Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns logging statements were made on the wrong connection causing concurrent use of memory pools. Configuring the LogLevel of mod_http2 above "info" will mitigate this vulnerability for unpatched servers.

🗓️ 18 Aug 2020 07:00:00Reported by MicrosoftType

Apache 2.4.20–2.4.43 logs on wrong HTTP/2 connection during tracing, risking memory pool concurrency; raise mod_http2 LogLevel above info.

Reporter	Title	Published	Views	Family All 148
0day.today	Apache 2 HTTP2 Module Concurrent Pool Usage Vulnerability	8 Dec 202000:00	–	zdt
IBM Security Bulletins	Security Bulletin: Rational Build Forge security advisory for Apache HTTP Server	27 Oct 202020:56	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Apache HTTP (CVE-2018-17199 and CVE-2020-11993) affects HMC	22 Nov 202106:10	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Apache HTTP Server affect IBM i	9 Sep 202014:56	–	ibm
FreeBSD	Apache httpd -- Multiple vulnerabilities	7 Aug 202000:00	–	freebsd
ATTACKERKB	CVE-2020-11984 — Multiple Vulnerabilities in Apache Web Server Could Allow for Remote Code Execution	7 Aug 202000:00	–	attackerkb
ATTACKERKB	CVE-2020-9490	7 Aug 202000:00	–	attackerkb
Tenable Nessus	Amazon Linux 2 : httpd (ALAS-2020-1490)	20 Nov 202000:00	–	nessus
Tenable Nessus	Amazon Linux 2 : mod_http2 (ALAS-2020-1493)	17 Sep 202000:00	–	nessus
Tenable Nessus	Amazon Linux AMI : httpd24 (ALAS-2020-1418)	31 Aug 202000:00	–	nessus