The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1121 advisory.

  - In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured     with AuthLDAPCharsetConfig, uses the Accept-Language header value to lookup the right charset encoding     when verifying the user's credentials. If the header value is not present in the charset conversion table,     a fallback mechanism is used to truncate it to a two characters value to allow a quick retry (for example,     'en-US' is truncated to 'en'). A header value of less than two characters forces an out of bound write of     one NUL byte to a memory location that is not part of the string. In the worst case, quite unlikely, the     process would crash which could be used as a Denial of Service attack. In the more likely case, this     memory is already reserved for future use and the issue has no effect at all. (CVE-2017-15710)

  - A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an     out of bound access after a size limit is reached by reading the HTTP header. This vulnerability is     considered very hard if not impossible to trigger in non-debug mode (both log and build level), so it is     classified as low risk for common server usage. (CVE-2018-1301)

  - In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before     decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since     the expiry time is loaded when the session is decoded. (CVE-2018-17199)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has httpd packages installed that are affected by multiple vulnerabilities:

  - A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an     out of bound access after a size limit is reached by reading the HTTP header. This vulnerability is     considered very hard if not impossible to trigger in non-debug mode (both log and build level), so it is     classified as low risk for common server usage. (CVE-2018-1301)

  - In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured     with AuthLDAPCharsetConfig, uses the Accept-Language header value to lookup the right charset encoding     when verifying the user's credentials. If the header value is not present in the charset conversion table,     a fallback mechanism is used to truncate it to a two characters value to allow a quick retry (for example,     'en-US' is truncated to 'en'). A header value of less than two characters forces an out of bound write of     one NUL byte to a memory location that is not part of the string. In the worst case, quite unlikely, the     process would crash which could be used as a Denial of Service attack. In the more likely case, this     memory is already reserved for future use and the issue has no effect at all. (CVE-2017-15710)

  - In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before     decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since     the expiry time is loaded when the session is decoded. (CVE-2018-17199)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been found in the Apache HTTPD server.

CVE-2017-15710

Alex Nichols and Jakob Hirsch reported that mod_authnz_ldap, if configured with AuthLDAPCharsetConfig, could cause an of bound write if supplied with a crafted Accept-Language header. This could potentially be used for a Denial of Service attack.

CVE-2018-1301

Robert Swiecki reported that a specially crafted request could have crashed the Apache HTTP Server, due to an out of bound access after a size limit is reached by reading the HTTP header. CVE-2018-1312

Nicolas Daniels discovered that when generating an HTTP Digest authentication challenge, the nonce sent by mod_auth_digest to prevent reply attacks was not correctly generated using a pseudo-random seed. In a cluster of servers using a common Digest authentication configuration, HTTP requests could be replayed across servers by an attacker without detection.

For Debian 7 'Wheezy', these problems have been fixed in version 2.2.22-13+deb7u13.

We recommend that you upgrade your apache2 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the httpd package has been released.

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was found in Apache HTTP Server 2.4.0     to 2.4.38. When the path component of a request URL     contains multiple consecutive slashes ('/'), directives     such as LocationMatch and RewriteRule must account for     duplicates in regular expressions while other aspects     of the servers processing will implicitly collapse     them.(CVE-2019-0220)

  - A specially crafted request could have crashed the     Apache HTTP Server prior to version 2.4.30, due to an     out of bound access after a size limit is reached by     reading the HTTP header. This vulnerability is     considered very hard if not impossible to trigger in     non-debug mode (both log and build level), so it is     classified as low risk for common server     usage.(CVE-2018-1301)

  - In Apache httpd 2.4.0 to 2.4.29, when mod_session is     configured to forward its session data to CGI     applications (SessionEnv on, not the default), a remote     user may influence their content by using a 'Session'     header. This comes from the 'HTTP_SESSION' variable     name used by mod_session to forward its data to CGIs,     since the prefix 'HTTP_' is also used by the Apache     HTTP Server to pass HTTP header fields, per CGI     specifications.(CVE-2018-1283)

  - mod_lua.c in the mod_lua module in the Apache HTTP     Server 2.3.x and 2.4.x through 2.4.10 does not support     an httpd configuration in which the same Lua     authorization provider is used with different arguments     within different contexts, which allows remote     attackers to bypass intended access restrictions in     opportunistic circumstances by leveraging multiple     Require directives, as demonstrated by a configuration     that specifies authorization for one group to access a     certain directory, and authorization for a second group     to access a second directory.(CVE-2014-8109)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the httpd packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was found in Apache HTTP Server 2.4.0     to 2.4.38. When the path component of a request URL     contains multiple consecutive slashes ('/'), directives     such as LocationMatch and RewriteRule must account for     duplicates in regular expressions while other aspects     of the servers processing will implicitly collapse     them.(CVE-2019-0220)

  - A specially crafted request could have crashed the     Apache HTTP Server prior to version 2.4.30, due to an     out of bound access after a size limit is reached by     reading the HTTP header. This vulnerability is     considered very hard if not impossible to trigger in     non-debug mode (both log and build level), so it is     classified as low risk for common server     usage.(CVE-2018-1301)

  - In Apache httpd 2.4.0 to 2.4.29, when mod_session is     configured to forward its session data to CGI     applications (SessionEnv on, not the default), a remote     user may influence their content by using a 'Session'     header. This comes from the 'HTTP_SESSION' variable     name used by mod_session to forward its data to CGIs,     since the prefix 'HTTP_' is also used by the Apache     HTTP Server to pass HTTP header fields, per CGI     specifications.(CVE-2018-1283)

  - mod_lua.c in the mod_lua module in the Apache HTTP     Server 2.3.x and 2.4.x through 2.4.10 does not support     an httpd configuration in which the same Lua     authorization provider is used with different arguments     within different contexts, which allows remote     attackers to bypass intended access restrictions in     opportunistic circumstances by leveraging multiple     Require directives, as demonstrated by a configuration     that specifies authorization for one group to access a     certain directory, and authorization for a second group     to access a second directory.(CVE-2014-8109)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3627-2 advisory.

    USN-3627-1 fixed vulnerabilities in Apache HTTP Server. This update provides the corresponding updates for     Ubuntu 18.04 LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update :

  - fixes the **mod_md** default store directory

  - fixes a startup failure in certain **mod_ssl** vhost     configurations

----

This update includes the latest upstream release of the Apache HTTP Server, version 2.4.33. A number of security vulnerabilities are fixed in this release :

  - *Low*: Possible out of bound read in mod_cache_socache     (CVE-2018-1303)

  - *Low*: Possible out of bound access after failure in     reading the HTTP request (CVE-2018-1301)

  - *Low*: Weak Digest auth nonce generation in     mod_auth_digest (CVE-2018-1312)

  - *Low*: <FilesMatch> bypass with a trailing newline in     the file name (CVE-2017-15715)

  - *Low*: Out of bound write in mod_authnz_ldap when using     too small Accept-Language values (CVE-2017-15710)

  - *Moderate*: Tampering of mod_session data for CGI     applications (CVE-2018-1283)

For more information about changes in this release, see:
https://www.apache.org/dist/httpd/CHANGES_2.4.33

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
135341	CentOS 7 : httpd (RHSA-2020:1121)	Nessus	CentOS Local Security Checks	4/10/2020	10/9/2024	high
143994	NewStart CGSL CORE 5.05 / MAIN 5.05 : httpd Multiple Vulnerabilities (NS-SA-2020-0110)	Nessus	NewStart CGSL Local Security Checks	12/9/2020	12/10/2020	high
110250	Debian DLA-1389-1 : apache2 security update	Nessus	Debian Local Security Checks	5/31/2018	9/27/2024	critical
121822	Photon OS 1.0: Httpd PHSA-2018-1.0-0126	Nessus	PhotonOS Local Security Checks	2/7/2019	3/20/2025	high
130866	EulerOS 2.0 SP5 : httpd (EulerOS-SA-2019-2157)	Nessus	Huawei Local Security Checks	11/12/2019	4/12/2024	medium
134539	EulerOS Virtualization for ARM 64 3.0.2.0 : httpd (EulerOS-SA-2020-1250)	Nessus	Huawei Local Security Checks	3/13/2020	3/22/2024	medium
109466	Ubuntu 18.04 LTS : Apache HTTP Server vulnerabilities (USN-3627-2)	Nessus	Ubuntu Local Security Checks	5/1/2018	10/29/2024	critical
109745	Fedora 26 : httpd (2018-e6d9251471)	Nessus	Fedora Local Security Checks	5/14/2018	10/9/2024	critical

Detections

Analytics

Plugins Search

high

high

critical

high

medium

medium

critical

critical