HIGH 7.5 Microsoft
CVE-2020-11993
Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns logging statements were made on the wrong connection causing concurrent use of memory pools. Configuring the LogLevel of mod_http2 above "info" will mitigate this vulnerability for unpatched servers.
Microsoft Security Update 2020-Aug: Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns logging statements were made on the wrong connection causing concurrent use of memory pools. Configuring the LogLevel of mod_http2 above "info" will mitigate this vulnerability for unpatched servers.
Affected Products
- cm1 httpd 2.4.46-5 on CBL Mariner 1.0
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-11993
- https://nvd.nist.gov/vuln/detail/CVE-2020-11993
This high severity vulnerability with a CVSS score of 7.5 was published on 2020-08-11 via Microsoft. EPSS score: 58.7% (top 1% of all CVEs by exploitation probability). Affected: cm1 httpd 2.4.46-5 on CBL Mariner 1.0.
vulnfeed aggregates 9909 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.