Slackware 14.0、14.1、14.2 和当前版本可使用新的 httpd 程序包修复安全问题。

远程 CentOS Linux 8 主机上安装的程序包受到 CESA-2020: 4751 公告中提及的多个漏洞的影响。

  - httpd：mod_http2：通过缓慢、多余的请求正文造成 DoS (CVE-2018-17189)

  - httpd：mod_http2：字符串比较的释放后读取 (CVE-2019-0196)

  - httpd：mod_http2：最近更新的可能崩溃 (CVE-2019-0197)

  - httpd：早期推送中的内存损坏 (CVE-2019-10081)

  - httpd：h2 连接关闭中的释放后读取 (CVE-2019-10082)

  - httpd：mod_proxy 错误页面中的有限跨站脚本 (CVE-2019-10092)

  - httpd：mod_remoteip 中的空指针取消引用 (CVE-2019-10097)

  - httpd：mod_rewrite 中可能存在开放重定向 (CVE-2019-10098)

  - httpd：mod_rewrite 配置容易受到开放重定向的影响 (CVE-2020-1927)

  - httpd：mod_proxy_ftp 可使用未初始化值 (CVE-2020-1934)

请注意，Nessus 尚未测试这些问题，而是只依据应用程序自我报告的版本号进行判断。

The version of Apache httpd installed on the remote host is prior to 2.4.41. It is, therefore, affected by multiple vulnerabilities as referenced in the 2.4.41 advisory, including the following:

  - A limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could     cause the link on the error page to be malformed and instead point to a page of their choice. This would     only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way     that the Proxy Error page was displayed. (CVE-2019-10092)

  - HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with H2PushResource, could lead     to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that     of the configured push link header values, not data supplied by the client. (CVE-2019-10081)

  - Some HTTP/2 implementations are vulnerable to unconstrained internal data buffering, potentially leading     to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint;
    however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the     wire. The attacker then sends a stream of requests for a large response object. Depending on how the     servers queue the responses, this can consume excess memory, CPU, or both. (CVE-2019-9517)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for apache2 fixes the following issues :

Security issues fixed :

CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to unconstrained interal data buffering (bsc#1145575).

CVE-2019-10081: Fixed mod_http2 that is vulnerable to memory corruption on early pushes (bsc#1145742).

CVE-2019-10082: Fixed mod_http2 that is vulnerable to read-after-free in h2 connection shutdown (bsc#1145741).

CVE-2019-10092: Fixed limited cross-site scripting in mod_proxy (bsc#1145740).

CVE-2019-10097: Fixed mod_remoteip stack-based buffer overflow and NULL pointer dereference (bsc#1145739).

CVE-2019-10098: Fixed mod_rewrite configuration vulnerablility to open redirect (bsc#1145738).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201909-04 (Apache: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Apache. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip     was configured to use a trusted intermediary proxy     server using the 'PROXY' protocol, a specially crafted     PROXY header could trigger a stack buffer overflow or     NULL pointer deference. This vulnerability could only     be triggered by a trusted proxy and not by untrusted     HTTP clients.(CVE-2019-10097)

  - Some HTTP/2 implementations are vulnerable to     unconstrained interal data buffering, potentially     leading to a denial of service. The attacker opens the     HTTP/2 window so the peer can send without constraint     however, they leave the TCP window closed so the peer     cannot actually write (many of) the bytes on the wire.
    The attacker then sends a stream of requests for a     large response object. Depending on how the servers     queue the responses, this can consume excess memory,     CPU, or both.(CVE-2019-9517)

  - HTTP/2 (2.4.20 through 2.4.39) very early pushes, for     example configured with 'H2PushResource', could lead to     an overwrite of memory in the pushing request's pool,     leading to crashes. The memory copied is that of the     configured push link header values, not data supplied     by the client.(CVE-2019-10081)

  - In Apache HTTP Server 2.4.18-2.4.39, using fuzzed     network input, the http/2 session handling could be     made to read memory after being freed, during     connection shutdown.(CVE-2019-10082)

  - In Apache HTTP Server 2.4 release 2.4.37 and prior,     mod_session checks the session expiry time before     decoding the session. This causes session expiry time     to be ignored for mod_session_cookie sessions since the     expiry time is loaded when the session is     decoded.(CVE-2018-17199)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New httpd packages are available for Slackware 14.0, 14.1, 14.2, and
-current to fix security issues.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4751 advisory.

  - httpd: mod_http2: DoS via slow, unneeded request bodies (CVE-2018-17189)

  - httpd: mod_http2: read-after-free on a string compare (CVE-2019-0196)

  - httpd: mod_http2: possible crash on late upgrade (CVE-2019-0197)

  - httpd: memory corruption on early pushes (CVE-2019-10081)

  - httpd: read-after-free in h2 connection shutdown (CVE-2019-10082)

  - httpd: limited cross-site scripting in mod_proxy error page (CVE-2019-10092)

  - httpd: null-pointer dereference in mod_remoteip (CVE-2019-10097)

  - httpd: mod_rewrite potential open redirect (CVE-2019-10098)

  - httpd: mod_rewrite configurations vulnerable to open redirect (CVE-2020-1927)

  - httpd: mod_proxy_ftp use of uninitialized value (CVE-2020-1934)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the httpd package has been released.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
135160	Slackware 14.0 / 14.1 / 14.2 / 当前版本：httpd (SSA:2020-091-02)（内部数据缓冲）	Nessus	Slackware Local Security Checks	2020/4/2	2022/12/5	critical
145821	CentOS 8：httpd：2.4 (CESA-2020: 4751)	Nessus	CentOS Local Security Checks	2021/2/1	2023/2/8	critical
128033	Apache 2.4.x < 2.4.41 Multiple Vulnerabilities	Nessus	Web Servers	2019/8/20	2022/12/5	critical
128316	SUSE SLED15 / SLES15 Security Update : apache2 (SUSE-SU-2019:2237-1) (Internal Data Buffering)	Nessus	SuSE Local Security Checks	2019/8/29	2022/12/5	critical
128593	GLSA-201909-04 : Apache: Multiple vulnerabilities (Internal Data Buffering)	Nessus	Gentoo Local Security Checks	2019/9/9	2022/12/6	critical
133989	EulerOS 2.0 SP8 : httpd (EulerOS-SA-2020-1155)	Nessus	Huawei Local Security Checks	2020/2/25	2024/3/26	critical
135160	Slackware 14.0 / 14.1 / 14.2 / current : httpd (SSA:2020-091-02) (Internal Data Buffering)	Nessus	Slackware Local Security Checks	2020/4/2	2022/12/5	critical
145821	CentOS 8 : httpd:2.4 (CESA-2020:4751)	Nessus	CentOS Local Security Checks	2021/2/1	2023/2/8	critical
129688	Photon OS 2.0: Httpd PHSA-2019-2.0-0178	Nessus	PhotonOS Local Security Checks	2019/10/7	2024/7/23	critical

検出

プラグインの検索

critical

critical

critical

critical

critical

critical

critical

critical

critical