CVE-2020-11984 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
apache	CNA	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 97%

Vendor	Product	Version
apache	http_server	2.4.32 ≤ 𝑥 ≤ 2.4.43
netapp	clustered_data_ontap	-
canonical	ubuntu_linux	16.04
canonical	ubuntu_linux	18.04
canonical	ubuntu_linux	20.04
debian	debian_linux	9.0
debian	debian_linux	10.0
opensuse	leap	15.1
opensuse	leap	15.2
oracle	communications_element_manager	8.2.0 ≤ 𝑥 ≤ 8.2.2
oracle	communications_session_report_manager	8.2.0 ≤ 𝑥 ≤ 8.2.2
oracle	communications_session_route_manager	8.2.0 ≤ 𝑥 ≤ 8.2.2
oracle	enterprise_manager_ops_center	12.4.0.0
oracle	hyperion_infrastructure_technology	11.1.2.4
oracle	instantis_enterprisetrack	17.1
oracle	instantis_enterprisetrack	17.2
oracle	instantis_enterprisetrack	17.3
oracle	zfs_storage_appliance_kit	8.8

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

apache2

bullseye	2.4.62-1~deb11u1 fixed
stretch	not-affected
bullseye (security)	2.4.62-1~deb11u2 fixed
bookworm	2.4.62-1~deb12u1 fixed
bookworm (security)	2.4.62-1~deb12u2 fixed
sid	2.4.62-3 fixed
trixie	2.4.62-3 fixed

uwsgi

bullseye	unimportant
stretch	not-affected
bookworm	unimportant
trixie	unimportant
sid	unimportant

Ubuntu Releases

Ubuntu Product

Codename

apache2

jammy	Fixed 2.4.46-1ubuntu1 released
impish	Fixed 2.4.46-1ubuntu1 released
hirsute	Fixed 2.4.46-1ubuntu1 released
groovy	Fixed 2.4.46-1ubuntu1 released
focal	Fixed 2.4.41-4ubuntu3.1 released
bionic	not-affected
xenial	not-affected
trusty	not-affected

uwsgi

jammy	not-affected
impish	not-affected
hirsute	not-affected
groovy	not-affected
focal	not-affected
bionic	Fixed 2.0.15-10.2ubuntu2.2 released
xenial	Fixed 2.0.12-5ubuntu3.2+esm1 released
trusty	Fixed 1.9.17.1-5ubuntu0.1+esm1 released

Known Exploits!

Common Weakness Enumeration

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The program copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

References

http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00068.html

http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00071.html

http://packetstormsecurity.com/files/159009/Apache2-mod_proxy_uwsgi-Incorrect-Request-Handling.html

http://www.openwall.com/lists/oss-security/2020/08/08/1

http://www.openwall.com/lists/oss-security/2020/08/08/10

http://www.openwall.com/lists/oss-security/2020/08/08/8

http://www.openwall.com/lists/oss-security/2020/08/08/9

http://www.openwall.com/lists/oss-security/2020/08/10/5

http://www.openwall.com/lists/oss-security/2020/08/17/2

https://httpd.apache.org/security/vulnerabilities_24.html

https://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r09bb998baee74a2c316446bd1a41ae7f8d7049d09d9ff991471e8775%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r2c6083f6a2027914a0f5b54e2a1f4fa98c03f8693b58460911818255%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r34753590ae8e3f2b6af689af4fe84269b592f5fda9f3244fd9abbce8%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r5debe8f82728a00a4a68bc904dd6c35423bdfc8d601cfb4579f38bf1%40%3Cdev.httpd.apache.org%3E

https://lists.apache.org/thread.html/r623de9b2b2433a87f3f3a15900419fc9c00c77b26936dfea4060f672%40%3Cdev.httpd.apache.org%3E

https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rf71eb428714374a6f9ad68952e23611ec7807b029fd6a1b4f5f732d9%40%3Ccvs.httpd.apache.org%3E

https://lists.debian.org/debian-lts-announce/2020/09/msg00001.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A2RN46PRBJE7E7OPD4YZX5SVWV5QKGV5/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYVYE2ZERFXDV6RMKK3I5SDSDQLPSEIQ/

https://security.gentoo.org/glsa/202008-04

https://security.netapp.com/advisory/ntap-20200814-0005/

https://usn.ubuntu.com/4458-1/

https://www.debian.org/security/2020/dsa-4757

https://www.oracle.com/security-alerts/cpujan2021.html

https://www.oracle.com/security-alerts/cpuoct2020.html

http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00068.html

http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00071.html

http://packetstormsecurity.com/files/159009/Apache2-mod_proxy_uwsgi-Incorrect-Request-Handling.html

http://www.openwall.com/lists/oss-security/2020/08/08/1

http://www.openwall.com/lists/oss-security/2020/08/08/10

http://www.openwall.com/lists/oss-security/2020/08/08/8

http://www.openwall.com/lists/oss-security/2020/08/08/9

http://www.openwall.com/lists/oss-security/2020/08/10/5

http://www.openwall.com/lists/oss-security/2020/08/17/2

https://httpd.apache.org/security/vulnerabilities_24.html

https://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r09bb998baee74a2c316446bd1a41ae7f8d7049d09d9ff991471e8775%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r2c6083f6a2027914a0f5b54e2a1f4fa98c03f8693b58460911818255%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r34753590ae8e3f2b6af689af4fe84269b592f5fda9f3244fd9abbce8%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r5debe8f82728a00a4a68bc904dd6c35423bdfc8d601cfb4579f38bf1%40%3Cdev.httpd.apache.org%3E

https://lists.apache.org/thread.html/r623de9b2b2433a87f3f3a15900419fc9c00c77b26936dfea4060f672%40%3Cdev.httpd.apache.org%3E

https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

https://lists.apache.org/thread.html/rf71eb428714374a6f9ad68952e23611ec7807b029fd6a1b4f5f732d9%40%3Ccvs.httpd.apache.org%3E

https://lists.debian.org/debian-lts-announce/2020/09/msg00001.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A2RN46PRBJE7E7OPD4YZX5SVWV5QKGV5/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYVYE2ZERFXDV6RMKK3I5SDSDQLPSEIQ/

https://security.gentoo.org/glsa/202008-04

https://security.netapp.com/advisory/ntap-20200814-0005/

https://usn.ubuntu.com/4458-1/

https://www.debian.org/security/2020/dsa-4757

https://www.oracle.com/security-alerts/cpujan2021.html

https://www.oracle.com/security-alerts/cpuoct2020.html