PT-2020-5444
CVE-2020-9490
·
تاريخ النشر
2020-08-07
·
تاريخ التحديث
2026-10-09
الوصف من
CVSS 3.1
7.5
عاليةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions
Apache HTTP Server versions 2.4.20 through 2.4.43
Description
The issue is related to the implementation of the HTTP/2 mechanism in the Apache HTTP Server, which is associated with inconsistent interpretation of HTTP requests. This can allow a remote attacker to cause a denial of service. A specially crafted value for the
Cache-Digest header in a HTTP/2 request would result in a crash when the server tries to HTTP/2 PUSH a resource afterwards.Recommendations
For Apache HTTP Server versions 2.4.20 through 2.4.43, configuring the HTTP/2 feature via "H2Push off" will mitigate this issue for unpatched servers.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾