Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via "H2Push off" will mitigate this vulnerability for unpatched servers.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
Configuration 6 (hide)
|
Configuration 7 (hide)
AND |
|
Configuration 8 (hide)
|
History
07 Nov 2023, 03:26
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
Information
Published : 2020-08-07 16:15
Updated : 2024-02-28 17:47
NVD link : CVE-2020-9490
Mitre link : CVE-2020-9490
CVE.ORG link : CVE-2020-9490
JSON object : View
Products Affected
oracle
- communications_session_route_manager
- communications_element_manager
- communications_session_report_manager
- instantis_enterprisetrack
- enterprise_manager_ops_center
- zfs_storage_appliance_kit
- hyperion_infrastructure_technology
fedoraproject
- fedora
redhat
- enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions
- openstack_for_ibm_power
- enterprise_linux_server_tus
- enterprise_linux_for_power_little_endian
- enterprise_linux
- enterprise_linux_for_ibm_z_systems
- enterprise_linux_for_power_little_endian_eus
- enterprise_linux_server_aus
- enterprise_linux_eus
- software_collections
- enterprise_linux_for_ibm_z_systems_eus
- openstack
- enterprise_linux_server_update_services_for_sap_solutions
apache
- http_server
canonical
- ubuntu_linux
opensuse
- leap
debian
- debian_linux
CWE
CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')