NetSight
IP …
high7.5

CVE-2020-9490

Apache HTTP Server versions 2.4.20 to 2.4.43.

Impact

Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via "H2Push off" will mitigate this vulnerability for unpatched servers.

Affected products

VendorProductAffected versions
ApacheHttp Server
from 2.4.20 before 2.4.46
OracleCommunications Element Manager
from 8.2.0 through 8.2.2
OracleCommunications Session Report Manager
from 8.2.0 through 8.2.2
OracleCommunications Session Route Manager
from 8.2.0 through 8.2.2
OracleEnterprise Manager Ops Center
Version 12.4.0.0
OracleHyperion Infrastructure Technology
Version 11.1.2.4
OracleInstantis Enterprisetrack
Versions 17.1, 17.2, 17.3
OracleZfs Storage Appliance Kit
Version 8.8
OpensuseLeap
Versions 15.1, 15.2
DebianDebian Linux
Version 10.0
FedoraprojectFedora
Versions 31, 32
CanonicalUbuntu Linux
Versions 16.04, 18.04, 20.04

Weakness classification

CWE-444

References