CVE-2014-0242

mod_wsgi module before 3.4 for Apache, when used in embedded mode, might allow remote attackers to obtain sensitive information via the Content-Type header which is generated from memory that may have been freed and then overwritten by a separate thread.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 92%
Affected Products (NVD)
VendorProductVersion
modwsgimod_wsgi
𝑥
< 3.4
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
mod-wsgi
bookworm
4.9.4-1
fixed
bullseye
4.7.1-3+deb11u1
fixed
sid
5.0.0-1
fixed
trixie
5.0.0-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
mod-wsgi
lucid
ignored
precise
Fixed 3.3-4ubuntu0.1
released
saucy
not-affected
trusty
not-affected
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
mod
RHEL 6
0:3.2-6.el6_5
fixed
Common Weakness Enumeration
References
http://blog.dscpl.com.au/2014/05/security-release-for-modwsgi-version-35.html
http://modwsgi.readthedocs.org/en/latest/release-notes/version-3.4.html
http://www.openwall.com/lists/oss-security/2014/05/21/1
http://www.securityfocus.com/bid/67534
http://blog.dscpl.com.au/2014/05/security-release-for-modwsgi-version-35.html
http://modwsgi.readthedocs.org/en/latest/release-notes/version-3.4.html
http://www.openwall.com/lists/oss-security/2014/05/21/1
http://www.securityfocus.com/bid/67534