RHSA-2020:4751
Vulnerability from csaf_opensuse - Published: 2020-11-03 00:00 - Updated: 2026-09-20 11:12Summary
security update for httpd
Severity
Moderate
Notes
Title of the patch: security update for httpd
Description of the patch: This security update provides a functional equivalent of RHSA-2020:4751.
The original Red Hat(R) advisory is available from the Red Hat web site at
https://access.redhat.com/errata/RHSA-2020:4751.
Patchnames: RHSA-2020:4751
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
4.3 (Medium)
Affected products
Recommended
11 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Liberty Linux 8:httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 8:httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 8:httpd-manual-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 8:httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 8:mod_http2-0:1.15.7-2.module+el8.3.0+7670+8bf57d29.x86_64::httpd:2.4 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 8:mod_ldap-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 8:mod_session-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Liberty Linux 8:mod_ssl-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4 | — |
Vendor Fix
|
Threats
Impact
moderate
5 (Medium)
Affected products
Recommended
11 products, the same list as for
CVE-2018-17189
Threats
Impact
moderate
4.2 (Medium)
Affected products
Recommended
11 products, the same list as for
CVE-2018-17189
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
11 products, the same list as for
CVE-2018-17189
Threats
Impact
low
5.3 (Medium)
Affected products
Recommended
11 products, the same list as for
CVE-2018-17189
Threats
Impact
low
7.1 (High)
Affected products
Recommended
11 products, the same list as for
CVE-2018-17189
Threats
Impact
low
4.9 (Medium)
Affected products
Recommended
11 products, the same list as for
CVE-2018-17189
Threats
Impact
low
8.2 (High)
Affected products
Recommended
11 products, the same list as for
CVE-2018-17189
Threats
Impact
low
6.1 (Medium)
Affected products
Recommended
11 products, the same list as for
CVE-2018-17189
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
11 products, the same list as for
CVE-2018-17189
Threats
Impact
moderate
References
39 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "security update for httpd",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This security update provides a functional equivalent of RHSA-2020:4751.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2020:4751.\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "RHSA-2020:4751",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2020_4751.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-17189 page",
"url": "https://www.suse.com/security/cve/CVE-2018-17189/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-0196 page",
"url": "https://www.suse.com/security/cve/CVE-2019-0196/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-0197 page",
"url": "https://www.suse.com/security/cve/CVE-2019-0197/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-10081 page",
"url": "https://www.suse.com/security/cve/CVE-2019-10081/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-10082 page",
"url": "https://www.suse.com/security/cve/CVE-2019-10082/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-10092 page",
"url": "https://www.suse.com/security/cve/CVE-2019-10092/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-10097 page",
"url": "https://www.suse.com/security/cve/CVE-2019-10097/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-10098 page",
"url": "https://www.suse.com/security/cve/CVE-2019-10098/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-1927 page",
"url": "https://www.suse.com/security/cve/CVE-2020-1927/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-1934 page",
"url": "https://www.suse.com/security/cve/CVE-2020-1934/"
}
],
"title": "security update for httpd",
"tracking": {
"current_release_date": "2026-09-20T11:12:04Z",
"generator": {
"date": "2020-11-03T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "RHSA-2020:4751",
"initial_release_date": "2020-11-03T00:00:00Z",
"revision_history": [
{
"date": "2020-11-03T00:00:00Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-20T11:12:04Z",
"number": "2",
"summary": "unknown changes"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "httpd-filesystem-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"product": {
"name": "httpd-filesystem-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch (httpd:2.4)",
"product_id": "httpd-filesystem-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"product_identification_helper": {
"purl": "pkg:rpm/suse/httpd-filesystem@2.4.37-30.module+el8.3.0+7001+0766b9e7?arch=noarch\u0026rpmmod=httpd:2.4:8030020201104103500:rhel8"
}
}
},
{
"category": "product_version",
"name": "httpd-manual-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"product": {
"name": "httpd-manual-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch (httpd:2.4)",
"product_id": "httpd-manual-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"product_identification_helper": {
"purl": "pkg:rpm/suse/httpd-manual@2.4.37-30.module+el8.3.0+7001+0766b9e7?arch=noarch\u0026rpmmod=httpd:2.4:8030020201104103500:rhel8"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"product": {
"name": "httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64 (httpd:2.4)",
"product_id": "httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"product_identification_helper": {
"purl": "pkg:rpm/suse/httpd@2.4.37-30.module+el8.3.0+7001+0766b9e7?arch=x86_64\u0026rpmmod=httpd:2.4:8030020201104103500:rhel8"
}
}
},
{
"category": "product_version",
"name": "httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"product": {
"name": "httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64 (httpd:2.4)",
"product_id": "httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"product_identification_helper": {
"purl": "pkg:rpm/suse/httpd-devel@2.4.37-30.module+el8.3.0+7001+0766b9e7?arch=x86_64\u0026rpmmod=httpd:2.4:8030020201104103500:rhel8"
}
}
},
{
"category": "product_version",
"name": "httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"product": {
"name": "httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64 (httpd:2.4)",
"product_id": "httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"product_identification_helper": {
"purl": "pkg:rpm/suse/httpd-tools@2.4.37-30.module+el8.3.0+7001+0766b9e7?arch=x86_64\u0026rpmmod=httpd:2.4:8030020201104103500:rhel8"
}
}
},
{
"category": "product_version",
"name": "mod_http2-0:1.15.7-2.module+el8.3.0+7670+8bf57d29.x86_64::httpd:2.4",
"product": {
"name": "mod_http2-0:1.15.7-2.module+el8.3.0+7670+8bf57d29.x86_64 (httpd:2.4)",
"product_id": "mod_http2-0:1.15.7-2.module+el8.3.0+7670+8bf57d29.x86_64::httpd:2.4",
"product_identification_helper": {
"purl": "pkg:rpm/suse/mod_http2@1.15.7-2.module+el8.3.0+7670+8bf57d29?arch=x86_64\u0026rpmmod=httpd:2.4:8030020201104103500:rhel8"
}
}
},
{
"category": "product_version",
"name": "mod_ldap-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"product": {
"name": "mod_ldap-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64 (httpd:2.4)",
"product_id": "mod_ldap-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"product_identification_helper": {
"purl": "pkg:rpm/suse/mod_ldap@2.4.37-30.module+el8.3.0+7001+0766b9e7?arch=x86_64\u0026rpmmod=httpd:2.4:8030020201104103500:rhel8"
}
}
},
{
"category": "product_version",
"name": "mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"product": {
"name": "mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64 (httpd:2.4)",
"product_id": "mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"product_identification_helper": {
"purl": "pkg:rpm/suse/mod_md@2.0.8-8.module+el8.3.0+6814+67d1e611?arch=x86_64\u0026rpmmod=httpd:2.4:8000020230912110926:rhel8\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "mod_proxy_html-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"product": {
"name": "mod_proxy_html-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64 (httpd:2.4)",
"product_id": "mod_proxy_html-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"product_identification_helper": {
"purl": "pkg:rpm/suse/mod_proxy_html@2.4.37-30.module+el8.3.0+7001+0766b9e7?arch=x86_64\u0026rpmmod=httpd:2.4:8030020201104103500:rhel8\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "mod_session-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"product": {
"name": "mod_session-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64 (httpd:2.4)",
"product_id": "mod_session-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"product_identification_helper": {
"purl": "pkg:rpm/suse/mod_session@2.4.37-30.module+el8.3.0+7001+0766b9e7?arch=x86_64\u0026rpmmod=httpd:2.4:8030020201104103500:rhel8"
}
}
},
{
"category": "product_version",
"name": "mod_ssl-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"product": {
"name": "mod_ssl-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64 (httpd:2.4)",
"product_id": "mod_ssl-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"product_identification_helper": {
"purl": "pkg:rpm/suse/mod_ssl@2.4.37-30.module+el8.3.0+7001+0766b9e7?arch=x86_64\u0026rpmmod=httpd:2.4:8030020201104103500:rhel8\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Liberty Linux 8",
"product": {
"name": "SUSE Liberty Linux 8",
"product_id": "SUSE Liberty Linux 8",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sll:8"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4 as component of SUSE Liberty Linux 8",
"product_id": "SUSE Liberty Linux 8:httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4"
},
"product_reference": "httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"relates_to_product_reference": "SUSE Liberty Linux 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4 as component of SUSE Liberty Linux 8",
"product_id": "SUSE Liberty Linux 8:httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4"
},
"product_reference": "httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"relates_to_product_reference": "SUSE Liberty Linux 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-filesystem-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4 as component of SUSE Liberty Linux 8",
"product_id": "SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4"
},
"product_reference": "httpd-filesystem-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"relates_to_product_reference": "SUSE Liberty Linux 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-manual-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4 as component of SUSE Liberty Linux 8",
"product_id": "SUSE Liberty Linux 8:httpd-manual-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4"
},
"product_reference": "httpd-manual-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"relates_to_product_reference": "SUSE Liberty Linux 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4 as component of SUSE Liberty Linux 8",
"product_id": "SUSE Liberty Linux 8:httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4"
},
"product_reference": "httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"relates_to_product_reference": "SUSE Liberty Linux 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_http2-0:1.15.7-2.module+el8.3.0+7670+8bf57d29.x86_64::httpd:2.4 as component of SUSE Liberty Linux 8",
"product_id": "SUSE Liberty Linux 8:mod_http2-0:1.15.7-2.module+el8.3.0+7670+8bf57d29.x86_64::httpd:2.4"
},
"product_reference": "mod_http2-0:1.15.7-2.module+el8.3.0+7670+8bf57d29.x86_64::httpd:2.4",
"relates_to_product_reference": "SUSE Liberty Linux 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_ldap-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4 as component of SUSE Liberty Linux 8",
"product_id": "SUSE Liberty Linux 8:mod_ldap-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4"
},
"product_reference": "mod_ldap-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"relates_to_product_reference": "SUSE Liberty Linux 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4 as component of SUSE Liberty Linux 8",
"product_id": "SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4"
},
"product_reference": "mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"relates_to_product_reference": "SUSE Liberty Linux 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_proxy_html-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4 as component of SUSE Liberty Linux 8",
"product_id": "SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4"
},
"product_reference": "mod_proxy_html-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"relates_to_product_reference": "SUSE Liberty Linux 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_session-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4 as component of SUSE Liberty Linux 8",
"product_id": "SUSE Liberty Linux 8:mod_session-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4"
},
"product_reference": "mod_session-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"relates_to_product_reference": "SUSE Liberty Linux 8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mod_ssl-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4 as component of SUSE Liberty Linux 8",
"product_id": "SUSE Liberty Linux 8:mod_ssl-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4"
},
"product_reference": "mod_ssl-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"relates_to_product_reference": "SUSE Liberty Linux 8"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2018-17189",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-17189"
}
],
"notes": [
{
"category": "general",
"text": "In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-2.module+el8.3.0+7670+8bf57d29.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-17189",
"url": "https://www.suse.com/security/cve/CVE-2018-17189"
},
{
"category": "external",
"summary": "SUSE Bug 1122838 for CVE-2018-17189",
"url": "https://bugzilla.suse.com/1122838"
},
{
"category": "external",
"summary": "SUSE Bug 1125965 for CVE-2018-17189",
"url": "https://bugzilla.suse.com/1125965"
},
{
"category": "external",
"summary": "SUSE Bug 1126894 for CVE-2018-17189",
"url": "https://bugzilla.suse.com/1126894"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-2.module+el8.3.0+7670+8bf57d29.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-2.module+el8.3.0+7670+8bf57d29.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-11-03T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2018-17189"
},
{
"cve": "CVE-2019-0196",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-0196"
}
],
"notes": [
{
"category": "general",
"text": "A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-2.module+el8.3.0+7670+8bf57d29.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-0196",
"url": "https://www.suse.com/security/cve/CVE-2019-0196"
},
{
"category": "external",
"summary": "SUSE Bug 1131237 for CVE-2019-0196",
"url": "https://bugzilla.suse.com/1131237"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-2.module+el8.3.0+7670+8bf57d29.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-2.module+el8.3.0+7670+8bf57d29.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-11-03T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2019-0196"
},
{
"cve": "CVE-2019-0197",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-0197"
}
],
"notes": [
{
"category": "general",
"text": "A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set \"H2Upgrade on\" are unaffected by this issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-2.module+el8.3.0+7670+8bf57d29.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-0197",
"url": "https://www.suse.com/security/cve/CVE-2019-0197"
},
{
"category": "external",
"summary": "SUSE Bug 1131245 for CVE-2019-0197",
"url": "https://bugzilla.suse.com/1131245"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-2.module+el8.3.0+7670+8bf57d29.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-2.module+el8.3.0+7670+8bf57d29.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-11-03T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2019-0197"
},
{
"cve": "CVE-2019-10081",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-10081"
}
],
"notes": [
{
"category": "general",
"text": "HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with \"H2PushResource\", could lead to an overwrite of memory in the pushing request\u0027s pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-2.module+el8.3.0+7670+8bf57d29.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-10081",
"url": "https://www.suse.com/security/cve/CVE-2019-10081"
},
{
"category": "external",
"summary": "SUSE Bug 1145742 for CVE-2019-10081",
"url": "https://bugzilla.suse.com/1145742"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-2.module+el8.3.0+7670+8bf57d29.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-2.module+el8.3.0+7670+8bf57d29.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-11-03T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2019-10081"
},
{
"cve": "CVE-2019-10082",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-10082"
}
],
"notes": [
{
"category": "general",
"text": "In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection shutdown.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-2.module+el8.3.0+7670+8bf57d29.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-10082",
"url": "https://www.suse.com/security/cve/CVE-2019-10082"
},
{
"category": "external",
"summary": "SUSE Bug 1145741 for CVE-2019-10082",
"url": "https://bugzilla.suse.com/1145741"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-2.module+el8.3.0+7670+8bf57d29.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-2.module+el8.3.0+7670+8bf57d29.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-11-03T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2019-10082"
},
{
"cve": "CVE-2019-10092",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-10092"
}
],
"notes": [
{
"category": "general",
"text": "In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-2.module+el8.3.0+7670+8bf57d29.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-10092",
"url": "https://www.suse.com/security/cve/CVE-2019-10092"
},
{
"category": "external",
"summary": "SUSE Bug 1145740 for CVE-2019-10092",
"url": "https://bugzilla.suse.com/1145740"
},
{
"category": "external",
"summary": "SUSE Bug 1182703 for CVE-2019-10092",
"url": "https://bugzilla.suse.com/1182703"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-2.module+el8.3.0+7670+8bf57d29.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-2.module+el8.3.0+7670+8bf57d29.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-11-03T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2019-10092"
},
{
"cve": "CVE-2019-10097",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-10097"
}
],
"notes": [
{
"category": "general",
"text": "In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the \"PROXY\" protocol, a specially crafted PROXY header could trigger a stack buffer overflow or NULL pointer deference. This vulnerability could only be triggered by a trusted proxy and not by untrusted HTTP clients.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-2.module+el8.3.0+7670+8bf57d29.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-10097",
"url": "https://www.suse.com/security/cve/CVE-2019-10097"
},
{
"category": "external",
"summary": "SUSE Bug 1145739 for CVE-2019-10097",
"url": "https://bugzilla.suse.com/1145739"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-2.module+el8.3.0+7670+8bf57d29.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-2.module+el8.3.0+7670+8bf57d29.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-11-03T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2019-10097"
},
{
"cve": "CVE-2019-10098",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-10098"
}
],
"notes": [
{
"category": "general",
"text": "In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-2.module+el8.3.0+7670+8bf57d29.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-10098",
"url": "https://www.suse.com/security/cve/CVE-2019-10098"
},
{
"category": "external",
"summary": "SUSE Bug 1145738 for CVE-2019-10098",
"url": "https://bugzilla.suse.com/1145738"
},
{
"category": "external",
"summary": "SUSE Bug 1168407 for CVE-2019-10098",
"url": "https://bugzilla.suse.com/1168407"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-2.module+el8.3.0+7670+8bf57d29.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.0"
},
"products": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-2.module+el8.3.0+7670+8bf57d29.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-11-03T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2019-10098"
},
{
"cve": "CVE-2020-1927",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-1927"
}
],
"notes": [
{
"category": "general",
"text": "In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-2.module+el8.3.0+7670+8bf57d29.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-1927",
"url": "https://www.suse.com/security/cve/CVE-2020-1927"
},
{
"category": "external",
"summary": "SUSE Bug 1145738 for CVE-2020-1927",
"url": "https://bugzilla.suse.com/1145738"
},
{
"category": "external",
"summary": "SUSE Bug 1168407 for CVE-2020-1927",
"url": "https://bugzilla.suse.com/1168407"
},
{
"category": "external",
"summary": "SUSE Bug 1170718 for CVE-2020-1927",
"url": "https://bugzilla.suse.com/1170718"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-2.module+el8.3.0+7670+8bf57d29.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-2.module+el8.3.0+7670+8bf57d29.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-11-03T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-1927"
},
{
"cve": "CVE-2020-1934",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-1934"
}
],
"notes": [
{
"category": "general",
"text": "In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-2.module+el8.3.0+7670+8bf57d29.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-1934",
"url": "https://www.suse.com/security/cve/CVE-2020-1934"
},
{
"category": "external",
"summary": "SUSE Bug 1168404 for CVE-2020-1934",
"url": "https://bugzilla.suse.com/1168404"
},
{
"category": "external",
"summary": "SUSE Bug 1170718 for CVE-2020-1934",
"url": "https://bugzilla.suse.com/1170718"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-2.module+el8.3.0+7670+8bf57d29.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 8:httpd-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-devel-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:httpd-filesystem-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-manual-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.noarch::httpd:2.4",
"SUSE Liberty Linux 8:httpd-tools-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_http2-0:1.15.7-2.module+el8.3.0+7670+8bf57d29.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ldap-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_md-1:2.0.8-8.module+el8.3.0+6814+67d1e611.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_proxy_html-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_session-0:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4",
"SUSE Liberty Linux 8:mod_ssl-1:2.4.37-30.module+el8.3.0+7001+0766b9e7.x86_64::httpd:2.4"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-11-03T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-1934"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…