NetSight
IP …
high7.5

CVE-2020-11993

Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were m…

Impact

Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were made on the wrong connection, causing concurrent use of memory pools. Configuring the LogLevel of mod_http2 above "info" will mitigate this vulnerability for unpatched servers.

Affected products

VendorProductAffected versions
ApacheHttp Server
from 2.4.20 before 2.4.44
NetappClustered Data Ontap
All versions
CanonicalUbuntu Linux
Versions 16.04, 18.04, 20.04
OpensuseLeap
Versions 15.1, 15.2
DebianDebian Linux
Version 10.0
FedoraprojectFedora
Versions 31, 32
OracleCommunications Element Manager
from 8.2.0 through 8.2.2
OracleCommunications Session Report Manager
from 8.2.0 through 8.2.2
OracleCommunications Session Route Manager
from 8.2.0 through 8.2.2
OracleEnterprise Manager Ops Center
Version 12.4.0.0
OracleHyperion Infrastructure Technology
Version 11.1.2.4
OracleInstantis Enterprisetrack
Versions 17.1, 17.2, 17.3

Weakness classification

CWE-444

References