==========================================================================
Ubuntu Security Notice USN-4458-1
August 13, 2020

apache2 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 20.04 LTS
– Ubuntu 18.04 LTS
– Ubuntu 16.04 LTS

Summary:

Several security issues were fixed in Apache HTTP Server.

Software Description:
– apache2: Apache HTTP server

Details:

Fabrice Perez discovered that the Apache mod_rewrite module incorrectly
handled certain redirects. A remote attacker could possibly use this issue
to perform redirects to an unexpected URL. (CVE-2020-1927)

Chamal De Silva discovered that the Apache mod_proxy_ftp module incorrectly
handled memory when proxying to a malicious FTP server. A remote attacker
could possibly use this issue to obtain sensitive information.
(CVE-2020-1934)

Felix Wilhelm discovered that the HTTP/2 implementation in Apache did not
properly handle certain Cache-Digest headers. A remote attacker could
possibly use this issue to cause Apache to crash, resulting in a denial of
service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
(CVE-2020-9490)

Felix Wilhelm discovered that the Apache mod_proxy_uwsgi module incorrectly
handled large headers. A remote attacker could use this issue to obtain
sensitive information or possibly execute arbitrary code. This issue only
affected Ubuntu 20.04 LTS. (CVE-2020-11984)

Felix Wilhelm discovered that the HTTP/2 implementation in Apache did not
properly handle certain logging statements. A remote attacker could
possibly use this issue to cause Apache to crash, resulting in a denial of
service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
(CVE-2020-11993)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS:
apache2 2.4.41-4ubuntu3.1
apache2-bin 2.4.41-4ubuntu3.1
libapache2-mod-proxy-uwsgi 2.4.41-4ubuntu3.1

Ubuntu 18.04 LTS:
apache2 2.4.29-1ubuntu4.14
apache2-bin 2.4.29-1ubuntu4.14

Ubuntu 16.04 LTS:
apache2 2.4.18-2ubuntu3.17
apache2-bin 2.4.18-2ubuntu3.17

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/4458-1
CVE-2020-11984, CVE-2020-11993, CVE-2020-1927, CVE-2020-1934,
CVE-2020-9490

Package Information:
https://launchpad.net/ubuntu/+source/apache2/2.4.41-4ubuntu3.1
https://launchpad.net/ubuntu/+source/apache2/2.4.29-1ubuntu4.14
https://launchpad.net/ubuntu/+source/apache2/2.4.18-2ubuntu3.17

—–BEGIN PGP SIGNATURE—–

iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAl81WTEACgkQZWnYVadE
vpMnmQ/7BPnq32uDMiFkmVP7awQyTHnH0YuXSpdn6bA9yLuwihuhEkV73wC4AMhe
3FHny52mTwTQ7FPGurZz2u7bHrNT/ytXaRu9z2/0TesFyWOQ+oKrxHqghFDKAKg2
9DeDzHOQEuSSfpZT5QMZPH2CHCg39iRVfy9RSc/w6vLQ2LZA0tYbD9OCtRd+eyKm
jSgzoaGrwobRfplUDtTjO1b5Y4QBW5mRWC+Ko4b96ca/ruIrbssHfPrcp7CJWxqS
d3tRzZLUm+oQ/dUbzNmEK793EsOAseQCODRNABwAI1gBh34IIZpO4Fi+Za2j6uKd
N/hD6y5npiOP5TW+MupNy4C13NdQ8eFhcFUCrroWyKJ1XFxf1Wi+MeDO5UBqu+UO
AvXnMmoXs2j0h59s7b29679Ro/wJ+Dzp8e+ITWzGiGJk5tQkXnCOa4mdDjM8qfN9
hRZIHq4+EqtEdhKFFgBhbD10QO4t2TDSF5c/xD7JH/f+6UcSmGnW5IrpwHKkTwHm
smffyDlEnBTC3kiGImz6nVZ1Q7Arfxct8EkaQ6kzGhYhscKZcmDGu2M56s2syH5A
uTaG11eORVVdhyTjqqQx+hF2TxIydg/M3bDWOBgPDU8XAKk1w0rrZuKGoxNSBDdR
ug2ZWSpN9uO54R7FrKRLQgiYW4+F7vjoAbHrhdTZ5A1Uyc2xcU8=
=tTub
—–END PGP SIGNATURE—–
—