CVE-2020-11993
First published: Wed Aug 05 2020(Updated: )
A flaw was found in Apache httpd in versions 2.4.20 to 2.4.43. Logging using the wrong pool by mod_http2 at debug/trace log level may lead to potential crashes and denial of service. The highest threat from this vulnerability is to system availability.
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/jbcs-httpd24-apr | <0:1.6.3-104.jbcs.el6 | 0:1.6.3-104.jbcs.el6 |
| redhat/jbcs-httpd24-apr-util | <0:1.6.1-75.jbcs.el6 | 0:1.6.1-75.jbcs.el6 |
| redhat/jbcs-httpd24-brotli | <0:1.0.6-38.jbcs.el6 | 0:1.0.6-38.jbcs.el6 |
| redhat/jbcs-httpd24-curl | <0:7.64.1-44.jbcs.el6 | 0:7.64.1-44.jbcs.el6 |
| redhat/jbcs-httpd24-httpd | <0:2.4.37-64.jbcs.el6 | 0:2.4.37-64.jbcs.el6 |
| redhat/jbcs-httpd24-jansson | <0:2.11-53.jbcs.el6 | 0:2.11-53.jbcs.el6 |
| redhat/jbcs-httpd24-nghttp2 | <0:1.39.2-34.jbcs.el6 | 0:1.39.2-34.jbcs.el6 |
| redhat/jbcs-httpd24-openssl | <1:1.1.1c-32.jbcs.el6 | 1:1.1.1c-32.jbcs.el6 |
| redhat/jbcs-httpd24-apr | <0:1.6.3-104.jbcs.el7 | 0:1.6.3-104.jbcs.el7 |
| redhat/jbcs-httpd24-apr-util | <0:1.6.1-75.jbcs.el7 | 0:1.6.1-75.jbcs.el7 |
| redhat/jbcs-httpd24-brotli | <0:1.0.6-38.jbcs.el7 | 0:1.0.6-38.jbcs.el7 |
| redhat/jbcs-httpd24-curl | <0:7.64.1-44.jbcs.el7 | 0:7.64.1-44.jbcs.el7 |
| redhat/jbcs-httpd24-httpd | <0:2.4.37-64.jbcs.el7 | 0:2.4.37-64.jbcs.el7 |
| redhat/jbcs-httpd24-jansson | <0:2.11-53.jbcs.el7 | 0:2.11-53.jbcs.el7 |
| redhat/jbcs-httpd24-nghttp2 | <0:1.39.2-34.jbcs.el7 | 0:1.39.2-34.jbcs.el7 |
| redhat/jbcs-httpd24-openssl | <1:1.1.1c-32.jbcs.el7 | 1:1.1.1c-32.jbcs.el7 |
| redhat/jbcs-httpd24-openssl-chil | <0:1.0.0-1.jbcs.el7 | 0:1.0.0-1.jbcs.el7 |
| redhat/httpd24-httpd | <0:2.4.34-22.el7 | 0:2.4.34-22.el7 |
| redhat/httpd | <2.4.44 | 2.4.44 |
| debian/apache2 | 2.4.62-1~deb11u1 2.4.62-1~deb11u2 2.4.62-1~deb12u2 2.4.63-1 | |
| Apache Http Server | >=2.4.20<=2.4.43 | |
| NetApp Clustered Data ONTAP | ||
| Ubuntu Linux | =16.04 | |
| Ubuntu Linux | =18.04 | |
| Ubuntu Linux | =20.04 | |
| openSUSE | =15.1 | |
| openSUSE | =15.2 | |
| Debian GNU/Linux | =10.0 | |
| Fedoraproject Fedora | =31 | |
| Fedoraproject Fedora | =32 | |
| oracle communications element manager | >=8.2.0<=8.2.2 | |
| oracle communications session report manager | >=8.2.0<=8.2.2 | |
| oracle communications session route manager | >=8.2.0<=8.2.2 | |
| Oracle Enterprise Manager Ops Center | =12.4.0.0 | |
| oracle hyperion infrastructure technology | =11.1.2.4 | |
| oracle instantis enterprisetrack | =17.1 | |
| oracle instantis enterprisetrack | =17.2 | |
| oracle instantis enterprisetrack | =17.3 | |
| Oracle Sun ZFS Storage Appliance Kit | =8.8 | |
| Ubuntu | =16.04 | |
| Ubuntu | =18.04 | |
| Ubuntu | =20.04 | |
| Debian | =10.0 | |
| Fedora | =31 | |
| Fedora | =32 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2020-11993 https://nvd.nist.gov/vuln/detail/CVE-2020-11993 https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-11993
- https://bugzilla.redhat.com/show_bug.cgi?id=1866564
- https://access.redhat.com/errata/RHSA-2020:4384
- https://access.redhat.com/errata/RHSA-2021:1809
- https://access.redhat.com/errata/RHSA-2020:4383
- https://access.redhat.com/errata/RHBA-2020:5280
- https://access.redhat.com/security/cve/cve-2020-11993
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00068.html
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00071.html
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00081.html
- http://packetstormsecurity.com/files/160393/Apache-2-HTTP2-Module-Concurrent-Pool-Usage.html
- https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-11993
- https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r09bb998baee74a2c316446bd1a41ae7f8d7049d09d9ff991471e8775@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r2c6083f6a2027914a0f5b54e2a1f4fa98c03f8693b58460911818255@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r5debe8f82728a00a4a68bc904dd6c35423bdfc8d601cfb4579f38bf1@%3Cdev.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r623de9b2b2433a87f3f3a15900419fc9c00c77b26936dfea4060f672@%3Cdev.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r9e9f1a7609760f0f80562eaaec2aa3c32d525c3e0fca98b475240c71@%3Cdev.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rdf3e5d0a5f5c3d90d6013bccc6c4d5af59cf1f8c8dea5d9a283d13ce@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rf71eb428714374a6f9ad68952e23611ec7807b029fd6a1b4f5f732d9@%3Ccvs.httpd.apache.org%3E
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4NKWG2EXAQQB6LMLATKZ7KLSRGCSHVAN/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ITVFDBVM6E3JF3O7RYLRPRCH3RDRHJJY/
- https://security.gentoo.org/glsa/202008-04
- https://security.netapp.com/advisory/ntap-20200814-0005/
- https://usn.ubuntu.com/4458-1/
- https://www.debian.org/security/2020/dsa-4757
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://launchpad.net/bugs/cve/CVE-2020-11993
- https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r09bb998baee74a2c316446bd1a41ae7f8d7049d09d9ff991471e8775%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r2c6083f6a2027914a0f5b54e2a1f4fa98c03f8693b58460911818255%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r5debe8f82728a00a4a68bc904dd6c35423bdfc8d601cfb4579f38bf1%40%3Cdev.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r623de9b2b2433a87f3f3a15900419fc9c00c77b26936dfea4060f672%40%3Cdev.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r9e9f1a7609760f0f80562eaaec2aa3c32d525c3e0fca98b475240c71%40%3Cdev.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rdf3e5d0a5f5c3d90d6013bccc6c4d5af59cf1f8c8dea5d9a283d13ce%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rf71eb428714374a6f9ad68952e23611ec7807b029fd6a1b4f5f732d9%40%3Ccvs.httpd.apache.org%3E
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4NKWG2EXAQQB6LMLATKZ7KLSRGCSHVAN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ITVFDBVM6E3JF3O7RYLRPRCH3RDRHJJY/
- https://github.com/icing/mod_h2/commit/89773a4f98ee9a9fb402470e04b6f4044faa7fdf
- https://access.redhat.com/support/policy/updates/jboss_notes
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1868149
- https://www.openwall.com/lists/oss-security/2020/08/07/3
- https://svn.apache.org/r1879642
- https://github.com/apache/httpd/commit/63a0a87efa0925514d15c211b508f6594669888c
- https://security-tracker.debian.org/tracker/CVE-2020-11993
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11993
- https://nvd.nist.gov/vuln/detail/CVE-2020-11993
- https://ubuntu.com/security/CVE-2020-11993
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2020-11993.
What is the severity of CVE-2020-11993?
The severity of CVE-2020-11993 is high.
Which versions of Apache HTTP Server are affected by CVE-2020-11993?
Apache HTTP Server versions 2.4.20 to 2.4.43 are affected by CVE-2020-11993.
How can I mitigate the vulnerability?
Configuring the LogLevel of mod_http2 above "info" will mitigate CVE-2020-11993.
Where can I find more information about CVE-2020-11993?
You can find more information about CVE-2020-11993 at the following references: [1] [2] [3]
- collector/redhat-cve
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/remedy
- agent/severity
- agent/weakness
- collector/mitre-cve
- source/MITRE
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/event
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-11993
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/trending
- agent/source
- collector/security-tracker-debian
- source/Debian
- agent/author
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-index
- agent/softwarecombine
- agent/tags
- package-manager/redhat
- package-manager/debian
- vendor/apache
- canonical/apache http server
- version/apache http server/2.4.20
- version/apache http server/2.4.43
- vendor/netapp
- canonical/netapp clustered data ontap
- vendor/canonical
- canonical/ubuntu linux
- version/ubuntu linux/16.04
- version/ubuntu linux/18.04
- version/ubuntu linux/20.04
- vendor/opensuse
- canonical/opensuse
- version/opensuse/15.1
- version/opensuse/15.2
- vendor/debian
- canonical/debian gnu/linux
- version/debian gnu/linux/10.0
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/31
- version/fedoraproject fedora/32
- vendor/oracle
- canonical/oracle communications element manager
- version/oracle communications element manager/8.2.0
- version/oracle communications element manager/8.2.2
- canonical/oracle communications session report manager
- version/oracle communications session report manager/8.2.0
- version/oracle communications session report manager/8.2.2
- canonical/oracle communications session route manager
- version/oracle communications session route manager/8.2.0
- version/oracle communications session route manager/8.2.2
- canonical/oracle enterprise manager ops center
- version/oracle enterprise manager ops center/12.4.0.0
- canonical/oracle hyperion infrastructure technology
- version/oracle hyperion infrastructure technology/11.1.2.4
- canonical/oracle instantis enterprisetrack
- version/oracle instantis enterprisetrack/17.1
- version/oracle instantis enterprisetrack/17.2
- version/oracle instantis enterprisetrack/17.3
- canonical/oracle sun zfs storage appliance kit
- version/oracle sun zfs storage appliance kit/8.8
- canonical/ubuntu
- version/ubuntu/16.04
- version/ubuntu/18.04
- version/ubuntu/20.04
- canonical/debian
- version/debian/10.0
- canonical/fedora
- version/fedora/31
- version/fedora/32