mod_wsgi module before 3.4 for Apache, when used in embedded mode, might allow remote attackers to obtain sensitive information via the Content-Type header which is generated from memory that may have been freed and then overwritten by a separate thread.
References
| Link | Resource |
|---|---|
| http://blog.dscpl.com.au/2014/05/security-release-for-modwsgi-version-35.html | Release Notes Third Party Advisory |
| http://modwsgi.readthedocs.org/en/latest/release-notes/version-3.4.html | Release Notes Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2014/05/21/1 | Mailing List |
| http://www.securityfocus.com/bid/67534 | Third Party Advisory VDB Entry |
| http://blog.dscpl.com.au/2014/05/security-release-for-modwsgi-version-35.html | Release Notes Third Party Advisory |
| http://modwsgi.readthedocs.org/en/latest/release-notes/version-3.4.html | Release Notes Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2014/05/21/1 | Mailing List |
| http://www.securityfocus.com/bid/67534 | Third Party Advisory VDB Entry |
Configurations
History
21 Nov 2024, 02:01
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://blog.dscpl.com.au/2014/05/security-release-for-modwsgi-version-35.html - Release Notes, Third Party Advisory | |
| References | () http://modwsgi.readthedocs.org/en/latest/release-notes/version-3.4.html - Release Notes, Vendor Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2014/05/21/1 - Mailing List | |
| References | () http://www.securityfocus.com/bid/67534 - Third Party Advisory, VDB Entry |
Information
Published : 2019-12-09 20:15
Updated : 2024-11-21 02:01
NVD link : CVE-2014-0242
Mitre link : CVE-2014-0242
CVE.ORG link : CVE-2014-0242
JSON object : View
Products Affected
modwsgi
- mod_wsgi
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor