707dd694fe32e4f221de67c210@%3Ccvs.httpd.apache.org%3E",
                  },
                  {
                     name: "openSUSE-SU-2020:0597",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpujul2020.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujul2020.html",
                  },
                  {
                     name: "https://httpd.apache.org/security/vulnerabilities_24.html",
                     refsource: "CONFIRM",
                     url: "https://httpd.apache.org/security/vulnerabilities_24.html",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20200413-0002/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20200413-0002/",
                  },
                  {
                     name: "USN-4458-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/4458-1/",
                  },
                  {
                     name: "FEDORA-2020-189a1e6c3e",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HYVYE2ZERFXDV6RMKK3I5SDSDQLPSEIQ/",
                  },
                  {
                     name: "DSA-4757",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2020/dsa-4757",
                  },
                  {
                     name: "FEDORA-2020-0d3d3f5072",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A2RN46PRBJE7E7OPD4YZX5SVWV5QKGV5/",
                  },
                  {
                     name: "[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-cvs] 20210330 svn commit: r1073143 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf@%3Ccvs.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-cvs] 20210330 svn commit: r1888194 [13/13] - /httpd/site/trunk/content/security/json/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r09bb998baee74a2c316446bd1a41ae7f8d7049d09d9ff991471e8775@%3Ccvs.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-cvs] 20210330 svn commit: r1073140 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-cvs] 20210330 svn commit: r1073139 [13/13] - in /websites/staging/httpd/trunk/content: ./ security/json/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/rdf3e5d0a5f5c3d90d6013bccc6c4d5af59cf1f8c8dea5d9a283d13ce@%3Ccvs.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-cvs] 20210330 svn commit: r1073149 [13/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36@%3Ccvs.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-cvs] 20210330 svn commit: r1073157 - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-1934.json security/vulnerabilities_24.html",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r33e626224386d2851a83c352f784ba90dedee5dc7fcfcc221d5d7527@%3Ccvs.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-cvs] 20210330 svn commit: r1888213 - /httpd/site/trunk/content/security/json/CVE-2020-1934.json",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r26706d75f6b9080ca6a29955aeb8de98ec71bbea6e9f05809c46bca4@%3Ccvs.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-cvs] 20210603 svn commit: r1075360 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9@%3Ccvs.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-cvs] 20210606 svn commit: r1075470 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E",
                  },
                  {
                     name: "[debian-lts-announce] 20210709 [SECURITY] [DLA 2706-1] apache2 security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "f0158376-9dc2-43b6-827c-5f631a4d8d09",
      assignerShortName: "apache",
      cveId: "CVE-2020-1934",
      datePublished: "2020-04-01T19:22:23",
      dateReserved: "2019-12-02T00:00:00",
      dateUpdated: "2024-08-04T06:54:00.049Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-1938

Vulnerability from cvelistv5

Published

2020-02-24 21:19

Modified

2025-02-06 21:14

Severity ?

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.

References

▼	URL	Tags
	https://lists.apache.org/thread.html/r7c6f492fbd39af34a68681dbbba0468490ff1a97a1bd79c6a53610ef%40%3Cannounce.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r856cdd87eda7af40b50278d6de80ee4b42d63adeb433a34a7bdaf9db%40%3Cnotifications.ofbiz.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r75113652e46c4dee687236510649acfb70d2c63e074152049c3f399d%40%3Cnotifications.ofbiz.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rd0774c95699d5aeb5e16e9a600fb2ea296e81175e30a62094e27e3e7%40%3Ccommits.ofbiz.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r74328b178f9f37fe759dffbc9c1f2793e66d79d7a8a20d3836551794%40%3Cnotifications.ofbiz.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rce2af55f6e144ffcdc025f997eddceb315dfbc0b230e3d750a7f7425%40%3Cnotifications.ofbiz.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rad36ec6a1ffc9e43266b030c22ceeea569243555d34fb4187ff08522%40%3Cnotifications.ofbiz.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rb2fc890bef23cbc7f343900005fe1edd3b091cf18dada455580258f9%40%3Cusers.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r38a5b7943b9a62ecb853acc22ef08ff586a7b3c66e08f949f0396ab1%40%3Cusers.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r17aaa3a05b5b7fe9075613dd0c681efa60a4f8c8fbad152c61371b6e%40%3Cusers.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rd50baccd1bbb96c2327d5a8caa25a49692b3d68d96915bd1cfbb9f8b%40%3Cusers.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r4afa11e0464408e68f0e9560e90b185749363a66398b1491254f7864%40%3Cusers.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r772335e6851ad33ddb076218fa4ff70de1bf398d5b43e2ddf0130e5d%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.debian.org/debian-lts-announce/2020/03/msg00006.html	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/re5eecbe5bf967439bafeeaa85987b3a43f0e6efe06b6976ee768cde2%40%3Cusers.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r5e2f1201b92ee05a0527cfc076a81ea0c270be299b87895c0ddbe02b%40%3Cusers.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r549b43509e387a42656f0641fa311bf27c127c244fe02007d5b8d6f6%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r61f280a76902b594692f0b24a1dbf647bb5a4c197b9395e9a6796e7c%40%3Cusers.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r4f86cb260196e5cfcbbe782822c225ddcc70f54560f14a8f11c6926f%40%3Cusers.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r9f119d9ce9239114022e13dbfe385b3de7c972f24f05d6dbd35c1a2f%40%3Cusers.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r089dc67c0358a1556dd279c762c74f32d7a254a54836b7ee2d839d8e%40%3Cdev.tomee.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rbdb1d2b651a3728f0ceba9e0853575b6f90296a94a71836a15f7364a%40%3Cdev.tomee.apache.org%3E	mailing-list, x_refsource_MLIST
	http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00025.html	vendor-advisory, x_refsource_SUSE
	https://lists.apache.org/thread.html/rc068e824654c4b8bd4f2490bec869e29edbfcd5dfe02d47cbf7433b2%40%3Cdev.tomee.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rf26663f42e7f1a1d1cac732469fb5e92c89908a48b61ec546dbb79ca%40%3Cbugs.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://security.gentoo.org/glsa/202003-43	vendor-advisory, x_refsource_GENTOO
	https://lists.apache.org/thread.html/rcd5cd301e9e7e39f939baf2f5d58704750be07a5e2d3393e40ca7194%40%3Ccommits.tomee.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rf992c5adf376294af31378a70aa8a158388a41d7039668821be28df3%40%3Ccommits.tomee.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r6a5633cad1b560a1e51f5b425f02918bdf30e090fdf18c5f7c2617eb%40%3Ccommits.tomee.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2XFLQB3O5QVP4ZBIPVIXBEZV7F2R7ZMS/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L46WJIV6UV3FWA5O5YEY6XLA73RYD53B/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3IPNHCKFVUKSHDTM45UL4Q765EHHTFG/	vendor-advisory, x_refsource_FEDORA
	https://lists.apache.org/thread.html/r43faacf64570b1d9a4bada407a5af3b2738b0c007b905f1b6b608c65%40%3Cusers.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html	vendor-advisory, x_refsource_SUSE
	https://www.debian.org/security/2020/dsa-4673	vendor-advisory, x_refsource_DEBIAN
	https://www.debian.org/security/2020/dsa-4680	vendor-advisory, x_refsource_DEBIAN
	https://lists.debian.org/debian-lts-announce/2020/05/msg00026.html	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rb1c0fb105ce2b93b7ec6fc1b77dd208022621a91c12d1f580813cfed%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/ra7092f7492569b39b04ec0decf52628ba86c51f15efb38f5853e2760%40%3Cnotifications.ofbiz.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r8f7484589454638af527182ae55ef5b628ba00c05c5b11887c922fb1%40%3Cnotifications.ofbiz.apache.org%3E	mailing-list, x_refsource_MLIST
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	https://security.netapp.com/advisory/ntap-20200226-0002/	x_refsource_CONFIRM
	http://support.blackberry.com/kb/articleDetail?articleNumber=000062739	x_refsource_CONFIRM
	https://lists.apache.org/thread.html/r92d78655c068d0bc991d1edbdfb24f9c5134603e647cade1113d4e0a%40%3Cusers.tomee.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E	mailing-list, x_refsource_MLIST
	https://www.oracle.com/security-alerts/cpuoct2020.html	x_refsource_MISC
	https://lists.apache.org/thread.html/r57f5e4ced436ace518a9e222fabe27fb785f09f5bf974814cc48ca97%40%3Ccommits.tomee.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r47caef01f663106c2bb81d116b8380d62beac9e543dd3f3bc2c2beda%40%3Ccommits.tomee.apache.org%3E	mailing-list, x_refsource_MLIST
	https://www.oracle.com/security-alerts/cpujan2021.html	x_refsource_MISC
	https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	Apache	Apache Tomcat	Version: Apache Tomcat 9.0.0.M1 to 9.0.0.30 Version: 8.5.0 to 8.5.50 Version: 7.0.0 to 7.0.99

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T06:54:00.412Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "[tomcat-announce] 20200224 [SECURITY] CVE-2020-1938 AJP Request Injection and potential Remote Code Execution",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r7c6f492fbd39af34a68681dbbba0468490ff1a97a1bd79c6a53610ef%40%3Cannounce.tomcat.apache.org%3E",
               },
               {
                  name: "[ofbiz-notifications] 20200225 [jira] [Commented] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938)",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r856cdd87eda7af40b50278d6de80ee4b42d63adeb433a34a7bdaf9db%40%3Cnotifications.ofbiz.apache.org%3E",
               },
               {
                  name: "[ofbiz-notifications] 20200225 [jira] [Updated] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938)",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r75113652e46c4dee687236510649acfb70d2c63e074152049c3f399d%40%3Cnotifications.ofbiz.apache.org%3E",
               },
               {
                  name: "[ofbiz-commits] 20200227 [ofbiz-plugins] branch release17.12 updated: Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938) (OFBIZ-11407)",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/rd0774c95699d5aeb5e16e9a600fb2ea296e81175e30a62094e27e3e7%40%3Ccommits.ofbiz.apache.org%3E",
               },
               {
                  name: "[ofbiz-notifications] 20200227 [jira] [Commented] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938)",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r74328b178f9f37fe759dffbc9c1f2793e66d79d7a8a20d3836551794%40%3Cnotifications.ofbiz.apache.org%3E",
               },
               {
                  name: "[ofbiz-notifications] 20200228 [jira] [Commented] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938)",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/rce2af55f6e144ffcdc025f997eddceb315dfbc0b230e3d750a7f7425%40%3Cnotifications.ofbiz.apache.org%3E",
               },
               {
                  name: "[ofbiz-notifications] 20200228 [jira] [Comment Edited] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938)",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/rad36ec6a1ffc9e43266b030c22ceeea569243555d34fb4187ff08522%40%3Cnotifications.ofbiz.apache.org%3E",
               },
               {
                  name: "[tomcat-users] 20200301 Re: [SECURITY] CVE-2020-1938 AJP Request Injection and potential Remote Code Execution",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/rb2fc890bef23cbc7f343900005fe1edd3b091cf18dada455580258f9%40%3Cusers.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-users] 20200302 Re: AW: [SECURITY] CVE-2020-1938 AJP Request Injection and potentialRemote Code Execution",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r38a5b7943b9a62ecb853acc22ef08ff586a7b3c66e08f949f0396ab1%40%3Cusers.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-users] 20200302 AW: [SECURITY] CVE-2020-1938 AJP Request Injection and potentialRemote Code Execution",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r17aaa3a05b5b7fe9075613dd0c681efa60a4f8c8fbad152c61371b6e%40%3Cusers.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-users] 20200302 Re: [SECURITY] CVE-2020-1938 AJP Request Injection and potential Remote Code Execution",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/rd50baccd1bbb96c2327d5a8caa25a49692b3d68d96915bd1cfbb9f8b%40%3Cusers.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-users] 20200304 Re: Fix for CVE-2020-1938",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r4afa11e0464408e68f0e9560e90b185749363a66398b1491254f7864%40%3Cusers.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20200304 Re: Tagging 10.0.x, 9.0.x, 8.5.x",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r772335e6851ad33ddb076218fa4ff70de1bf398d5b43e2ddf0130e5d%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[debian-lts-announce] 20200304 [SECURITY] [DLA 2133-1] tomcat7 security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2020/03/msg00006.html",
               },
               {
                  name: "[tomcat-users] 20200305 Aw: Re: Fix for CVE-2020-1938",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/re5eecbe5bf967439bafeeaa85987b3a43f0e6efe06b6976ee768cde2%40%3Cusers.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-users] 20200305 Re: Aw: Re: Fix for CVE-2020-1938",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r5e2f1201b92ee05a0527cfc076a81ea0c270be299b87895c0ddbe02b%40%3Cusers.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-dev] 20200309 [Bug 64206] Answer file not being used",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r549b43509e387a42656f0641fa311bf27c127c244fe02007d5b8d6f6%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-users] 20200309 Re: Apache Tomcat AJP File Inclusion Vulnerability (unauthenticated check)",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r61f280a76902b594692f0b24a1dbf647bb5a4c197b9395e9a6796e7c%40%3Cusers.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-users] 20200310 Aw: Re: Re: Fix for CVE-2020-1938",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r4f86cb260196e5cfcbbe782822c225ddcc70f54560f14a8f11c6926f%40%3Cusers.tomcat.apache.org%3E",
               },
               {
                  name: "[tomcat-users] 20200310 Re: Re: Re: Fix for CVE-2020-1938",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r9f119d9ce9239114022e13dbfe385b3de7c972f24f05d6dbd35c1a2f%40%3Cusers.tomcat.apache.org%3E",
               },
               {
                  name: "[tomee-dev] 20200311 CVE-2020-1938 on Tomcat 9.0.30 / TomEE 8.0.1",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r089dc67c0358a1556dd279c762c74f32d7a254a54836b7ee2d839d8e%40%3Cdev.tomee.apache.org%3E",
               },
               {
                  name: "[tomee-dev] 20200311 Re: CVE-2020-1938 on Tomcat 9.0.30 / TomEE 8.0.1",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/rbdb1d2b651a3728f0ceba9e0853575b6f90296a94a71836a15f7364a%40%3Cdev.tomee.apache.org%3E",
               },
               {
                  name: "openSUSE-SU-2020:0345",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00025.html",
               },
               {
                  name: "[tomee-dev] 20200316 RE: CVE-2020-8840 on TomEE 8.0.1",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/rc068e824654c4b8bd4f2490bec869e29edbfcd5dfe02d47cbf7433b2%40%3Cdev.tomee.apache.org%3E",
               },
               {
                  name: "[httpd-bugs] 20200319 [Bug 53098] mod_proxy_ajp: patch to set worker secret passed to tomcat",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/rf26663f42e7f1a1d1cac732469fb5e92c89908a48b61ec546dbb79ca%40%3Cbugs.httpd.apache.org%3E",
               },
               {
                  name: "GLSA-202003-43",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202003-43",
               },
               {
                  name: "[tomee-commits] 20200320 [jira] [Updated] (TOMEE-2789) TomEE plus(7.0.7) is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability.",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/rcd5cd301e9e7e39f939baf2f5d58704750be07a5e2d3393e40ca7194%40%3Ccommits.tomee.apache.org%3E",
               },
               {
                  name: "[tomee-commits] 20200320 [jira] [Created] (TOMEE-2789) TomEE plus is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability.",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/rf992c5adf376294af31378a70aa8a158388a41d7039668821be28df3%40%3Ccommits.tomee.apache.org%3E",
               },
               {
                  name: "[tomee-commits] 20200323 [jira] [Commented] (TOMEE-2789) TomEE plus(7.0.7) is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability.",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r6a5633cad1b560a1e51f5b425f02918bdf30e090fdf18c5f7c2617eb%40%3Ccommits.tomee.apache.org%3E",
               },
               {
                  name: "FEDORA-2020-0e42878ba7",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2XFLQB3O5QVP4ZBIPVIXBEZV7F2R7ZMS/",
               },
               {
                  name: "FEDORA-2020-c870aa8378",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L46WJIV6UV3FWA5O5YEY6XLA73RYD53B/",
               },
               {
                  name: "FEDORA-2020-04ac174fa9",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3IPNHCKFVUKSHDTM45UL4Q765EHHTFG/",
               },
               {
                  name: "[tomcat-users] 20200413 RE: Alternatives for AJP",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r43faacf64570b1d9a4bada407a5af3b2738b0c007b905f1b6b608c65%40%3Cusers.tomcat.apache.org%3E",
               },
               {
                  name: "openSUSE-SU-2020:0597",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html",
               },
               {
                  name: "DSA-4673",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2020/dsa-4673",
               },
               {
                  name: "DSA-4680",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2020/dsa-4680",
               },
               {
                  name: "[debian-lts-announce] 20200528 [SECURITY] [DLA 2209-1] tomcat8 security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2020/05/msg00026.html",
               },
               {
                  name: "[tomcat-dev] 20200625 svn commit: r1879208 - in /tomcat/site/trunk: docs/security-10.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-8.xml xdocs/security-9.xml",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/rb1c0fb105ce2b93b7ec6fc1b77dd208022621a91c12d1f580813cfed%40%3Cdev.tomcat.apache.org%3E",
               },
               {
                  name: "[ofbiz-notifications] 20200628 [jira] [Updated] (OFBIZ-11847) CLONE - Upgrade Tomcat from 9.0.34 to 9.0.36 (CVE-2020-11996)",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/ra7092f7492569b39b04ec0decf52628ba86c51f15efb38f5853e2760%40%3Cnotifications.ofbiz.apache.org%3E",
               },
               {
                  name: "[ofbiz-notifications] 20200628 [jira] [Created] (OFBIZ-11847) CLONE - Upgrade Tomcat from 9.0.34 to 9.0.36 (CVE-2020-11996)",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r8f7484589454638af527182ae55ef5b628ba00c05c5b11887c922fb1%40%3Cnotifications.ofbiz.apache.org%3E",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2020.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20200226-0002/",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "http://support.blackberry.com/kb/articleDetail?articleNumber=000062739",
               },
               {
                  name: "[tomee-users] 20200723 Re: TomEE on Docker",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r92d78655c068d0bc991d1edbdfb24f9c5134603e647cade1113d4e0a%40%3Cusers.tomee.apache.org%3E",
               },
               {
                  name: "[geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuoct2020.html",
               },
               {
                  name: "[tomee-commits] 20201127 [jira] [Resolved] (TOMEE-2789) TomEE plus(7.0.7) is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability.",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r57f5e4ced436ace518a9e222fabe27fb785f09f5bf974814cc48ca97%40%3Ccommits.tomee.apache.org%3E",
               },
               {
                  name: "[tomee-commits] 20201127 [jira] [Updated] (TOMEE-2789) TomEE plus(7.0.7) is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability.",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r47caef01f663106c2bb81d116b8380d62beac9e543dd3f3bc2c2beda%40%3Ccommits.tomee.apache.org%3E",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujan2021.html",
               },
               {
                  name: "[announce] 20210125 Apache Software Foundation Security Report: 2020",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E",
               },
               {
                  name: "[announce] 20210223 Re: Apache Software Foundation Security Report: 2020",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  cvssV3_1: {
                     attackComplexity: "LOW",
                     attackVector: "NETWORK",
                     availabilityImpact: "HIGH",
                     baseScore: 9.8,
                     baseSeverity: "CRITICAL",
                     confidentialityImpact: "HIGH",
                     integrityImpact: "HIGH",
                     privilegesRequired: "NONE",
                     scope: "UNCHANGED",
                     userInteraction: "NONE",
                     vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                     version: "3.1",
                  },
               },
               {
                  other: {
                     content: {
                        id: "CVE-2020-1938",
                        options: [
                           {
                              Exploitation: "active",
                           },
                           {
                              Automatable: "yes",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-02-06T21:05:38.047118Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
               {
                  other: {
                     content: {
                        dateAdded: "2022-03-03",
                        reference: "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-1938",
                     },
                     type: "kev",
                  },
               },
            ],
            problemTypes: [
               {
                  descriptions: [
                     {
                        description: "CWE-noinfo Not enough information",
                        lang: "en",
                        type: "CWE",
                     },
                  ],
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-02-06T21:14:30.076Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "Apache Tomcat",
               vendor: "Apache",
               versions: [
                  {
                     status: "affected",
                     version: "Apache Tomcat 9.0.0.M1 to 9.0.0.30",
                  },
                  {
                     status: "affected",
                     version: "8.5.0 to 8.5.50",
                  },
                  {
                     status: "affected",
                     version: "7.0.0 to 7.0.99",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "AJP Request Injection leading to possible Remote Code Execution",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2021-02-24T03:06:28.000Z",
            orgId: "f0158376-9dc2-43b6-827c-5f631a4d8d09",
            shortName: "apache",
         },
         references: [
            {
               name: "[tomcat-announce] 20200224 [SECURITY] CVE-2020-1938 AJP Request Injection and potential Remote Code Execution",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r7c6f492fbd39af34a68681dbbba0468490ff1a97a1bd79c6a53610ef%40%3Cannounce.tomcat.apache.org%3E",
            },
            {
               name: "[ofbiz-notifications] 20200225 [jira] [Commented] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938)",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r856cdd87eda7af40b50278d6de80ee4b42d63adeb433a34a7bdaf9db%40%3Cnotifications.ofbiz.apache.org%3E",
            },
            {
               name: "[ofbiz-notifications] 20200225 [jira] [Updated] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938)",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r75113652e46c4dee687236510649acfb70d2c63e074152049c3f399d%40%3Cnotifications.ofbiz.apache.org%3E",
            },
            {
               name: "[ofbiz-commits] 20200227 [ofbiz-plugins] branch release17.12 updated: Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938) (OFBIZ-11407)",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/rd0774c95699d5aeb5e16e9a600fb2ea296e81175e30a62094e27e3e7%40%3Ccommits.ofbiz.apache.org%3E",
            },
            {
               name: "[ofbiz-notifications] 20200227 [jira] [Commented] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938)",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r74328b178f9f37fe759dffbc9c1f2793e66d79d7a8a20d3836551794%40%3Cnotifications.ofbiz.apache.org%3E",
            },
            {
               name: "[ofbiz-notifications] 20200228 [jira] [Commented] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938)",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/rce2af55f6e144ffcdc025f997eddceb315dfbc0b230e3d750a7f7425%40%3Cnotifications.ofbiz.apache.org%3E",
            },
            {
               name: "[ofbiz-notifications] 20200228 [jira] [Comment Edited] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938)",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/rad36ec6a1ffc9e43266b030c22ceeea569243555d34fb4187ff08522%40%3Cnotifications.ofbiz.apache.org%3E",
            },
            {
               name: "[tomcat-users] 20200301 Re: [SECURITY] CVE-2020-1938 AJP Request Injection and potential Remote Code Execution",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/rb2fc890bef23cbc7f343900005fe1edd3b091cf18dada455580258f9%40%3Cusers.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-users] 20200302 Re: AW: [SECURITY] CVE-2020-1938 AJP Request Injection and potentialRemote Code Execution",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r38a5b7943b9a62ecb853acc22ef08ff586a7b3c66e08f949f0396ab1%40%3Cusers.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-users] 20200302 AW: [SECURITY] CVE-2020-1938 AJP Request Injection and potentialRemote Code Execution",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r17aaa3a05b5b7fe9075613dd0c681efa60a4f8c8fbad152c61371b6e%40%3Cusers.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-users] 20200302 Re: [SECURITY] CVE-2020-1938 AJP Request Injection and potential Remote Code Execution",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/rd50baccd1bbb96c2327d5a8caa25a49692b3d68d96915bd1cfbb9f8b%40%3Cusers.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-users] 20200304 Re: Fix for CVE-2020-1938",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r4afa11e0464408e68f0e9560e90b185749363a66398b1491254f7864%40%3Cusers.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20200304 Re: Tagging 10.0.x, 9.0.x, 8.5.x",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r772335e6851ad33ddb076218fa4ff70de1bf398d5b43e2ddf0130e5d%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[debian-lts-announce] 20200304 [SECURITY] [DLA 2133-1] tomcat7 security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2020/03/msg00006.html",
            },
            {
               name: "[tomcat-users] 20200305 Aw: Re: Fix for CVE-2020-1938",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/re5eecbe5bf967439bafeeaa85987b3a43f0e6efe06b6976ee768cde2%40%3Cusers.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-users] 20200305 Re: Aw: Re: Fix for CVE-2020-1938",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r5e2f1201b92ee05a0527cfc076a81ea0c270be299b87895c0ddbe02b%40%3Cusers.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-dev] 20200309 [Bug 64206] Answer file not being used",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r549b43509e387a42656f0641fa311bf27c127c244fe02007d5b8d6f6%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-users] 20200309 Re: Apache Tomcat AJP File Inclusion Vulnerability (unauthenticated check)",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r61f280a76902b594692f0b24a1dbf647bb5a4c197b9395e9a6796e7c%40%3Cusers.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-users] 20200310 Aw: Re: Re: Fix for CVE-2020-1938",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r4f86cb260196e5cfcbbe782822c225ddcc70f54560f14a8f11c6926f%40%3Cusers.tomcat.apache.org%3E",
            },
            {
               name: "[tomcat-users] 20200310 Re: Re: Re: Fix for CVE-2020-1938",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r9f119d9ce9239114022e13dbfe385b3de7c972f24f05d6dbd35c1a2f%40%3Cusers.tomcat.apache.org%3E",
            },
            {
               name: "[tomee-dev] 20200311 CVE-2020-1938 on Tomcat 9.0.30 / TomEE 8.0.1",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r089dc67c0358a1556dd279c762c74f32d7a254a54836b7ee2d839d8e%40%3Cdev.tomee.apache.org%3E",
            },
            {
               name: "[tomee-dev] 20200311 Re: CVE-2020-1938 on Tomcat 9.0.30 / TomEE 8.0.1",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/rbdb1d2b651a3728f0ceba9e0853575b6f90296a94a71836a15f7364a%40%3Cdev.tomee.apache.org%3E",
            },
            {
               name: "openSUSE-SU-2020:0345",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00025.html",
            },
            {
               name: "[tomee-dev] 20200316 RE: CVE-2020-8840 on TomEE 8.0.1",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/rc068e824654c4b8bd4f2490bec869e29edbfcd5dfe02d47cbf7433b2%40%3Cdev.tomee.apache.org%3E",
            },
            {
               name: "[httpd-bugs] 20200319 [Bug 53098] mod_proxy_ajp: patch to set worker secret passed to tomcat",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/rf26663f42e7f1a1d1cac732469fb5e92c89908a48b61ec546dbb79ca%40%3Cbugs.httpd.apache.org%3E",
            },
            {
               name: "GLSA-202003-43",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202003-43",
            },
            {
               name: "[tomee-commits] 20200320 [jira] [Updated] (TOMEE-2789) TomEE plus(7.0.7) is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability.",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/rcd5cd301e9e7e39f939baf2f5d58704750be07a5e2d3393e40ca7194%40%3Ccommits.tomee.apache.org%3E",
            },
            {
               name: "[tomee-commits] 20200320 [jira] [Created] (TOMEE-2789) TomEE plus is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability.",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/rf992c5adf376294af31378a70aa8a158388a41d7039668821be28df3%40%3Ccommits.tomee.apache.org%3E",
            },
            {
               name: "[tomee-commits] 20200323 [jira] [Commented] (TOMEE-2789) TomEE plus(7.0.7) is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability.",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r6a5633cad1b560a1e51f5b425f02918bdf30e090fdf18c5f7c2617eb%40%3Ccommits.tomee.apache.org%3E",
            },
            {
               name: "FEDORA-2020-0e42878ba7",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2XFLQB3O5QVP4ZBIPVIXBEZV7F2R7ZMS/",
            },
            {
               name: "FEDORA-2020-c870aa8378",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L46WJIV6UV3FWA5O5YEY6XLA73RYD53B/",
            },
            {
               name: "FEDORA-2020-04ac174fa9",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/K3IPNHCKFVUKSHDTM45UL4Q765EHHTFG/",
            },
            {
               name: "[tomcat-users] 20200413 RE: Alternatives for AJP",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r43faacf64570b1d9a4bada407a5af3b2738b0c007b905f1b6b608c65%40%3Cusers.tomcat.apache.org%3E",
            },
            {
               name: "openSUSE-SU-2020:0597",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html",
            },
            {
               name: "DSA-4673",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2020/dsa-4673",
            },
            {
               name: "DSA-4680",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2020/dsa-4680",
            },
            {
               name: "[debian-lts-announce] 20200528 [SECURITY] [DLA 2209-1] tomcat8 security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2020/05/msg00026.html",
            },
            {
               name: "[tomcat-dev] 20200625 svn commit: r1879208 - in /tomcat/site/trunk: docs/security-10.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-8.xml xdocs/security-9.xml",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/rb1c0fb105ce2b93b7ec6fc1b77dd208022621a91c12d1f580813cfed%40%3Cdev.tomcat.apache.org%3E",
            },
            {
               name: "[ofbiz-notifications] 20200628 [jira] [Updated] (OFBIZ-11847) CLONE - Upgrade Tomcat from 9.0.34 to 9.0.36 (CVE-2020-11996)",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/ra7092f7492569b39b04ec0decf52628ba86c51f15efb38f5853e2760%40%3Cnotifications.ofbiz.apache.org%3E",
            },
            {
               name: "[ofbiz-notifications] 20200628 [jira] [Created] (OFBIZ-11847) CLONE - Upgrade Tomcat from 9.0.34 to 9.0.36 (CVE-2020-11996)",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r8f7484589454638af527182ae55ef5b628ba00c05c5b11887c922fb1%40%3Cnotifications.ofbiz.apache.org%3E",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujul2020.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20200226-0002/",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "http://support.blackberry.com/kb/articleDetail?articleNumber=000062739",
            },
            {
               name: "[tomee-users] 20200723 Re: TomEE on Docker",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r92d78655c068d0bc991d1edbdfb24f9c5134603e647cade1113d4e0a%40%3Cusers.tomee.apache.org%3E",
            },
            {
               name: "[geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpuoct2020.html",
            },
            {
               name: "[tomee-commits] 20201127 [jira] [Resolved] (TOMEE-2789) TomEE plus(7.0.7) is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability.",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r57f5e4ced436ace518a9e222fabe27fb785f09f5bf974814cc48ca97%40%3Ccommits.tomee.apache.org%3E",
            },
            {
               name: "[tomee-commits] 20201127 [jira] [Updated] (TOMEE-2789) TomEE plus(7.0.7) is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability.",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r47caef01f663106c2bb81d116b8380d62beac9e543dd3f3bc2c2beda%40%3Ccommits.tomee.apache.org%3E",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujan2021.html",
            },
            {
               name: "[announce] 20210125 Apache Software Foundation Security Report: 2020",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E",
            },
            {
               name: "[announce] 20210223 Re: Apache Software Foundation Security Report: 2020",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@apache.org",
               ID: "CVE-2020-1938",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Apache Tomcat",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "Apache Tomcat 9.0.0.M1 to 9.0.0.30",
                                       },
                                       {
                                          version_value: "8.5.0 to 8.5.50",
                                       },
                                       {
                                          version_value: "7.0.0 to 7.0.99",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Apache",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "AJP Request Injection leading to possible Remote Code Execution",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "[tomcat-announce] 20200224 [SECURITY] CVE-2020-1938 AJP Request Injection and potential Remote Code Execution",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r7c6f492fbd39af34a68681dbbba0468490ff1a97a1bd79c6a53610ef%40%3Cannounce.tomcat.apache.org%3E",
                  },
                  {
                     name: "[ofbiz-notifications] 20200225 [jira] [Commented] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938)",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r856cdd87eda7af40b50278d6de80ee4b42d63adeb433a34a7bdaf9db@%3Cnotifications.ofbiz.apache.org%3E",
                  },
                  {
                     name: "[ofbiz-notifications] 20200225 [jira] [Updated] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938)",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r75113652e46c4dee687236510649acfb70d2c63e074152049c3f399d@%3Cnotifications.ofbiz.apache.org%3E",
                  },
                  {
                     name: "[ofbiz-commits] 20200227 [ofbiz-plugins] branch release17.12 updated: Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938) (OFBIZ-11407)",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/rd0774c95699d5aeb5e16e9a600fb2ea296e81175e30a62094e27e3e7@%3Ccommits.ofbiz.apache.org%3E",
                  },
                  {
                     name: "[ofbiz-notifications] 20200227 [jira] [Commented] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938)",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r74328b178f9f37fe759dffbc9c1f2793e66d79d7a8a20d3836551794@%3Cnotifications.ofbiz.apache.org%3E",
                  },
                  {
                     name: "[ofbiz-notifications] 20200228 [jira] [Commented] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938)",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/rce2af55f6e144ffcdc025f997eddceb315dfbc0b230e3d750a7f7425@%3Cnotifications.ofbiz.apache.org%3E",
                  },
                  {
                     name: "[ofbiz-notifications] 20200228 [jira] [Comment Edited] (OFBIZ-11407) Upgrade Tomcat from 9.0.29 to 9.0.31 (CVE-2020-1938)",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/rad36ec6a1ffc9e43266b030c22ceeea569243555d34fb4187ff08522@%3Cnotifications.ofbiz.apache.org%3E",
                  },
                  {
                     name: "[tomcat-users] 20200301 Re: [SECURITY] CVE-2020-1938 AJP Request Injection and potential Remote Code Execution",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/rb2fc890bef23cbc7f343900005fe1edd3b091cf18dada455580258f9@%3Cusers.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-users] 20200302 Re: AW: [SECURITY] CVE-2020-1938 AJP Request Injection and potentialRemote Code Execution",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r38a5b7943b9a62ecb853acc22ef08ff586a7b3c66e08f949f0396ab1@%3Cusers.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-users] 20200302 AW: [SECURITY] CVE-2020-1938 AJP Request Injection and potentialRemote Code Execution",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r17aaa3a05b5b7fe9075613dd0c681efa60a4f8c8fbad152c61371b6e@%3Cusers.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-users] 20200302 Re: [SECURITY] CVE-2020-1938 AJP Request Injection and potential Remote Code Execution",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/rd50baccd1bbb96c2327d5a8caa25a49692b3d68d96915bd1cfbb9f8b@%3Cusers.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-users] 20200304 Re: Fix for CVE-2020-1938",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r4afa11e0464408e68f0e9560e90b185749363a66398b1491254f7864@%3Cusers.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20200304 Re: Tagging 10.0.x, 9.0.x, 8.5.x",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r772335e6851ad33ddb076218fa4ff70de1bf398d5b43e2ddf0130e5d@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[debian-lts-announce] 20200304 [SECURITY] [DLA 2133-1] tomcat7 security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2020/03/msg00006.html",
                  },
                  {
                     name: "[tomcat-users] 20200305 Aw: Re: Fix for CVE-2020-1938",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/re5eecbe5bf967439bafeeaa85987b3a43f0e6efe06b6976ee768cde2@%3Cusers.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-users] 20200305 Re: Aw: Re: Fix for CVE-2020-1938",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r5e2f1201b92ee05a0527cfc076a81ea0c270be299b87895c0ddbe02b@%3Cusers.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-dev] 20200309 [Bug 64206] Answer file not being used",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r549b43509e387a42656f0641fa311bf27c127c244fe02007d5b8d6f6@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-users] 20200309 Re: Apache Tomcat AJP File Inclusion Vulnerability (unauthenticated check)",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r61f280a76902b594692f0b24a1dbf647bb5a4c197b9395e9a6796e7c@%3Cusers.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-users] 20200310 Aw: Re: Re: Fix for CVE-2020-1938",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r4f86cb260196e5cfcbbe782822c225ddcc70f54560f14a8f11c6926f@%3Cusers.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomcat-users] 20200310 Re: Re: Re: Fix for CVE-2020-1938",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r9f119d9ce9239114022e13dbfe385b3de7c972f24f05d6dbd35c1a2f@%3Cusers.tomcat.apache.org%3E",
                  },
                  {
                     name: "[tomee-dev] 20200311 CVE-2020-1938 on Tomcat 9.0.30 / TomEE 8.0.1",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r089dc67c0358a1556dd279c762c74f32d7a254a54836b7ee2d839d8e@%3Cdev.tomee.apache.org%3E",
                  },
                  {
                     name: "[tomee-dev] 20200311 Re: CVE-2020-1938 on Tomcat 9.0.30 / TomEE 8.0.1",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/rbdb1d2b651a3728f0ceba9e0853575b6f90296a94a71836a15f7364a@%3Cdev.tomee.apache.org%3E",
                  },
                  {
                     name: "openSUSE-SU-2020:0345",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00025.html",
                  },
                  {
                     name: "[tomee-dev] 20200316 RE: CVE-2020-8840 on TomEE 8.0.1",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/rc068e824654c4b8bd4f2490bec869e29edbfcd5dfe02d47cbf7433b2@%3Cdev.tomee.apache.org%3E",
                  },
                  {
                     name: "[httpd-bugs] 20200319 [Bug 53098] mod_proxy_ajp: patch to set worker secret passed to tomcat",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/rf26663f42e7f1a1d1cac732469fb5e92c89908a48b61ec546dbb79ca@%3Cbugs.httpd.apache.org%3E",
                  },
                  {
                     name: "GLSA-202003-43",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202003-43",
                  },
                  {
                     name: "[tomee-commits] 20200320 [jira] [Updated] (TOMEE-2789) TomEE plus(7.0.7) is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability.",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/rcd5cd301e9e7e39f939baf2f5d58704750be07a5e2d3393e40ca7194@%3Ccommits.tomee.apache.org%3E",
                  },
                  {
                     name: "[tomee-commits] 20200320 [jira] [Created] (TOMEE-2789) TomEE plus is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability.",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/rf992c5adf376294af31378a70aa8a158388a41d7039668821be28df3@%3Ccommits.tomee.apache.org%3E",
                  },
                  {
                     name: "[tomee-commits] 20200323 [jira] [Commented] (TOMEE-2789) TomEE plus(7.0.7) is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability.",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r6a5633cad1b560a1e51f5b425f02918bdf30e090fdf18c5f7c2617eb@%3Ccommits.tomee.apache.org%3E",
                  },
                  {
                     name: "FEDORA-2020-0e42878ba7",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2XFLQB3O5QVP4ZBIPVIXBEZV7F2R7ZMS/",
                  },
                  {
                     name: "FEDORA-2020-c870aa8378",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L46WJIV6UV3FWA5O5YEY6XLA73RYD53B/",
                  },
                  {
                     name: "FEDORA-2020-04ac174fa9",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K3IPNHCKFVUKSHDTM45UL4Q765EHHTFG/",
                  },
                  {
                     name: "[tomcat-users] 20200413 RE: Alternatives for AJP",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r43faacf64570b1d9a4bada407a5af3b2738b0c007b905f1b6b608c65@%3Cusers.tomcat.apache.org%3E",
                  },
                  {
                     name: "openSUSE-SU-2020:0597",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html",
                  },
                  {
                     name: "DSA-4673",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2020/dsa-4673",
                  },
                  {
                     name: "DSA-4680",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2020/dsa-4680",
                  },
                  {
                     name: "[debian-lts-announce] 20200528 [SECURITY] [DLA 2209-1] tomcat8 security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2020/05/msg00026.html",
                  },
                  {
                     name: "[tomcat-dev] 20200625 svn commit: r1879208 - in /tomcat/site/trunk: docs/security-10.html docs/security-8.html docs/security-9.html xdocs/security-10.xml xdocs/security-8.xml xdocs/security-9.xml",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/rb1c0fb105ce2b93b7ec6fc1b77dd208022621a91c12d1f580813cfed@%3Cdev.tomcat.apache.org%3E",
                  },
                  {
                     name: "[ofbiz-notifications] 20200628 [jira] [Updated] (OFBIZ-11847) CLONE - Upgrade Tomcat from 9.0.34 to 9.0.36 (CVE-2020-11996)",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/ra7092f7492569b39b04ec0decf52628ba86c51f15efb38f5853e2760@%3Cnotifications.ofbiz.apache.org%3E",
                  },
                  {
                     name: "[ofbiz-notifications] 20200628 [jira] [Created] (OFBIZ-11847) CLONE - Upgrade Tomcat from 9.0.34 to 9.0.36 (CVE-2020-11996)",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r8f7484589454638af527182ae55ef5b628ba00c05c5b11887c922fb1@%3Cnotifications.ofbiz.apache.org%3E",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpujul2020.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujul2020.html",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20200226-0002/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20200226-0002/",
                  },
                  {
                     name: "http://support.blackberry.com/kb/articleDetail?articleNumber=000062739",
                     refsource: "CONFIRM",
                     url: "http://support.blackberry.com/kb/articleDetail?articleNumber=000062739",
                  },
                  {
                     name: "[tomee-users] 20200723 Re: TomEE on Docker",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r92d78655c068d0bc991d1edbdfb24f9c5134603e647cade1113d4e0a@%3Cusers.tomee.apache.org%3E",
                  },
                  {
                     name: "[geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpuoct2020.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpuoct2020.html",
                  },
                  {
                     name: "[tomee-commits] 20201127 [jira] [Resolved] (TOMEE-2789) TomEE plus(7.0.7) is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability.",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r57f5e4ced436ace518a9e222fabe27fb785f09f5bf974814cc48ca97@%3Ccommits.tomee.apache.org%3E",
                  },
                  {
                     name: "[tomee-commits] 20201127 [jira] [Updated] (TOMEE-2789) TomEE plus(7.0.7) is affected by CVE-2020-1938(BDSA-2020-0339) vulnerability.",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r47caef01f663106c2bb81d116b8380d62beac9e543dd3f3bc2c2beda@%3Ccommits.tomee.apache.org%3E",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpujan2021.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujan2021.html",
                  },
                  {
                     name: "[announce] 20210125 Apache Software Foundation Security Report: 2020",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922@%3Cannounce.apache.org%3E",
                  },
                  {
                     name: "[announce] 20210223 Re: Apache Software Foundation Security Report: 2020",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7@%3Cannounce.apache.org%3E",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "f0158376-9dc2-43b6-827c-5f631a4d8d09",
      assignerShortName: "apache",
      cveId: "CVE-2020-1938",
      datePublished: "2020-02-24T21:19:18.000Z",
      dateReserved: "2019-12-02T00:00:00.000Z",
      dateUpdated: "2025-02-06T21:14:30.076Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2020-1927

Vulnerability from cvelistv5

Published

2020-04-01 23:08

Modified

2024-08-04 06:53

Severity ?

Summary

In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL.

References

▼	URL	Tags
	http://www.openwall.com/lists/oss-security/2020/04/03/1	mailing-list, x_refsource_MLIST
	http://www.openwall.com/lists/oss-security/2020/04/04/1	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r52a52fd60a258f5999a8fa5424b30d9fd795885f9ff4828d889cd201%40%3Cdev.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r1719675306dfbeaceff3dc63ccad3de2d5615919ca3c13276948b9ac%40%3Cdev.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r70ba652b79ba224b2cbc0a183078b3a49df783b419903e3dcf4d78c7%40%3Ccvs.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r10b853ea87dd150b0e76fda3f8254dfdb23dd05fa55596405b58478e%40%3Ccvs.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html	vendor-advisory, x_refsource_SUSE
	https://www.oracle.com/security-alerts/cpujul2020.html	x_refsource_MISC
	https://httpd.apache.org/security/vulnerabilities_24.html	x_refsource_CONFIRM
	https://security.netapp.com/advisory/ntap-20200413-0002/	x_refsource_CONFIRM
	https://usn.ubuntu.com/4458-1/	vendor-advisory, x_refsource_UBUNTU
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYVYE2ZERFXDV6RMKK3I5SDSDQLPSEIQ/	vendor-advisory, x_refsource_FEDORA
	https://www.debian.org/security/2020/dsa-4757	vendor-advisory, x_refsource_DEBIAN
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A2RN46PRBJE7E7OPD4YZX5SVWV5QKGV5/	vendor-advisory, x_refsource_FEDORA
	https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r09bb998baee74a2c316446bd1a41ae7f8d7049d09d9ff991471e8775%40%3Ccvs.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rdf3e5d0a5f5c3d90d6013bccc6c4d5af59cf1f8c8dea5d9a283d13ce%40%3Ccvs.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36%40%3Ccvs.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r731d43caece41d78d8c6304641a02a369fd78300e7ffaf566b06bc59%40%3Ccvs.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r6a4146bf3d1645af2880f8b7a4fd8afd696d5fd4a3ae272f49f5dc84%40%3Ccvs.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E	mailing-list, x_refsource_MLIST
	https://www.oracle.com/security-alerts/cpuApr2021.html	x_refsource_MISC
	https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html	mailing-list, x_refsource_MLIST
	https://www.oracle.com/security-alerts/cpujul2022.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Apache	Apache HTTP Server	Version: 2.4.0 to 2.4.41

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T06:53:59.905Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "[oss-security] 20200403 Re: CVE-2020-1927: mod_rewrite configurations vulnerable to open redirect",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2020/04/03/1",
               },
               {
                  name: "[oss-security] 20200403 Re: CVE-2020-1927: mod_rewrite configurations vulnerable to open redirect",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2020/04/04/1",
               },
               {
                  name: "[httpd-dev] 20200404 Odd vulnerabilities_24.html output",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r52a52fd60a258f5999a8fa5424b30d9fd795885f9ff4828d889cd201%40%3Cdev.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-dev] 20200404 Re: Odd vulnerabilities_24.html output",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r1719675306dfbeaceff3dc63ccad3de2d5615919ca3c13276948b9ac%40%3Cdev.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-cvs] 20200411 svn commit: r1876405 - in /httpd/test/framework/trunk/t: conf/core.conf.in security/CVE-2020-1927.t",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r70ba652b79ba224b2cbc0a183078b3a49df783b419903e3dcf4d78c7%40%3Ccvs.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-cvs] 20200412 svn commit: r1876426 - /httpd/test/framework/trunk/t/security/CVE-2020-1927.t",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r10b853ea87dd150b0e76fda3f8254dfdb23dd05fa55596405b58478e%40%3Ccvs.httpd.apache.org%3E",
               },
               {
                  name: "openSUSE-SU-2020:0597",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2020.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://httpd.apache.org/security/vulnerabilities_24.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://security.netapp.com/advisory/ntap-20200413-0002/",
               },
               {
                  name: "USN-4458-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/4458-1/",
               },
               {
                  name: "FEDORA-2020-189a1e6c3e",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYVYE2ZERFXDV6RMKK3I5SDSDQLPSEIQ/",
               },
               {
                  name: "DSA-4757",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2020/dsa-4757",
               },
               {
                  name: "FEDORA-2020-0d3d3f5072",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_FEDORA",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A2RN46PRBJE7E7OPD4YZX5SVWV5QKGV5/",
               },
               {
                  name: "[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-cvs] 20210330 svn commit: r1073143 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-cvs] 20210330 svn commit: r1888194 [13/13] - /httpd/site/trunk/content/security/json/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r09bb998baee74a2c316446bd1a41ae7f8d7049d09d9ff991471e8775%40%3Ccvs.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-cvs] 20210330 svn commit: r1073140 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-cvs] 20210330 svn commit: r1073139 [13/13] - in /websites/staging/httpd/trunk/content: ./ security/json/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/rdf3e5d0a5f5c3d90d6013bccc6c4d5af59cf1f8c8dea5d9a283d13ce%40%3Ccvs.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-cvs] 20210330 svn commit: r1073149 [13/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36%40%3Ccvs.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-cvs] 20210330 svn commit: r1073158 - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-1927.json security/vulnerabilities_24.html",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r731d43caece41d78d8c6304641a02a369fd78300e7ffaf566b06bc59%40%3Ccvs.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-cvs] 20210330 svn commit: r1888215 - /httpd/site/trunk/content/security/json/CVE-2020-1927.json",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r6a4146bf3d1645af2880f8b7a4fd8afd696d5fd4a3ae272f49f5dc84%40%3Ccvs.httpd.apache.org%3E",
               },
               {
                  name: "[httpd-cvs] 20210606 svn commit: r1075470 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpuApr2021.html",
               },
               {
                  name: "[debian-lts-announce] 20210709 [SECURITY] [DLA 2706-1] apache2 security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.oracle.com/security-alerts/cpujul2022.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Apache HTTP Server",
               vendor: "Apache",
               versions: [
                  {
                     status: "affected",
                     version: "2.4.0 to 2.4.41",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-601",
                     description: "mod_rewrite CWE-601 open redirect",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-07-25T16:14:55",
            orgId: "f0158376-9dc2-43b6-827c-5f631a4d8d09",
            shortName: "apache",
         },
         references: [
            {
               name: "[oss-security] 20200403 Re: CVE-2020-1927: mod_rewrite configurations vulnerable to open redirect",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2020/04/03/1",
            },
            {
               name: "[oss-security] 20200403 Re: CVE-2020-1927: mod_rewrite configurations vulnerable to open redirect",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2020/04/04/1",
            },
            {
               name: "[httpd-dev] 20200404 Odd vulnerabilities_24.html output",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r52a52fd60a258f5999a8fa5424b30d9fd795885f9ff4828d889cd201%40%3Cdev.httpd.apache.org%3E",
            },
            {
               name: "[httpd-dev] 20200404 Re: Odd vulnerabilities_24.html output",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r1719675306dfbeaceff3dc63ccad3de2d5615919ca3c13276948b9ac%40%3Cdev.httpd.apache.org%3E",
            },
            {
               name: "[httpd-cvs] 20200411 svn commit: r1876405 - in /httpd/test/framework/trunk/t: conf/core.conf.in security/CVE-2020-1927.t",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r70ba652b79ba224b2cbc0a183078b3a49df783b419903e3dcf4d78c7%40%3Ccvs.httpd.apache.org%3E",
            },
            {
               name: "[httpd-cvs] 20200412 svn commit: r1876426 - /httpd/test/framework/trunk/t/security/CVE-2020-1927.t",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r10b853ea87dd150b0e76fda3f8254dfdb23dd05fa55596405b58478e%40%3Ccvs.httpd.apache.org%3E",
            },
            {
               name: "openSUSE-SU-2020:0597",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujul2020.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://httpd.apache.org/security/vulnerabilities_24.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://security.netapp.com/advisory/ntap-20200413-0002/",
            },
            {
               name: "USN-4458-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/4458-1/",
            },
            {
               name: "FEDORA-2020-189a1e6c3e",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYVYE2ZERFXDV6RMKK3I5SDSDQLPSEIQ/",
            },
            {
               name: "DSA-4757",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2020/dsa-4757",
            },
            {
               name: "FEDORA-2020-0d3d3f5072",
               tags: [
                  "vendor-advisory",
                  "x_refsource_FEDORA",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A2RN46PRBJE7E7OPD4YZX5SVWV5QKGV5/",
            },
            {
               name: "[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E",
            },
            {
               name: "[httpd-cvs] 20210330 svn commit: r1073143 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E",
            },
            {
               name: "[httpd-cvs] 20210330 svn commit: r1888194 [13/13] - /httpd/site/trunk/content/security/json/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r09bb998baee74a2c316446bd1a41ae7f8d7049d09d9ff991471e8775%40%3Ccvs.httpd.apache.org%3E",
            },
            {
               name: "[httpd-cvs] 20210330 svn commit: r1073140 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E",
            },
            {
               name: "[httpd-cvs] 20210330 svn commit: r1073139 [13/13] - in /websites/staging/httpd/trunk/content: ./ security/json/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/rdf3e5d0a5f5c3d90d6013bccc6c4d5af59cf1f8c8dea5d9a283d13ce%40%3Ccvs.httpd.apache.org%3E",
            },
            {
               name: "[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E",
            },
            {
               name: "[httpd-cvs] 20210330 svn commit: r1073149 [13/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36%40%3Ccvs.httpd.apache.org%3E",
            },
            {
               name: "[httpd-cvs] 20210330 svn commit: r1073158 - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-1927.json security/vulnerabilities_24.html",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r731d43caece41d78d8c6304641a02a369fd78300e7ffaf566b06bc59%40%3Ccvs.httpd.apache.org%3E",
            },
            {
               name: "[httpd-cvs] 20210330 svn commit: r1888215 - /httpd/site/trunk/content/security/json/CVE-2020-1927.json",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r6a4146bf3d1645af2880f8b7a4fd8afd696d5fd4a3ae272f49f5dc84%40%3Ccvs.httpd.apache.org%3E",
            },
            {
               name: "[httpd-cvs] 20210606 svn commit: r1075470 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpuApr2021.html",
            },
            {
               name: "[debian-lts-announce] 20210709 [SECURITY] [DLA 2706-1] apache2 security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.oracle.com/security-alerts/cpujul2022.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@apache.org",
               ID: "CVE-2020-1927",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Apache HTTP Server",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "2.4.0 to 2.4.41",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Apache",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "mod_rewrite CWE-601 open redirect",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "[oss-security] 20200403 Re: CVE-2020-1927: mod_rewrite configurations vulnerable to open redirect",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2020/04/03/1",
                  },
                  {
                     name: "[oss-security] 20200403 Re: CVE-2020-1927: mod_rewrite configurations vulnerable to open redirect",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2020/04/04/1",
                  },
                  {
                     name: "[httpd-dev] 20200404 Odd vulnerabilities_24.html output",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r52a52fd60a258f5999a8fa5424b30d9fd795885f9ff4828d889cd201@%3Cdev.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-dev] 20200404 Re: Odd vulnerabilities_24.html output",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r1719675306dfbeaceff3dc63ccad3de2d5615919ca3c13276948b9ac@%3Cdev.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-cvs] 20200411 svn commit: r1876405 - in /httpd/test/framework/trunk/t: conf/core.conf.in security/CVE-2020-1927.t",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r70ba652b79ba224b2cbc0a183078b3a49df783b419903e3dcf4d78c7@%3Ccvs.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-cvs] 20200412 svn commit: r1876426 - /httpd/test/framework/trunk/t/security/CVE-2020-1927.t",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r10b853ea87dd150b0e76fda3f8254dfdb23dd05fa55596405b58478e@%3Ccvs.httpd.apache.org%3E",
                  },
                  {
                     name: "openSUSE-SU-2020:0597",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00002.html",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpujul2020.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujul2020.html",
                  },
                  {
                     name: "https://httpd.apache.org/security/vulnerabilities_24.html",
                     refsource: "CONFIRM",
                     url: "https://httpd.apache.org/security/vulnerabilities_24.html",
                  },
                  {
                     name: "https://security.netapp.com/advisory/ntap-20200413-0002/",
                     refsource: "CONFIRM",
                     url: "https://security.netapp.com/advisory/ntap-20200413-0002/",
                  },
                  {
                     name: "USN-4458-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/4458-1/",
                  },
                  {
                     name: "FEDORA-2020-189a1e6c3e",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HYVYE2ZERFXDV6RMKK3I5SDSDQLPSEIQ/",
                  },
                  {
                     name: "DSA-4757",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2020/dsa-4757",
                  },
                  {
                     name: "FEDORA-2020-0d3d3f5072",
                     refsource: "FEDORA",
                     url: "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A2RN46PRBJE7E7OPD4YZX5SVWV5QKGV5/",
                  },
                  {
                     name: "[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-cvs] 20210330 svn commit: r1073143 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf@%3Ccvs.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-cvs] 20210330 svn commit: r1888194 [13/13] - /httpd/site/trunk/content/security/json/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r09bb998baee74a2c316446bd1a41ae7f8d7049d09d9ff991471e8775@%3Ccvs.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-cvs] 20210330 svn commit: r1073140 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-cvs] 20210330 svn commit: r1073139 [13/13] - in /websites/staging/httpd/trunk/content: ./ security/json/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/rdf3e5d0a5f5c3d90d6013bccc6c4d5af59cf1f8c8dea5d9a283d13ce@%3Ccvs.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-cvs] 20210330 svn commit: r1073149 [13/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36@%3Ccvs.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-cvs] 20210330 svn commit: r1073158 - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-1927.json security/vulnerabilities_24.html",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r731d43caece41d78d8c6304641a02a369fd78300e7ffaf566b06bc59@%3Ccvs.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-cvs] 20210330 svn commit: r1888215 - /httpd/site/trunk/content/security/json/CVE-2020-1927.json",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r6a4146bf3d1645af2880f8b7a4fd8afd696d5fd4a3ae272f49f5dc84@%3Ccvs.httpd.apache.org%3E",
                  },
                  {
                     name: "[httpd-cvs] 20210606 svn commit: r1075470 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html",
                     refsource: "MLIST",
                     url: "https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpuApr2021.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpuApr2021.html",
                  },
                  {
                     name: "[debian-lts-announce] 20210709 [SECURITY] [DLA 2706-1] apache2 security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2021/07/msg00006.html",
                  },
                  {
                     name: "https://www.oracle.com/security-alerts/cpujul2022.html",
                     refsource: "MISC",
                     url: "https://www.oracle.com/security-alerts/cpujul2022.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "f0158376-9dc2-43b6-827c-5f631a4d8d09",
      assignerShortName: "apache",
      cveId: "CVE-2020-1927",
      datePublished: "2020-04-01T23:08:43",
      dateReserved: "2019-12-02T00:00:00",
      dateUpdated: "2024-08-04T06:53:59.905Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

Vulnerability from csaf_suse

cve-2020-1934

Vulnerability from cvelistv5

cve-2020-1938

Vulnerability from cvelistv5

cve-2020-1927

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature