{"id":"CVE-2020-11985","aliases":["BIT-apache-2020-11985","DEBIAN-CVE-2020-11985","EUVD-2020-4308","GHSA-39vm-h38v-j867","RHBA-2015:2194","RHSA-2017:1161","SUSE-SU-2020:2450-1","UBUNTU-CVE-2020-11985"],"status":"published","title":"IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using...","description":"IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Note this issue was fixed in Apache HTTP Server 2.4.24 but was retrospectively allocated a low severity CVE in 2020.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.07082,"percentile":0.94265,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-345"],"published":"2020-08-07T15:36:31Z","modified":"2026-10-26T12:01:25Z","fixes":[{"ecosystem":"Bitnami","package":"apache","fixed_in":["2.4.24"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"apache2","fixed_in":["2.4.25-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"apache2","fixed_in":["2.4.25-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"apache2","fixed_in":["2.4.25-1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"httpd","fixed_in":["0:2.4.6-40.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"httpd-debuginfo","fixed_in":["0:2.4.6-40.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"httpd-devel","fixed_in":["0:2.4.6-40.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"httpd-manual","fixed_in":["0:2.4.6-40.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"httpd-tools","fixed_in":["0:2.4.6-40.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"mod_ldap","fixed_in":["0:2.4.6-40.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"mod_proxy_html","fixed_in":["1:2.4.6-40.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"mod_session","fixed_in":["0:2.4.6-40.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"mod_ssl","fixed_in":["1:2.4.6-40.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"httpd","fixed_in":["0:2.4.6-40.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"httpd-debuginfo","fixed_in":["0:2.4.6-40.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"httpd-devel","fixed_in":["0:2.4.6-40.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"httpd-manual","fixed_in":["0:2.4.6-40.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"httpd-tools","fixed_in":["0:2.4.6-40.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"mod_ldap","fixed_in":["0:2.4.6-40.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"mod_proxy_html","fixed_in":["1:2.4.6-40.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"mod_session","fixed_in":["0:2.4.6-40.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"mod_ssl","fixed_in":["1:2.4.6-40.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"httpd-debuginfo","fixed_in":["0:2.4.6-40.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"mod_ldap","fixed_in":["0:2.4.6-40.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"mod_proxy_html","fixed_in":["1:2.4.6-40.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"mod_session","fixed_in":["0:2.4.6-40.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"httpd","fixed_in":["0:2.4.6-40.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"httpd-devel","fixed_in":["0:2.4.6-40.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"httpd-manual","fixed_in":["0:2.4.6-40.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"httpd-tools","fixed_in":["0:2.4.6-40.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"mod_ssl","fixed_in":["1:2.4.6-40.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"httpd-debuginfo","fixed_in":["0:2.4.6-40.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"mod_ldap","fixed_in":["0:2.4.6-40.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"mod_proxy_html","fixed_in":["1:2.4.6-40.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"mod_session","fixed_in":["0:2.4.6-40.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"httpd","fixed_in":["0:2.4.6-40.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"httpd-devel","fixed_in":["0:2.4.6-40.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"httpd-manual","fixed_in":["0:2.4.6-40.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"httpd-tools","fixed_in":["0:2.4.6-40.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"mod_ssl","fixed_in":["1:2.4.6-40.el7"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"apache2","fixed_in":["2.4.18-2ubuntu3.15"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"apache","ranges":[{"type":"SEMVER","events":[{"introduced":"2.4.1"},{"fixed":"2.4.24"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.25-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.25-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.25-1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-40.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-40.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-40.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-40.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-40.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-40.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-40.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-40.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-40.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-40.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-40.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-40.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-40.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-40.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-40.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-40.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-40.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-40.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-40.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-40.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-40.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-40.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-40.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-40.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-40.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-40.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-40.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-40.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-40.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-40.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-40.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-40.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-40.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-40.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-40.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.6-40.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.25-9.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.25-9.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.25-9.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.25-9.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.25-9.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.25-9.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.25-9.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.25-9.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.25-9.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"httpd24-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.25-9.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"httpd24-httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.25-9.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"httpd24-httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.25-9.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"httpd24-httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.25-9.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"httpd24-httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.25-9.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"httpd24-mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.25-9.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"httpd24-mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.25-9.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"httpd24-mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.25-9.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"httpd24-mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.25-9.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-29.63.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-29.63.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-29.63.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-29.63.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-29.63.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-29.63.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-29.63.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-29.63.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-29.63.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-29.63.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-29.63.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-29.63.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-29.63.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-29.63.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-29.63.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-29.63.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-29.63.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.23-29.63.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.6-2ubuntu2","2.4.6-2ubuntu3","2.4.6-2ubuntu4","2.4.7-1ubuntu1","2.4.7-1ubuntu2","2.4.7-1ubuntu3","2.4.7-1ubuntu4","2.4.7-1ubuntu4.1","2.4.7-1ubuntu4.4","2.4.7-1ubuntu4.5","2.4.7-1ubuntu4.6","2.4.7-1ubuntu4.7","2.4.7-1ubuntu4.8","2.4.7-1ubuntu4.9","2.4.7-1ubuntu4.10","2.4.7-1ubuntu4.11","2.4.7-1ubuntu4.13","2.4.7-1ubuntu4.15","2.4.7-1ubuntu4.16","2.4.7-1ubuntu4.17","2.4.7-1ubuntu4.18","2.4.7-1ubuntu4.19","2.4.7-1ubuntu4.20","2.4.7-1ubuntu4.21","2.4.7-1ubuntu4.22","2.4.7-1ubuntu4.22+esm1","2.4.7-1ubuntu4.22+esm2","2.4.7-1ubuntu4.22+esm3","2.4.7-1ubuntu4.22+esm4","2.4.7-1ubuntu4.22+esm5","2.4.7-1ubuntu4.22+esm6","2.4.7-1ubuntu4.22+esm8","2.4.7-1ubuntu4.22+esm9","2.4.7-1ubuntu4.22+esm10","2.4.7-1ubuntu4.22+esm12","2.4.7-1ubuntu4.22+esm13","2.4.7-1ubuntu4.22+esm14","2.4.7-1ubuntu4.22+esm15","2.4.7-1ubuntu4.22+esm16","2.4.7-1ubuntu4.22+esm17"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.18-2ubuntu3.15"}]}],"versions":["2.4.12-2ubuntu2","2.4.17-1ubuntu1","2.4.17-2ubuntu1","2.4.17-3ubuntu1","2.4.18-1ubuntu1","2.4.18-2ubuntu1","2.4.18-2ubuntu2","2.4.18-2ubuntu3","2.4.18-2ubuntu3.1","2.4.18-2ubuntu3.2","2.4.18-2ubuntu3.3","2.4.18-2ubuntu3.4","2.4.18-2ubuntu3.5","2.4.18-2ubuntu3.7","2.4.18-2ubuntu3.8","2.4.18-2ubuntu3.9","2.4.18-2ubuntu3.10","2.4.18-2ubuntu3.12","2.4.18-2ubuntu3.13","2.4.18-2ubuntu3.14"]}],"products":[{"vendor":"apache","product":"http_server"},{"vendor":"apache software foundation","product":"apache http server"}],"references":[{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","article","report"]},{"url":"https://security.gentoo.org/glsa/202008-04","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYVYE2ZERFXDV6RMKK3I5SDSDQLPSEIQ/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A2RN46PRBJE7E7OPD4YZX5SVWV5QKGV5/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20200827-0002/","tags":["x_refsource_CONFIRM","x_transferred","web","advisory"]},{"url":"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r09bb998baee74a2c316446bd1a41ae7f8d7049d09d9ff991471e8775%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11985","tags":["web","advisory"]},{"url":"https://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r09bb998baee74a2c316446bd1a41ae7f8d7049d09d9ff991471e8775@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A2RN46PRBJE7E7OPD4YZX5SVWV5QKGV5/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HYVYE2ZERFXDV6RMKK3I5SDSDQLPSEIQ/"},{"url":"https://github.com/advisories/GHSA-39vm-h38v-j867"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-11985","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHBA-2015:2194","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1125276","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1160625","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1162159","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1169081","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1170206","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1170214","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1170215","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1170220","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1176449","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1179306","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1180745","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1184118","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1188779","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1210091","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1214398","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1214401","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1214430","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1221575","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1222328","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1225820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1226015","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1227219","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1231924","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1235383","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1239164","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1242416","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1242503","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1255480","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1263975","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhba-2015_2194.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-11985","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1866559","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-11985","tags":["advisory","report"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-11985","tags":["article","report"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1161","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_Software_Collections/2/html/2.4_Release_Notes/chap-RHSCL.html#sect-RHSCL-Changes-httpd","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1329639","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1335616","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1336350","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1401528","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1406744","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1406753","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1406822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1414037","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1432249","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1433474","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1161.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-0736","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-0736","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0736","tags":["advisory"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html#2.4.25","tags":["article"]},{"url":"https://www.redteam-pentesting.de/advisories/rt-sa-2016-001.txt","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1546","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1546","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1546","tags":["advisory"]},{"url":"http://httpd.apache.org/security/vulnerabilities_24.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-2161","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-2161","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2161","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-8740","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8740","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8740","tags":["advisory"]},{"url":"http://seclists.org/bugtraq/2016/Dec/3","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-8743","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-8743","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-8743","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202450-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1175070","tags":["report"]},{"url":"https://bugzilla.suse.com/1175071","tags":["report"]},{"url":"https://bugzilla.suse.com/1175072","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11993","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-9490","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-11985","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2020/08/07/2","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-11985","description":"IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Note this issue was fixed in Apache HTTP Server 2.4.24 but was retrospectively allocated a low severity CVE in 2020.","status":"published","published":"2020-08-07T15:36:31Z","modified":"2024-08-04T11:48:58.232Z","cwes":["CWE-345"],"updated_at":"2026-11-02T14:35:57.67317Z"}],"euvd":[{"id":"EUVD-2020-4308","description":"IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Note this issue was fixed in Apache HTTP Server 2.4.24 but was retrospectively allocated a low severity CVE in 2020.","status":"published","published":"2020-08-07T15:36:31Z","modified":"2024-08-04T11:48:58Z","updated_at":"2026-11-03T03:07:41.399649Z"}],"ghsa":[{"id":"GHSA-39vm-h38v-j867","title":"IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using...","description":"IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Note this issue was fixed in Apache HTTP Server 2.4.24 but was retrospectively allocated a low severity CVE in 2020.","status":"published","published":"2022-05-24T17:25:02Z","modified":"2023-01-29T05:03:40Z","cwes":["CWE-345"],"updated_at":"2026-11-02T14:45:22.292804Z"}],"nvd":[{"id":"CVE-2020-11985","description":"IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Note this issue was fixed in Apache HTTP Server 2.4.24 but was retrospectively allocated a low severity CVE in 2020.","status":"published","published":"2020-08-07T16:15:11.81Z","modified":"2026-06-17T02:51:11.617Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-345"],"updated_at":"2026-11-02T14:06:10.994748Z"}],"osv":[{"id":"CVE-2020-11985","description":"IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Note this issue was fixed in Apache HTTP Server 2.4.24 but was retrospectively allocated a low severity CVE in 2020.","status":"published","published":"2020-08-07T16:15:11.81Z","modified":"2026-10-24T10:30:38.816764827Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:14.034736Z"},{"id":"DEBIAN-CVE-2020-11985","description":"IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Note this issue was fixed in Apache HTTP Server 2.4.24 but was retrospectively allocated a low severity CVE in 2020.","status":"published","published":"2020-08-07T16:15:11.81Z","modified":"2026-10-26T12:01:25.155775984Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"RHBA-2015:2194","title":"Red Hat Bug Fix Advisory: httpd bug fix and enhancement update","status":"published","published":"2024-09-13T21:59:34Z","modified":"2026-08-04T10:01:35Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:58.117212Z"},{"id":"RHSA-2017:1161","title":"Red Hat Security Advisory: httpd24-httpd security, bug fix, and enhancement update","status":"published","published":"2024-09-13T21:58:36Z","modified":"2026-09-21T10:01:39Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"UBUNTU-CVE-2020-11985","description":"IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Note this issue was fixed in Apache HTTP Server 2.4.24 but was retrospectively allocated a low severity CVE in 2020.","status":"published","published":"2020-08-07T16:15:00Z","modified":"2026-10-17T12:55:51.037005198Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:22.804634Z"},{"id":"BIT-apache-2020-11985","description":"IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Note this issue was fixed in Apache HTTP Server 2.4.24 but was retrospectively allocated a low severity CVE in 2020.","status":"published","published":"2024-03-06T10:57:47.876Z","modified":"2026-09-08T08:45:30.389401374Z","updated_at":"2026-11-02T15:28:28.267217Z"},{"id":"SUSE-SU-2020:2450-1","title":"Security update for apache2","description":"This update for apache2 fixes the following issues:\n\n- CVE-2020-9490: Fixed a crash caused by a specially crafted value for the 'Cache-Digest' header in a HTTP/2 request (bsc#1175071).\n- CVE-2020-11985: IP address spoofing when proxying using mod_remoteip and mod_rewrite (bsc#1175072).\n- CVE-2020-11993: When trace/debug was enabled for the HTTP/2 module logging statements were made on the wrong connection (bsc#1175070).\n","status":"published","published":"2020-09-02T09:48:12Z","modified":"2026-02-04T03:10:01.206021Z","updated_at":"2026-11-02T15:53:48.11786Z"}]}}