Bug 1168407 - (CVE-2020-1927) VUL-1: CVE-2020-1927: apache2: mod_rewrite configurations vulnerable to open redirect
(CVE-2020-1927)
VUL-1: CVE-2020-1927: apache2: mod_rewrite configurations vulnerable to open ...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P4 - Low : Normal
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/256263/
CVSSv2:NVD:CVE-2020-1927:5.8:(AV:N/A...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2020-04-02 07:52 UTC by Wolfgang Frisch
Modified: 2021-01-12 12:16 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Wolfgang Frisch 2020-04-02 07:52:05 UTC
CVE-2020-1927

In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL.

Note: This is the same defect as CVE-2019-10098. The fix for CVE-2019-10098 was ineffective.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1927
http://www.openwall.com/lists/oss-security/2020/04/01/4
http://seclists.org/oss-sec/2020/q2/3
Comment 1 Wolfgang Frisch 2020-04-02 09:24:09 UTC
The most recent release note provides more details:

>Changes with Apache 2.4.43
> 
>  *) SECURITY: CVE-2020-1927 (cve.mitre.org)
>     rewrite, core: Set PCRE_DOTALL flag by default to avoid unpredictable
>     matches and substitutions with encoded line break characters.
>     The fix for CVE-2019-10098 was not effective.  [Ruediger Pluem]

This is addressed in SVN revision 1864213.

https://svn.apache.org/viewvc?view=revision&revision=1864213
Comment 2 Wolfgang Frisch 2020-04-02 15:20:49 UTC
The aforementioned commit refers to the original vulnerability CVE-2019-10098 that was patched insufficiently by upstream.
Comment 3 Wolfgang Frisch 2020-04-02 16:13:27 UTC
I believe the issue was fixed with these commits:

SVN revision 1873905: factor out default regex flags
SVN revision 1874191: add AP_REG_NO_DEFAULT to allow opt-out of pcre defaults

https://svn.apache.org/viewvc?view=revision&revision=1873905
https://svn.apache.org/viewvc?view=revision&revision=1874191
Comment 6 Petr Gajdos 2020-04-06 14:16:24 UTC
Packages submitted for 15/apache2, 12sp2/apache2 and 12sp1/apache2.
Submitted 2.4.43 into 15sp2/apache2.
Comment 7 Petr Gajdos 2020-04-06 14:17:33 UTC
I believe all fixed.
Comment 8 Petr Gajdos 2020-04-07 07:54:52 UTC
home:pgajdos:apache-test:after looks good.
Comment 10 Swamp Workflow Management 2020-04-24 19:15:25 UTC
SUSE-SU-2020:1111-1: An update that fixes three vulnerabilities is now available.

Category: security (important)
Bug References: 1168404,1168407,1169066
CVE References: CVE-2020-1927,CVE-2020-1934,CVE-2020-1938
Sources used:
SUSE Linux Enterprise Server for SAP 12-SP1 (src):    apache2-2.4.16-20.29.1
SUSE Linux Enterprise Server 12-SP1-LTSS (src):    apache2-2.4.16-20.29.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 11 Swamp Workflow Management 2020-04-28 10:16:54 UTC
SUSE-SU-2020:1126-1: An update that fixes three vulnerabilities is now available.

Category: security (important)
Bug References: 1168404,1168407,1169066
CVE References: CVE-2020-1927,CVE-2020-1934,CVE-2020-1938
Sources used:
SUSE Linux Enterprise Server for SAP 15 (src):    apache2-2.4.33-3.30.1
SUSE Linux Enterprise Server 15-LTSS (src):    apache2-2.4.33-3.30.1
SUSE Linux Enterprise Module for Server Applications 15-SP1 (src):    apache2-2.4.33-3.30.1
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src):    apache2-2.4.33-3.30.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    apache2-2.4.33-3.30.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    apache2-2.4.33-3.30.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 13 Swamp Workflow Management 2020-05-01 22:22:41 UTC
openSUSE-SU-2020:0597-1: An update that fixes three vulnerabilities is now available.

Category: security (important)
Bug References: 1168404,1168407,1169066
CVE References: CVE-2020-1927,CVE-2020-1934,CVE-2020-1938
Sources used:
openSUSE Leap 15.1 (src):    apache2-2.4.33-lp151.8.12.1
Comment 14 Swamp Workflow Management 2020-05-13 16:22:44 UTC
SUSE-SU-2020:1272-1: An update that fixes three vulnerabilities is now available.

Category: security (important)
Bug References: 1168404,1168407,1169066
CVE References: CVE-2020-1927,CVE-2020-1934,CVE-2020-1938
Sources used:
SUSE OpenStack Cloud Crowbar 8 (src):    apache2-2.4.23-29.54.1
SUSE OpenStack Cloud 8 (src):    apache2-2.4.23-29.54.1
SUSE OpenStack Cloud 7 (src):    apache2-2.4.23-29.54.1
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    apache2-2.4.23-29.54.1
SUSE Linux Enterprise Software Development Kit 12-SP4 (src):    apache2-2.4.23-29.54.1
SUSE Linux Enterprise Server for SAP 12-SP3 (src):    apache2-2.4.23-29.54.1
SUSE Linux Enterprise Server for SAP 12-SP2 (src):    apache2-2.4.23-29.54.1
SUSE Linux Enterprise Server 12-SP5 (src):    apache2-2.4.23-29.54.1
SUSE Linux Enterprise Server 12-SP4 (src):    apache2-2.4.23-29.54.1
SUSE Linux Enterprise Server 12-SP3-LTSS (src):    apache2-2.4.23-29.54.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    apache2-2.4.23-29.54.1
SUSE Linux Enterprise Server 12-SP2-LTSS (src):    apache2-2.4.23-29.54.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    apache2-2.4.23-29.54.1
SUSE Enterprise Storage 5 (src):    apache2-2.4.23-29.54.1
HPE Helion Openstack 8 (src):    apache2-2.4.23-29.54.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 15 Alexandros Toptsoglou 2020-07-10 14:51:31 UTC
Done