SB2020082529 - Fedora 32 update for httpd
Published: August 25, 2020 Updated: July 3, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Buffer overflow (CVE-ID: CVE-2020-11984)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in od_proxy_uwsgi module. A remote attacker can send a specially crafted request to the web server, trigger memory corruption and gain access to sensitive information or execute arbitrary code on the target system.
2) Open redirect (CVE-ID: CVE-2020-1927)
The vulnerability allows a remote attacker to redirect victims to arbitrary URL.
The vulnerability exists due to improper sanitization of user-supplied data in some "mod_rewrite" configurations. A remote attacker can create a link that leads to a trusted website, however, when clicked, redirects the victim to arbitrary domain.
Successful exploitation of this vulnerability may allow a remote attacker to perform a phishing attack and steal potentially sensitive information.
3) Use of Uninitialized Variable (CVE-ID: CVE-2020-1934)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to the "mod_proxy_ftp" may use uninitialized memory when proxying to a malicious FTP server. A remote attacker can gain unauthorized access to sensitive information on the target system.
4) Input validation error (CVE-ID: CVE-2020-11985)
The vulnerability allows a remote attacker to perform a spoofing attack.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can spoof the user's IP address when proxying using mod_remoteip and mod_rewrite, as a result the fake IP address will be displayed in logs and will be passed to PHP scripts.
Depending on web application functionality this vulnerability can be used to bypass authorization checks based on IP addresses.
Remediation
Install update from vendor's website.