UbuntuUpdates.org

Package "apache2-suexec-pristine"

Name: apache2-suexec-pristine

Description:

Apache HTTP Server standard suexec program for mod_suexec

Latest version: 2.4.41-4ubuntu3.1
Release: focal (20.04)
Level: security
Repository: universe
Head package: apache2
Homepage: https://httpd.apache.org/

Links


Download "apache2-suexec-pristine"


Other versions of "apache2-suexec-pristine" in Focal

Repository Area Version
base universe 2.4.41-4ubuntu3
updates universe 2.4.41-4ubuntu3.1

Changelog

Version: 2.4.41-4ubuntu3.1 2020-08-13 16:07:31 UTC

  apache2 (2.4.41-4ubuntu3.1) focal-security; urgency=medium

  * SECURITY UPDATE: mod_rewrite redirect issue
    - debian/patches/CVE-2020-1927-1.patch: factor out default regex flags
      in include/ap_regex.h, server/core.c, server/util_pcre.c.
    - debian/patches/CVE-2020-1927-2.patch: add AP_REG_NO_DEFAULT to allow
      opt-out of pcre defaults in include/ap_regex.h,
      modules/filters/mod_substitute.c, server/util_pcre.c,
      server/util_regex.c.
    - CVE-2020-1927
  * SECURITY UPDATE: mod_proxy_ftp uninitialized memory issue
    - debian/patches/CVE-2020-1934.patch: trap bad FTP responses in
      modules/proxy/mod_proxy_ftp.c.
    - CVE-2020-1934
  * SECURITY UPDATE: DoS via invalid Cache-Digest header
    - debian/patches/CVE-2020-9490.patch: remove support for abandoned
      http-wg draft in modules/http2/h2_push.c, modules/http2/h2_push.h.
    - CVE-2020-9490
  * SECURITY UPDATE: mod_proxy_uwsgi info disclosure and possible RCE
    - debian/patches/CVE-2020-11984.patch: error out on HTTP header larger
      than 16K in modules/proxy/mod_proxy_uwsgi.c.
    - CVE-2020-11984
  * SECURITY UPDATE: concurrent use of memory pools in HTTP/2 module
    - debian/patches/CVE-2020-11993-pre1.patch: fixed rare cases where a h2
      worker could deadlock the main connection in modules/http2/*.
    - debian/patches/CVE-2020-11993.patch: fix logging and rename
      terminology in modules/http2/*.
    - CVE-2020-11993

 -- Marc Deslauriers <email address hidden> Wed, 12 Aug 2020 15:46:17 -0400

CVE-2020-1927 In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded new
CVE-2020-1934 In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server.
CVE-2020-9490 Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash whe
CVE-2020-11984 Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE
CVE-2020-11993 Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging stateme



About   -   Send Feedback to @ubuntu_updates