Re: CVE-2020-11984: Apache httpd: mod_uwsgi buffer overlow

[Daniel Ruggeri <druggeri () apache org>]

On 8/7/2020 8:20 PM, Seth Arnold wrote:
> On Fri, Aug 07, 2020 at 06:31:38AM -0500, Daniel Ruggeri wrote:
> > CVE-2020-11984: mod_uwsgi buffer overlow
> > Versions Affected:
> > httpd 2.4.32 to 2.4.44
> > Description:
> > Apache HTTP Server 2.4.32 to 2.4.44
> > mod_proxy_uwsgi info disclosure and possible RCE
> > References:
> > https://httpd.apache.org/security/vulnerabilities_24.html
> Hello Daniel, all,
>
> I'm confused: this english description of affected versions
> reads like 2.4.44 is affected. However, there is a heading on the
> vulnerabilities_24.html page that says this CVE is fixed in 2.4.44.
Hi, Seth;

   You're correct. That was an error on our part. We try to double check
this data (since sometimes we burn a release number as we test the
candidate) and things can get out of sync. I have it in my personal TODO
list to add some tooling around automating this particular part of the
release management process.

I've fixed this in a recent patch and the the site should now show the
correct data - many thanks for the correction

> Many projects include a "fixed in versions ..." list to indicate when
> something is fixed; I think this is less ambiguous.
>
> The "affects versions" don't always line up with the heading that claims
> to be fixed, eg CVE-2019-10092 claims to be fixed in 2.4.41, but the
> Affects entry doesn't mention 2.4.40.

Right - sometimes this will happen when we don't release a version. This
particular example is because 2.4.40 was not released (see below for a
bit more info).


> The headings are out of order:
>
> $ curl -sq https://httpd.apache.org/security/vulnerabilities_24.html | grep "Fixed in Apache"
> Fixed in Apache httpd 2.4.44</h1><dl>
> Fixed in Apache httpd 2.4.25</h1><dl>  # 2.4.25 is between 2.4.42 and 2.4.44
> Fixed in Apache httpd 2.4.42</h1><dl>
> Fixed in Apache httpd 2.4.41</h1><dl>
> Fixed in Apache httpd 2.4.39</h1><dl>
> [..]

No problem - I thought about this as I was putting together the
announcement but didn't adjust it at the time. I've fixed this as well


> The download site doesn't have a 2.4.40 download:
> https://archive.apache.org/dist/httpd/
>
> But the CHANGES_2.4.41 file shows a 2.4.40 release:
> https://archive.apache.org/dist/httpd/CHANGES_2.4.41

Correct - 2.4.40 was not released. We made a number of changes leading
up to it, but ultimately found an issue in the release candidate that we
fixed between then and a release that we were comfortable with.

If you're interested, you can see a bit more history (and even what's
coming in future release) by taking a look at this file:
http://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x/STATUS

We always note when we tag a release and then the final release date for
every version. You can find similar files for the old 2.2, 2.0, and 1.3
branches too.

> I don't actually care that much about CVE-2019-10092 -- I just tried to
> figure out the status of CVE-2020-11984 by looking at other examples on
> the page and found the page difficult to understand.
>
> And, something is a bit off with the CURRENT-IS-$version markers:
>
> $ curl -sq https://archive.apache.org/dist/httpd/ | grep -c CURRENT
> 47
I can see how that appears odd. This URL is our archive distribution
point, so anything we release to the formal distribution point will be
added here automatically to preserve history. It's best to use the
current distribution point:
https://dist.apache.org/repos/dist/release/httpd/

We always maintain the zero-length CURRNT-IS-foo file here and remove
non-current releases.


> I expected one in each of the 2.0, 2.2, and 2.4 series, or perhaps just
> one for the newest 2.4 release.
>
> Thanks


Thanks for taking the time to provide feedback! Have a great weekend