7.5
CVE-2020-9490
- EPSS 75.82%
- Published 07.08.2020 16:15:12
- Last modified 21.11.2024 05:40:45
- Source security@apache.org
- Teams watchlist Login
- Open Login
Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via "H2Push off" will mitigate this vulnerability for unpatched servers.
Data is provided by the National Vulnerability Database (NVD)
Apache ≫ HTTP Server Version >= 2.4.20 < 2.4.46
Oracle ≫ Communications Element Manager Version >= 8.2.0 <= 8.2.2
Oracle ≫ Communications Session Report Manager Version >= 8.2.0 <= 8.2.2
Oracle ≫ Communications Session Route Manager Version >= 8.2.0 <= 8.2.2
Oracle ≫ Enterprise Manager Ops Center Version12.4.0.0
Oracle ≫ Hyperion Infrastructure Technology Version11.1.2.4
Oracle ≫ Instantis Enterprisetrack Version17.1
Oracle ≫ Instantis Enterprisetrack Version17.2
Oracle ≫ Instantis Enterprisetrack Version17.3
Oracle ≫ Zfs Storage Appliance Kit Version8.8
Debian ≫ Debian Linux Version10.0
Fedoraproject ≫ Fedora Version31
Fedoraproject ≫ Fedora Version32
Canonical ≫ Ubuntu Linux Version16.04 SwEditionesm
Canonical ≫ Ubuntu Linux Version18.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version20.04 SwEditionlts
Redhat ≫ Software Collections Version1.0
Redhat ≫ Enterprise Linux Version6.0
Redhat ≫ Enterprise Linux Version7.0
Redhat ≫ Enterprise Linux Version7.6
Redhat ≫ Enterprise Linux Version7.7
Redhat ≫ Enterprise Linux Version7.0
Redhat ≫ Enterprise Linux Version7.6
Redhat ≫ Enterprise Linux Version7.7
Redhat ≫ Openstack For Ibm Power Version16.1
Redhat ≫ Enterprise Linux Version8.0
Redhat ≫ Enterprise Linux Eus Version8.1
Redhat ≫ Enterprise Linux Eus Version8.2
Redhat ≫ Enterprise Linux Eus Version8.4
Redhat ≫ Enterprise Linux Eus Version8.6
Redhat ≫ Enterprise Linux For Ibm Z Systems Version8.0
Redhat ≫ Enterprise Linux For Ibm Z Systems Eus Version8.1
Redhat ≫ Enterprise Linux For Ibm Z Systems Eus Version8.2
Redhat ≫ Enterprise Linux For Ibm Z Systems Eus Version8.4
Redhat ≫ Enterprise Linux For Ibm Z Systems Eus Version8.6
Redhat ≫ Enterprise Linux For Power Little Endian Version8.0
Redhat ≫ Enterprise Linux For Power Little Endian Eus Version8.1
Redhat ≫ Enterprise Linux For Power Little Endian Eus Version8.2
Redhat ≫ Enterprise Linux For Power Little Endian Eus Version8.4
Redhat ≫ Enterprise Linux For Power Little Endian Eus Version8.6
Redhat ≫ Enterprise Linux Server Aus Version8.2
Redhat ≫ Enterprise Linux Server Aus Version8.4
Redhat ≫ Enterprise Linux Server Aus Version8.6
Redhat ≫ Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions Version8.1
Redhat ≫ Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions Version8.2
Redhat ≫ Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions Version8.4
Redhat ≫ Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions Version8.6
Redhat ≫ Enterprise Linux Server Tus Version8.2
Redhat ≫ Enterprise Linux Server Tus Version8.4
Redhat ≫ Enterprise Linux Server Tus Version8.6
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 75.82% | 0.989 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
|
| nvd@nist.gov | 5 | 10 | 2.9 |
AV:N/AC:L/Au:N/C:N/I:N/A:P
|
CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.