Vulnerability · Published Apr 1, 2020 · Assigned by apache
CVE-2020-1934
Medium 5.3
In plain English
A medium-severity security flaw in Apache HTTP Server from Apache. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 52.0% (higher than 99% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.3Medium
Exploit odds (30 days)52.0%top 1.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | mod_md | 1:2.0.8-8.module_el8.6.0+2872+fe0ff7aa | ALSA-2020:4751 |
| AlmaLinux:8 | mod_md | 1:2.0.8-8.module_el8.5.0+2609+b30d9eec | ALSA-2020:4751 |
| Alpine:v3.20 | apache2 | 2.4.43-r0 | ALPINE-CVE-2020-1934 |
| Alpine:v3.21 | apache2 | 2.4.43-r0 | ALPINE-CVE-2020-1934 |
| Alpine:v3.22 | apache2 | 2.4.43-r0 | ALPINE-CVE-2020-1934 |
| Alpine:v3.23 | apache2 | 2.4.43-r0 | ALPINE-CVE-2020-1934 |
| Alpine:v3.24 | apache2 | 2.4.43-r0 | ALPINE-CVE-2020-1934 |
| Debian:12 | apache2 | 2.4.43-1 | DEBIAN-CVE-2020-1934 |
| Debian:13 | apache2 | 2.4.43-1 | DEBIAN-CVE-2020-1934 |
| Debian:14 | apache2 | 2.4.43-1 | DEBIAN-CVE-2020-1934 |
| Rocky Linux:8 | mod_md | 1:2.0.8-8.module+el8.5.0+695+1fa8055e | RLSA-2020:4751 |
| Rocky Linux:8 | mod_md | 1:2.0.8-8.module+el8.4.0+553+7a69454b | RLSA-2020:4751 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache | Apache HTTP Server | 2.4.0 to 2.4.41 |
References
- [httpd-dev] 20200404 Odd vulnerabilities_24.html output mailing-list, x_refsource_MLIST
- [httpd-dev] 20200404 Re: Odd vulnerabilities_24.html output mailing-list, x_refsource_MLIST
- [httpd-cvs] 20200420 svn commit: r1876764 - /httpd/httpd/branches/2.4.x/CHANGES mailing-list, x_refsource_MLIST
- openSUSE-SU-2020:0597 vendor-advisory, x_refsource_SUSE
- https://www.oracle.com/security-alerts/cpujul2020.html x_refsource_MISC
- https://httpd.apache.org/security/vulnerabilities_24.html x_refsource_CONFIRM
- https://security.netapp.com/advisory/ntap-20200413-0002/ x_refsource_CONFIRM
- USN-4458-1 vendor-advisory, x_refsource_UBUNTU
- FEDORA-2020-189a1e6c3e vendor-advisory, x_refsource_FEDORA
- DSA-4757 vendor-advisory, x_refsource_DEBIAN
- FEDORA-2020-0d3d3f5072 vendor-advisory, x_refsource_FEDORA
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list, x_refsource_MLIST
- [httpd-cvs] 20210330 svn commit: r1073143 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/ mailing-list, x_refsource_MLIST
- [httpd-cvs] 20210330 svn commit: r1888194 [13/13] - /httpd/site/trunk/content/security/json/ mailing-list, x_refsource_MLIST
- [httpd-cvs] 20210330 svn commit: r1073140 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list, x_refsource_MLIST
- [httpd-cvs] 20210330 svn commit: r1073139 [13/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list, x_refsource_MLIST
- [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list, x_refsource_MLIST
- [httpd-cvs] 20210330 svn commit: r1073149 [13/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list, x_refsource_MLIST
- [httpd-cvs] 20210330 svn commit: r1073157 - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-1934.json security/vulnerabilities_24.html mailing-list, x_refsource_MLIST
- [httpd-cvs] 20210330 svn commit: r1888213 - /httpd/site/trunk/content/security/json/CVE-2020-1934.json mailing-list, x_refsource_MLIST
- [httpd-cvs] 20210603 svn commit: r1075360 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list, x_refsource_MLIST
- [httpd-cvs] 20210606 svn commit: r1075470 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list, x_refsource_MLIST
- [debian-lts-announce] 20210709 [SECURITY] [DLA 2706-1] apache2 security update mailing-list, x_refsource_MLIST