CVE-2020-11984

Name of the Vulnerable Software and Affected Versions Apache HTTP server versions 2.4.32 through 2.4.44

Description The issue is related to a buffer copy without checking the size of the input data in the mod proxy uwsgi module of the Apache HTTP Server. This can allow a remote attacker to gain unauthorized access to protected information, execute arbitrary code, or cause a denial of service. The problem was discovered by Felix Wilhelm of Google Project Zero.

Recommendations For versions 2.4.32 through 2.4.43, consider disabling the mod proxy uwsgi module as a temporary workaround until a patch is available. For version 2.4.44, update to a version that includes the fix for this issue. As a general mitigation measure, restrict access to sensitive information and monitor for signs of unauthorized access or code execution.