Arch Linux Security Advisory ASA-202004-14 ========================================== Severity: Low Date : 2020-04-15 CVE-ID : CVE-2020-1927 CVE-2020-1934 Package : apache Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1126 Summary ======= The package apache before version 2.4.43-1 is vulnerable to multiple issues including information disclosure and open redirect. Resolution ========== Upgrade to 2.4.43-1. # pacman -Syu "apache>=2.4.43-1" The problems have been fixed upstream in version 2.4.43. Workaround ========== None. Description =========== - CVE-2020-1927 (open redirect) A security issue has been found in Apache HTTP Server from 2.4.0 up to and including 2.4.41, in the mod_rewrite module, where redirects that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL. This is the same defect as CVE-2019-10098. The fix for CVE-2019-10098 was ineffective. Possible mitigations are the use of anchor captures as back-references, or prefixing self-referential redirects with / or scheme, host, and port. - CVE-2020-1934 (information disclosure) The use of an uninitialized value has been found in Apache HTTP Server from 2.4.0 up to and including 2.4.41, in the mod_proxy_ftp module, when proxying to a malicious FTP server. Impact ====== A remote attacker is able to cause a redirect via a crafted HTTP request, or disclose information when proxying to an FTP server. References ========== https://httpd.apache.org/security/vulnerabilities_24.html https://seclists.org/oss-sec/2020/q2/3 https://seclists.org/oss-sec/2020/q2/4 https://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_ftp.c?r1=1873745&r2=1873744&pathrev=1873745 https://security.archlinux.org/CVE-2020-1927 https://security.archlinux.org/CVE-2020-1934