Security update for apache2 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:14749-1 Final 1 1 2021-06-17T07:53:00Z current 2021-06-17T07:53:00Z 2021-06-17T07:53:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for apache2 This update for apache2 fixes the following issues: - fixed CVE-2021-30641 [bsc#1187174]: MergeSlashes regression - fixed CVE-2020-35452 [bsc#1186922]: Single zero byte stack overflow in mod_auth_digest The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sleposp3-apache2-14749,slessp4-apache2-14749 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-202114749-1/ Link for SUSE-SU-2021:14749-1 https://lists.suse.com/pipermail/sle-security-updates/2021-June/009024.html E-Mail link for SUSE-SU-2021:14749-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1186922 SUSE Bug 1186922 https://bugzilla.suse.com/1187174 SUSE Bug 1187174 https://www.suse.com/security/cve/CVE-2020-35452/ SUSE CVE CVE-2020-35452 page https://www.suse.com/security/cve/CVE-2021-30641/ SUSE CVE CVE-2021-30641 page SUSE Linux Enterprise Point of Sale 11 SP3 SUSE Linux Enterprise Server 11 SP4-LTSS apache2-2.2.34-70.35.1 apache2-devel-2.2.34-70.35.1 apache2-doc-2.2.34-70.35.1 apache2-example-pages-2.2.34-70.35.1 apache2-prefork-2.2.34-70.35.1 apache2-utils-2.2.34-70.35.1 apache2-worker-2.2.34-70.35.1 apache2-2.2.34-70.35.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 apache2-devel-2.2.34-70.35.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 apache2-doc-2.2.34-70.35.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 apache2-example-pages-2.2.34-70.35.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 apache2-prefork-2.2.34-70.35.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 apache2-utils-2.2.34-70.35.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 apache2-worker-2.2.34-70.35.1 as a component of SUSE Linux Enterprise Point of Sale 11 SP3 apache2-2.2.34-70.35.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS apache2-doc-2.2.34-70.35.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS apache2-example-pages-2.2.34-70.35.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS apache2-prefork-2.2.34-70.35.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS apache2-utils-2.2.34-70.35.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS apache2-worker-2.2.34-70.35.1 as a component of SUSE Linux Enterprise Server 11 SP4-LTSS Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team could create one, though some particular compiler and/or compilation option might make it possible, with limited consequences anyway due to the size (a single byte) and the value (zero byte) of the overflow CVE-2020-35452 SUSE Linux Enterprise Point of Sale 11 SP3:apache2-2.2.34-70.35.1 SUSE Linux Enterprise Point of Sale 11 SP3:apache2-devel-2.2.34-70.35.1 SUSE Linux Enterprise Point of Sale 11 SP3:apache2-doc-2.2.34-70.35.1 SUSE Linux Enterprise Point of Sale 11 SP3:apache2-example-pages-2.2.34-70.35.1 SUSE Linux Enterprise Point of Sale 11 SP3:apache2-prefork-2.2.34-70.35.1 SUSE Linux Enterprise Point of Sale 11 SP3:apache2-utils-2.2.34-70.35.1 SUSE Linux Enterprise Point of Sale 11 SP3:apache2-worker-2.2.34-70.35.1 SUSE Linux Enterprise Server 11 SP4-LTSS:apache2-2.2.34-70.35.1 SUSE Linux Enterprise Server 11 SP4-LTSS:apache2-doc-2.2.34-70.35.1 SUSE Linux Enterprise Server 11 SP4-LTSS:apache2-example-pages-2.2.34-70.35.1 SUSE Linux Enterprise Server 11 SP4-LTSS:apache2-prefork-2.2.34-70.35.1 SUSE Linux Enterprise Server 11 SP4-LTSS:apache2-utils-2.2.34-70.35.1 SUSE Linux Enterprise Server 11 SP4-LTSS:apache2-worker-2.2.34-70.35.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-202114749-1/ https://www.suse.com/security/cve/CVE-2020-35452.html CVE-2020-35452 https://bugzilla.suse.com/1186922 SUSE Bug 1186922 Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF' CVE-2021-30641 SUSE Linux Enterprise Point of Sale 11 SP3:apache2-2.2.34-70.35.1 SUSE Linux Enterprise Point of Sale 11 SP3:apache2-devel-2.2.34-70.35.1 SUSE Linux Enterprise Point of Sale 11 SP3:apache2-doc-2.2.34-70.35.1 SUSE Linux Enterprise Point of Sale 11 SP3:apache2-example-pages-2.2.34-70.35.1 SUSE Linux Enterprise Point of Sale 11 SP3:apache2-prefork-2.2.34-70.35.1 SUSE Linux Enterprise Point of Sale 11 SP3:apache2-utils-2.2.34-70.35.1 SUSE Linux Enterprise Point of Sale 11 SP3:apache2-worker-2.2.34-70.35.1 SUSE Linux Enterprise Server 11 SP4-LTSS:apache2-2.2.34-70.35.1 SUSE Linux Enterprise Server 11 SP4-LTSS:apache2-doc-2.2.34-70.35.1 SUSE Linux Enterprise Server 11 SP4-LTSS:apache2-example-pages-2.2.34-70.35.1 SUSE Linux Enterprise Server 11 SP4-LTSS:apache2-prefork-2.2.34-70.35.1 SUSE Linux Enterprise Server 11 SP4-LTSS:apache2-utils-2.2.34-70.35.1 SUSE Linux Enterprise Server 11 SP4-LTSS:apache2-worker-2.2.34-70.35.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-202114749-1/ https://www.suse.com/security/cve/CVE-2021-30641.html CVE-2021-30641 https://bugzilla.suse.com/1187174 SUSE Bug 1187174