The version of IBM HTTP Server running on the remote host is affected by multiple vulnerabilities related to Apache HTTP Server, as follows:

  - In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be     self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within     the request URL. (CVE-2020-1927)

  - In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a     malicious FTP server. (CVE-2020-1934)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2644 advisory.

  - expat: large number of colons in input makes parser consume high amount of resources, leading to DoS     (CVE-2018-20843)

  - httpd: mod_http2: read-after-free on a string compare (CVE-2019-0196)

  - httpd: mod_http2: possible crash on late upgrade (CVE-2019-0197)

  - expat: heap-based buffer over-read via crafted XML input (CVE-2019-15903)

  - libxml2: memory leak in xmlParseBalancedChunkMemoryRecover in parser.c (CVE-2019-19956)

  - libxml2: memory leak in xmlSchemaPreRun in xmlschemas.c (CVE-2019-20388)

  - nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

  - httpd: mod_proxy_ftp use of uninitialized value (CVE-2020-1934)

  - libxml2: infinite loop in xmlStringLenDecodeEntities in some end-of-file situations (CVE-2020-7595)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4751 advisory.

    The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

    The following packages have been upgraded to a later upstream version: mod_http2 (1.15.7). (BZ#1814236)

    Security Fix(es):

    * httpd: memory corruption on early pushes (CVE-2019-10081)

    * httpd: read-after-free in h2 connection shutdown (CVE-2019-10082)

    * httpd: null-pointer dereference in mod_remoteip (CVE-2019-10097)

    * httpd: mod_rewrite configurations vulnerable to open redirect (CVE-2020-1927)

    * httpd: mod_http2: DoS via slow, unneeded request bodies (CVE-2018-17189)

    * httpd: mod_http2: read-after-free on a string compare (CVE-2019-0196)

    * httpd: mod_http2: possible crash on late upgrade (CVE-2019-0197)

    * httpd: limited cross-site scripting in mod_proxy error page (CVE-2019-10092)

    * httpd: mod_rewrite potential open redirect (CVE-2019-10098)

    * httpd: mod_proxy_ftp use of uninitialized value (CVE-2020-1934)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In Apache HTTP server 2.4.0 to 2.4.39, Redirects     configured with mod_rewrite that were intended to be     self-referential might be fooled by encoded newlines     and redirect instead to an unexpected URL within the     request URL.(CVE-2019-10098)

  - In Apache HTTP Server 2.4.0 to 2.4.41, redirects     configured with mod_rewrite that were intended to be     self-referential might be fooled by encoded newlines     and redirect instead to an an unexpected URL within the     request URL.(CVE-2020-1927)

  - In Apache HTTP Server 2.4.0-2.4.39, a limited     cross-site scripting issue was reported affecting the     mod_proxy error page. An attacker could cause the link     on the error page to be malformed and instead point to     a page of their choice. This would only be exploitable     where a server was set up with proxying enabled but was     misconfigured in such a way that the Proxy Error page     was displayed.(CVE-2019-10092)

  - Memory leak in the winnt_accept function in     server/mpm/winnt/child.c in the WinNT MPM in the Apache     HTTP Server 2.4.x before 2.4.10 on Windows, when the     default AcceptFilter is enabled, allows remote     attackers to cause a denial of service (memory     consumption) via crafted requests.(CVE-2014-3523)

  - In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp     may use uninitialized memory when proxying to a     malicious FTP server.(CVE-2020-1934)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Apache Team reports : SECURITY: CVE-2020-1934 mod_proxy_ftp: Use of uninitialized value with malicious backend FTP server. SECURITY:
CVE-2020-1927 rewrite, core: Set PCRE_DOTALL flag by default to avoid unpredictable matches and substitutions with encoded line break characters. The fix for CVE-2019-10098 was not effective.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:3958 advisory.

  - httpd:  bypass with a trailing newline in the file name (CVE-2017-15715)

  - httpd: Improper handling of headers in mod_session can allow a remote user to modify session data for CGI     applications (CVE-2018-1283)

  - httpd: Out of bounds read in mod_cache_socache can allow a remote attacker to cause DoS (CVE-2018-1303)

  - httpd: mod_rewrite potential open redirect (CVE-2019-10098)

  - httpd: mod_rewrite configurations vulnerable to open redirect (CVE-2020-1927)

  - httpd: mod_proxy_ftp use of uninitialized value (CVE-2020-1934)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - httpd: Improper handling of headers in mod_session can     allow a remote user to modify session data for CGI     applications (CVE-2018-1283)

  - httpd: Out of bounds read in mod_cache_socache can allow     a remote attacker to cause DoS (CVE-2018-1303)

  - httpd: mod_rewrite configurations vulnerable to open     redirect (CVE-2020-1927)

  - httpd: <FilesMatch> bypass with a trailing newline in     the file name (CVE-2017-15715)

  - httpd: mod_rewrite potential open redirect     (CVE-2019-10098)

  - httpd: mod_proxy_ftp use of uninitialized value     (CVE-2020-1934)

遠端 Redhat Enterprise Linux 8 主機上安裝的套件受到 RHSA-2020: 4751 公告中所提及的多個弱點影響。

  - httpd：mod_http2：透過緩慢且不需要的要求內文造成 DoS (CVE-2018-17189)

  - httpd：mod_http2：執行字串比較時發生釋放後讀取 (CVE-2019-0196)

  - httpd：mod_http2：執行最新更新時可能發生當機 (CVE-2019-0197)

  - httpd：早期推送中發生記憶體損壞 (CVE-2019-10081)

  - httpd：h2 連接關閉中存在釋放後讀取問題 (CVE-2019-10082)

  - httpd：mod_proxy 錯誤頁面中存在受限的跨網站指令碼 (CVE-2019-10092)

  - httpd：mod_remoteip 中存在 NULL 指標解除參照問題 (CVE-2019-10097)

  - httpd：mod_rewrite 中可能存在開放重新導向 (CVE-2019-10098)

  - httpd：mod_rewrite 組態容易受到開放重新導向影響 (CVE-2020-1927)

  - httpd：mod_proxy_ftp 使用未初始化的值 (CVE-2020-1934)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 Debian 9 主機上安裝的多個套件受到 dla-2706 公告中提及的多個弱點影響。

  - 在 Apache HTTP Server 2.4.0 至 2.4.41 中，以 mod_rewrite 設定的重新導向 (原用於自我參照) 可能會遭到編碼的新行誘騙，而重新導向至要求 URL 內的非預期 URL。(CVE-2020-1927)

  - 在 Apache HTTP Server 2.4.0 至 2.4.41 中，mod_proxy_ftp 在代理惡意 FTP 伺服器時可能使用未初始化的記憶體。(CVE-2020-1934)

  - 在 Apache HTTP Server 2.4.0 到 2.4.46 版中，特製的 Digest nonce 可能會在 mod_auth_digest 中造成堆疊溢位。目前尚無此溢位遭惡意利用的報告，Apache HTTP Server 團隊也無法建立溢位，不過某些特定的編譯器和/或編譯選項可能會造成溢位，但由於溢位的大小 (單一位元組) 和值 (零位元組)，因此所導致的後果有限 (CVE-2020-35452)

  - 在 Apache HTTP Server 2.4.0 到 2.4.46 版中，由 mod_session 處理的特製 Cookie 標頭可能會造成 NULL 指標解除參照和損毀，進而導致可能的拒絕服務 (CVE-2021-26690)

  - 在 Apache HTTP Server 2.4.0 到 2.4.46 版中，由原始伺服器傳送的特製 SessionHeader 可能會造成堆積溢位 (CVE-2021-26691)

  - 在 Apache HTTP Server 2.4.39 到 2.4.46 版中，「MergeSlashes OFF」的意外比對行為 (CVE-2021-30641)

  - HTTP/2 通訊協定的 Apache HTTP 伺服器通訊協定處置程式會根據為伺服器設定並用於 HTTP/1 通訊協定的大小限制，檢查所收到的要求標頭。違反這些限制時，系統會將 HTTP 回應傳送至用戶端，並附上指示拒絕要求原因的狀態程式碼。如果違規標頭是第一個收到或出現在頁尾的違規標頭，此拒絕回應就不會在 HTTP/2 通訊協定處置程式中完全初始化。這會導致初始化記憶體上發生 NULL 指標解除參照，進而損毀子處理程序。由於此類觸發 HTTP/2 的要求極易於製作和提交，因此可能遭惡意利用來使伺服器 DoS。此問題只會影響 mod_http2 1.15.17 和 Apache HTTP Server 2.4.47 版本。Apache HTTP Server 2.4.47 未曾發行過。(CVE-2021-31618)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端主機上執行的 IBM HTTP Server 版本受到與 Apache HTTP Server 有關的多個弱點影響，具體如下：

  - 在 Apache HTTP Server 2.4.0 至 2.4.41 中，以 mod_rewrite 設定的重新導向 (原用於自我參照) 可能會遭到編碼的新行誘騙，而重新導向至要求 URL 內的非預期 URL。(CVE-2020-1927)

  - 在 Apache HTTP Server 2.4.0 至 2.4.41 中，mod_proxy_ftp 在代理惡意 FTP 伺服器時可能使用未初始化的記憶體。(CVE-2020-1934)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼。

遠端 Redhat Enterprise Linux 6 / 7 主機上安裝的套件受到 RHSA-2020: 2644 公告中提及的多個弱點影響。

  - expat：輸入中大量的冒號會使剖析器消耗大量資源，進而導致 DoS (CVE-2018-20843)

  - httpd：mod_http2：執行字串比較時發生釋放後讀取 (CVE-2019-0196)

  - httpd：mod_http2：執行最新更新時可能發生當機 (CVE-2019-0197)

  - expat：透過特製的 XML 輸入，存在堆積型緩衝區過度讀取 (CVE-2019-15903)

  - libxml2：parser.c 的 xmlParseBalancedChunkMemoryRecover 中發生記憶體洩漏 (CVE-2019-19956)

  - libxml2：xmlschemas.c 的 xmlSchemaPreRun 中發生記憶體洩漏 (CVE-2019-20388)

  - nghttp2：SETTINGS 框架過大可導致 DoS (CVE-2020-11080)

  - httpd：mod_proxy_ftp 使用未初始化的值 (CVE-2020-1934)

  - libxml2：在某些檔案結尾情況下，xmlStringLenDecodeEntities 中存在無限迴圈 (CVE-2020-7595)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端 CentOS Linux 7 主機上安裝的套件受到 CESA-2020: 3958 公告中所提及的一個弱點影響。

  - httpd：在檔案名稱中發生結尾新行繞過 (CVE-2017-15715)

  - httpd：在 mod_session 中不當處理標頭可讓遠端使用者修改 CGI 應用程式的工作階段資料 (CVE-2018-1283)

  - httpd：mod_cache_socache 中的超出邊界讀取問題可讓遠端攻擊者造成拒絕服務 (CVE-2018-1303)

  - httpd：mod_rewrite 中可能存在開放重新導向 (CVE-2019-10098)

  - httpd：mod_rewrite 組態容易受到開放重新導向影響 (CVE-2020-1927)

  - httpd：mod_proxy_ftp 使用未初始化的值 (CVE-2020-1934)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼。

安全性修正：

  - httpd：在 mod_session 中不當處理標頭可讓遠端使用者修改 CGI 應用程式的工作階段資料 (CVE-2018-1283)

  - httpd：mod_cache_socache 中的超出邊界讀取問題可讓遠端攻擊者造成拒絕服務 (CVE-2018-1303)

  - httpd：mod_rewrite 組態容易受到開放重新導向影響 (CVE-2020-1927)

  - httpd：<FilesMatch>在檔案名稱中發生結尾新行繞過 (CVE-2017-15715)

  - httpd：mod_rewrite 中可能存在開放重新導向 (CVE-2019-10098)

  - httpd：mod_proxy_ftp 使用未初始化的值 (CVE-2020-1934)

執行 CORE 5.04 / MAIN 5.04 版的遠端 NewStart CGSL 主機上安裝的 httpd 套件受到多個弱點影響：

  - 在 Apache HTTP 伺服器 2.4.0 至 2.4.39 中，以 mod_rewrite 設定的重新導向 (原用於自我參照) 可能會遭到編碼的新行誘騙，而重新導向至要求 URL 內的非預期 URL。(CVE-2019-10098)

  - 在 Apache httpd 2.4.0 至 2.4.29 版中，mod_session 設定為將工作階段資料轉送至 CGI 應用程式時 (啟用 SessionEnv，但並非預設設定)，遠端使用者可能使用「Session」標頭來影響其內容。此問題是 mod_session 用來將其資料轉送至 CGI 的 HTTP_SESSION 變數名稱所致，因為 Apache HTTP Server 也使用前置詞 HTTP_ 來傳送 HTTP 標頭欄位 (依 CGI 規格)。(CVE-2018-1283)

  - 特別建構的 HTTP 要求可能損毀 Apache HTTP Server 2.4.30 之前的版本，這是準備在共用記憶體中快取的資料時發生超出邊界讀取所致。它可以用作針對 mod_cache_socache 使用者的拒絕服務攻擊。此弱點被視為低風險，因為 mod_cache_socache 並未廣泛使用，而且 mod_cache_disk 與此弱點無關。
    (CVE-2018-1303)

  - 在 Apache httpd 2.4.0 至 2.4.29 中，<FilesMatch> 中指定的運算式可以將「$」與惡意檔案名稱中的新行字元比對，而不是只比對檔案名稱的結尾。在外部封鎖部分檔案上傳的環境中，此問題可能會遭到惡意利用，但只能透過比對檔案名稱的結尾部分來利用。(CVE-2017-15715)

  - 在 Apache HTTP Server 2.4.0 至 2.4.41 中，以 mod_rewrite 設定的重新導向 (原用於自我參照) 可能會遭到編碼的新行誘騙，而重新導向至要求 URL 內的非預期 URL。(CVE-2020-1927)

  - 在 Apache HTTP Server 2.4.0 至 2.4.41 中，mod_proxy_ftp 在代理惡意 FTP 伺服器時可能使用未初始化的記憶體。(CVE-2020-1934)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼。

ID	名稱	產品	系列	已發布	已更新	嚴重性
144070	IBM HTTP Server 7.0.0.0 <= 7.0.0.45 / 8.0.0.0 <= 8.0.0.15 / 8.5.0.0 < 8.5.5.18 / 9.0.0.0 < 9.0.5.4 Multiple Vulnerabilities (6191631)	Nessus	Web Servers	2020/12/10	2022/12/5	medium
137705	RHEL 6 / 7 : Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP3 (RHSA-2020:2644)	Nessus	Red Hat Local Security Checks	2020/6/22	2024/3/6	medium
142397	RHEL 8 : httpd:2.4 (RHSA-2020:4751)	Nessus	Red Hat Local Security Checks	2020/11/4	2024/6/3	critical
140870	EulerOS 2.0 SP3 : httpd (EulerOS-SA-2020-2103)	Nessus	Huawei Local Security Checks	2020/9/28	2024/2/19	medium
135194	FreeBSD : Apache -- Multiple vulnerabilities (b360b120-74b1-11ea-a84a-4c72b94353b5)	Nessus	FreeBSD Local Security Checks	2020/4/3	2022/12/5	medium
141584	CentOS 7 : httpd (CESA-2020:3958)	Nessus	CentOS Local Security Checks	2020/10/20	2022/12/5	high
141711	Scientific Linux Security Update : httpd on SL7.x x86_64 (20201001)	Nessus	Scientific Linux Local Security Checks	2020/10/21	2024/2/14	high
142397	RHEL 8：httpd：2.4 (RHSA-2020: 4751)	Nessus	Red Hat Local Security Checks	2020/11/4	2024/6/3	critical
151486	Debian DLA-2706-1：apache2 - LTS 安全性更新	Nessus	Debian Local Security Checks	2021/7/9	2023/12/8	critical
144070	IBM HTTP Server 7.0.0.0 <= 7.0.0.45 / 8.0.0.0 <= 8.0.0.15 / 8.5.0.0 < 8.5.5.18 / 9.0.0.0 < 9.0.5.4 多個弱點 (6191631)	Nessus	Web Servers	2020/12/10	2022/12/5	medium
137705	RHEL 6/7：Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP3 (RHSA-2020: 2644)	Nessus	Red Hat Local Security Checks	2020/6/22	2024/3/6	medium
141584	CentOS 7：httpd (CESA-2020: 3958)	Nessus	CentOS Local Security Checks	2020/10/20	2022/12/5	high
141711	Scientific Linux 安全性更新：SL7.x x86_64 上的 httpd (20201001)	Nessus	Scientific Linux Local Security Checks	2020/10/21	2024/2/14	high
147353	NewStart CGSL CORE 5.04 / MAIN 5.04：httpd 多個弱點 (NS-SA-2021-0036)	Nessus	NewStart CGSL Local Security Checks	2021/3/10	2022/12/5	high

偵測

搜尋 Plugin

medium

medium

critical

medium

medium

high

high

critical

critical

medium

medium

high

high

high