Description

Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were made on the wrong connection, causing concurrent use of memory pools. Configuring the LogLevel of mod_http2 above "info" will mitigate this vulnerability for unpatched servers.

Remediation

References

CVE-2020-11993

Related Vulnerabilities

WordPress Plugin LearnPress-WordPress LMS SQL Injection (3.2.6.7)

ColdFusion 9 solr service exposed

Ruby Inadequate Encryption Strength Vulnerability (CVE-2021-32066)

PostgreSQL Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2014-0065)

WordPress 4.3.x Possible SQL Injection Vulnerability (4.3 - 4.3.12)

Severity

High

Classification

CVE-2020-11993 CWE-444 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L

Tags

Missing Update Known Vulnerabilities