CVEvulnerability

CVE-2020-11993

7.5 HIGH Published 2020-08-07 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2020-08-07
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:N/A:P
Weaknesses
CWE-444

Description

Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were made on the wrong connection, causing concurrent use of memory pools. Configuring the LogLevel of mod_http2 above "info" will mitigate this vulnerability for unpatched servers.

Affected configurations

• apache http server (>= 2.4.20 < 2.4.44) • netapp clustered data ontap • canonical ubuntu linux 16.04 • canonical ubuntu linux 18.04 • canonical ubuntu linux 20.04 • opensuse leap 15.1 • opensuse leap 15.2 • debian debian linux 10.0 • fedoraproject fedora 31 • fedoraproject fedora 32 • oracle communications element manager (>= 8.2.0 <= 8.2.2) • oracle communications session report manager (>= 8.2.0 <= 8.2.2) • oracle communications session route manager (>= 8.2.0 <= 8.2.2) • oracle enterprise manager ops center 12.4.0.0 • oracle hyperion infrastructure technology 11.1.2.4 • oracle instantis enterprisetrack 17.1 • oracle instantis enterprisetrack 17.2 • oracle instantis enterprisetrack 17.3 • oracle zfs storage appliance kit 8.8

Related

Weakness · CWE (1)

  • CWE-444 Inconsistent Interpretation of HTTP Requests weakness

References