Apache – CVE-2020-13950

Description

Kayran has detected that the Version of Apache HTTP Server being used is vulnerable to a ‘mod_proxy_http’ null pointer dereference.

CVE-2020-13950 is categorized as a ‘NULL Pointer Dereference’ vulnerability (CWE-476).
A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is actually NULL.
That, will probably cause a crash or an exit.

NULL pointer dereference issues can occur through a number of flaws, including race conditions, and simple programming omissions.

Attackers could cause the ‘mod_proxy_http’ to crash (via NULL pointer dereference).
They do that by crafting requests that uses both Content-Length and Transfer-Encoding headers, which could lead to a Denial of Service (DoS).

It could lead to a decrease in performance and interruptions in the availability of resources.

Recommendation

To fix CVE-2020-13950, upgrade the version of Apache HTTP Server being used to 2.4.48.

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13950

https://cwe.mitre.org/data/definitions/476.html

< Return to all Vulnerabilities

HTTP VS. HTTPS

You must have once wondered what HTTP means and what is the difference between that ugly word to HTTPS, and if not, then please read

Read More »

Man-In-The-Middle Attacks

Do you know these people who just push themselves into conversations?That’s Man-In-The-Middle Attacks. And from a wider angle, Man-In-The-Middle Attacks, or MITM, are built around

Read More »