CVE-2020-11993

Published: Aug 7, 2020Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were made on the wrong connection, causing concurrent use of memory pools. Configuring the LogLevel of mod_http2 above "info" will mitigate this vulnerability for unpatched servers.

Affected (19)

Products: Apache: Http Server · Netapp: Clustered Data Ontap · Canonical: Ubuntu Linux · +4 more

Show all products

1 product

1 product

1 product

1 product

1 product

1 product

7 products

Communications Element Manager

Communications Session Report Manager

Communications Session Route Manager

Enterprise Manager Ops Center

Hyperion Infrastructure Technology

Instantis Enterprisetrack

Zfs Storage Appliance Kit

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Http Server	From 2.4.20 to 2.4.44

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Netapp Clustered Data Ontap	All versions

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04
Canonical Ubuntu Linux	Version 20.04

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 15.1
Opensuse Leap	Version 15.2

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0

Configuration F

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 31
Fedoraproject Fedora	Version 32

Configuration G

9 vulnerable

Vulnerable Software	Affected Versions
Oracle Communications Element Manager	From 8.2.0 to 8.2.2
Oracle Communications Session Report Manager	From 8.2.0 to 8.2.2
Oracle Communications Session Route Manager	From 8.2.0 to 8.2.2
Oracle Enterprise Manager Ops Center	Version 12.4.0.0
Oracle Hyperion Infrastructure Technology	Version 11.1.2.4
Oracle Instantis Enterprisetrack	Version 17.1
Oracle Instantis Enterprisetrack	Version 17.2
Oracle Instantis Enterprisetrack	Version 17.3
Oracle Zfs Storage Appliance Kit	Version 8.8

Related CWEs

CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

References (52)

http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00068.html

Source: security@apache.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00071.html

Source: security@apache.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00081.html

Source: security@apache.org

Mailing ListThird Party Advisory

http://packetstormsecurity.com/files/160393/Apache-2-HTTP2-Module-Concurrent-Pool-Usage.html

Source: security@apache.org

ExploitThird Party AdvisoryVDB Entry

https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-11993

Source: security@apache.org

Vendor Advisory

https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

Patch

https://lists.apache.org/thread.html/r09bb998baee74a2c316446bd1a41ae7f8d7049d09d9ff991471e8775%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

Patch

https://lists.apache.org/thread.html/r2c6083f6a2027914a0f5b54e2a1f4fa98c03f8693b58460911818255%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

Patch

https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

Patch

https://lists.apache.org/thread.html/r5debe8f82728a00a4a68bc904dd6c35423bdfc8d601cfb4579f38bf1%40%3Cdev.httpd.apache.org%3E

Source: security@apache.org

Patch

https://lists.apache.org/thread.html/r623de9b2b2433a87f3f3a15900419fc9c00c77b26936dfea4060f672%40%3Cdev.httpd.apache.org%3E

Source: security@apache.org

Patch

https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

Patch

https://lists.apache.org/thread.html/r9e9f1a7609760f0f80562eaaec2aa3c32d525c3e0fca98b475240c71%40%3Cdev.httpd.apache.org%3E

Source: security@apache.org

Patch

https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

Patch

https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

Patch

https://lists.apache.org/thread.html/rdf3e5d0a5f5c3d90d6013bccc6c4d5af59cf1f8c8dea5d9a283d13ce%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

Patch

https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

Patch

https://lists.apache.org/thread.html/rf71eb428714374a6f9ad68952e23611ec7807b029fd6a1b4f5f732d9%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

Patch

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4NKWG2EXAQQB6LMLATKZ7KLSRGCSHVAN/

Source: security@apache.org

Third Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ITVFDBVM6E3JF3O7RYLRPRCH3RDRHJJY/

Source: security@apache.org

Third Party Advisory

https://security.gentoo.org/glsa/202008-04

Source: security@apache.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20200814-0005/

Source: security@apache.org

Third Party Advisory

https://usn.ubuntu.com/4458-1/

Source: security@apache.org

Third Party Advisory

https://www.debian.org/security/2020/dsa-4757

Source: security@apache.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpujan2021.html

Source: security@apache.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpuoct2020.html

Source: security@apache.org

Vendor Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00068.html