CVE-2020-9490: High severity Apache HTTP Server vulnerability
Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via "H2Push off" will mitigate this vulnerability for unpatched servers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/apache2to a version that resolves this vulnerability.Fixed in 2.4.62-1~deb11u1Fixed in 2.4.67-1~deb11u3Fixed in 2.4.68-1~deb12u1Fixed in 2.4.67-1~deb12u3Fixed in 2.4.68-1~deb13u1Fixed in 2.4.67-1~deb13u3Fixed in 2.4.68-1 - Configuration
Configure the Apache HTTP/2 feature using "H2Push off" to mitigate the vulnerability on unpatched servers (affected Apache versions 2.4.20 to 2.4.43).
Apache HTTP Server (HTTP/2) H2Push = off
Event History
Frequently Asked Questions
What is the severity of CVE-2020-9490?
CVE-2020-9490 has a severity level that can cause a crash in affected Apache HTTP Server instances.
How do I fix CVE-2020-9490?
To mitigate CVE-2020-9490, configure the HTTP/2 feature by setting 'H2Push off' in your Apache HTTP Server configuration.
Which versions of Apache HTTP Server are affected by CVE-2020-9490?
Apache HTTP Server versions 2.4.20 to 2.4.43 are impacted by CVE-2020-9490.
What are the potential consequences of exploiting CVE-2020-9490?
Exploiting CVE-2020-9490 can lead to unexpected crashes of the Apache HTTP Server.
Is there a permanent patch for CVE-2020-9490?
While there is no specific patch, applying the mitigation by disabling HTTP/2 push can prevent its exploitation.