apache2 vulnerabilities (Ubuntu)
160 vulnerabilities.
apache2UbuntuRequest splitting via HTTP/2 method injection and mod_proxy7.5 Highapache2UbuntuUnexpected URL matching with 'MergeSlashes OFF'5.3 Mediumapache2UbuntuApache HTTP Server mod_session response handling heap overflow9.8 Criticalapache2Ubuntumod_session NULL pointer dereference7.5 Highapache2Ubuntumod_auth_digest possible stack overflow by one nul byte7.3 Highapache2Ubuntumod_proxy_http NULL pointer dereference7.5 Highapache2Ubuntumod_proxy_wstunnel tunneling of non Upgraded connections5.3 Mediumapache2UbuntuIP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using...5.3 Mediumapache2UbuntuApache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module...7.5 Highapache2UbuntuApache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE9.8 Criticalapache2UbuntuApache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest'...7.5 Highapache2UbuntuIn Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended...6.1 Mediumapache2UbuntuIn Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying...5.3 Mediumapache2Ubuntuapache2 updateNo scoreapache2Ubuntuapache2 regressionNo scoreapache2UbuntuHTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource",...7.5 Highapache2UbuntuIn Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended...6.1 Mediumapache2UbuntuIn Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting...6.1 Mediumapache2UbuntuIn Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling...9.1 Criticalapache2UbuntuSome HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service7.5 Highapache2UbuntuA vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a...4.2 Mediumapache2UbuntuA vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a...5.3 Mediumapache2UbuntuIn Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when...7.5 Highapache2UbuntuIn Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code...7.8 Highapache2UbuntuA vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the...5.3 Mediumapache2UbuntuIn Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to...5.3 Mediumapache2UbuntuIn Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time...7.5 Highapache2UbuntuIn Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can...5.9 Mediumapache2Ubuntumod_userdir CRLF injection6.1 Mediumapache2UbuntuDoS for HTTP/2 connections by crafted requests7.5 Highapache2UbuntuIn Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the...9.8 Criticalapache2UbuntuA specially crafted HTTP request header could have crashed the Apache HTTP Server prior to...7.5 Highapache2UbuntuWhen an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version...5.9 Mediumapache2UbuntuA specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30,...5.9 Mediumapache2UbuntuIn Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to...5.3 Mediumapache2UbuntuIn Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a...8.1 Highapache2UbuntuIn Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if...7.5 Highapache2UbuntuApache httpd allows remote attackers to read secret data from process memory if the Limit...7.5 Highapache2UbuntuIn Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-...9.1 Criticalapache2UbuntuIn Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the...9.8 Criticalapache2UbuntuThe HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token...7.5 Highapache2UbuntuIn Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL...9.8 Criticalapache2UbuntuIn Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by...9.8 Criticalapache2UbuntuApache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace...7.5 Highapache2UbuntuIn Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can cause the...7.5 Highapache2UbuntuIn Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie...7.5 Highapache2UbuntuThe Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not...8.1 Highapache2UbuntuThe ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4...4.3 Mediumapache2UbuntuThe chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not...5.0 Mediumapache2UbuntuThe handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the Apache HTTP...5.0 Medium- Show moreLoading…