CVE-2006-20001: Apache HTTP Server: mod_dav out of bounds read, or write of zero byte
Published Jan 17, 2023
·Updated
A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash.
This issue affects Apache HTTP Server 2.4.54 and earlier.
Affected Software
3 affected componentsFixes available
Apache HTTP Server<2.4.55
redhat/httpd<2.4.55
2.4.55
debian/apache2
2.4.68-1~deb12u12.4.67-1~deb12u32.4.68-1~deb13u12.4.69-1~deb13u12.4.69-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/httpdto a version that resolves this vulnerability.Fixed in 2.4.55 - Upgrade
Upgrade
debian/apache2to a version that resolves this vulnerability.Fixed in 2.4.68-1~deb12u1Fixed in 2.4.67-1~deb12u3Fixed in 2.4.68-1~deb13u1Fixed in 2.4.69-1~deb13u1Fixed in 2.4.69-1
Event History
Jan 17, 2023
CVE Published
via MITRE·07:07 PM
Data Sourced
via MITRE·07:07 PM
DescriptionWeakness
Data Sourced
via Red Hat·08:55 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2006-20001.
2
What is the severity of CVE-2006-20001?
The severity of CVE-2006-20001 is high.
3
How does CVE-2006-20001 affect Apache HTTP Server?
CVE-2006-20001 affects Apache HTTP Server 2.4.54 and earlier.
4
How can I fix CVE-2006-20001?
To fix CVE-2006-20001, update Apache HTTP Server to version 2.4.55 or later.
5
What is the Common Weakness Enumeration (CWE) ID for CVE-2006-20001?
The CWE ID for CVE-2006-20001 is CWE-787.