Bugzilla – Bug 1175072
VUL-0: CVE-2020-11985: apache2: IP address spoofing when proxying using mod_remoteip and mod_rewrite
Last modified: 2020-09-11 14:00:17 UTC
CVE-2020-11985 IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Note this issue was fixed in Apache HTTP Server 2.4.24 but was retrospectively allocated a low severity CVE in 2020. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-11985 http://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-11985.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11985 https://httpd.apache.org/security/vulnerabilities_24.html https://security.gentoo.org/glsa/202008-04
https://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-11985.html https://svn.apache.org/viewvc?view=revision&revision=1688399
https://svn.apache.org/viewvc?view=revision&revision=1767483
mod_remoteip is not available in 2.2. 15sp2,15/apache2 have this change already. Will submit for 12sp2/apache2.
isc:home:pgajdos:apache-test:after looks good. I believe all fixed.
SUSE-SU-2020:2450-1: An update that fixes three vulnerabilities is now available. Category: security (moderate) Bug References: 1175070,1175071,1175072 CVE References: CVE-2020-11985,CVE-2020-11993,CVE-2020-9490 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 9 (src): apache2-2.4.23-29.63.1 SUSE OpenStack Cloud Crowbar 8 (src): apache2-2.4.23-29.63.1 SUSE OpenStack Cloud 9 (src): apache2-2.4.23-29.63.1 SUSE OpenStack Cloud 8 (src): apache2-2.4.23-29.63.1 SUSE OpenStack Cloud 7 (src): apache2-2.4.23-29.63.1 SUSE Linux Enterprise Software Development Kit 12-SP5 (src): apache2-2.4.23-29.63.1 SUSE Linux Enterprise Server for SAP 12-SP4 (src): apache2-2.4.23-29.63.1 SUSE Linux Enterprise Server for SAP 12-SP3 (src): apache2-2.4.23-29.63.1 SUSE Linux Enterprise Server for SAP 12-SP2 (src): apache2-2.4.23-29.63.1 SUSE Linux Enterprise Server 12-SP5 (src): apache2-2.4.23-29.63.1 SUSE Linux Enterprise Server 12-SP4-LTSS (src): apache2-2.4.23-29.63.1 SUSE Linux Enterprise Server 12-SP3-LTSS (src): apache2-2.4.23-29.63.1 SUSE Linux Enterprise Server 12-SP3-BCL (src): apache2-2.4.23-29.63.1 SUSE Linux Enterprise Server 12-SP2-LTSS (src): apache2-2.4.23-29.63.1 SUSE Linux Enterprise Server 12-SP2-BCL (src): apache2-2.4.23-29.63.1 SUSE Enterprise Storage 5 (src): apache2-2.4.23-29.63.1 HPE Helion Openstack 8 (src): apache2-2.4.23-29.63.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
released