Security update for apache2
This update for apache2 fixes the following issues: - fixed CVE-2021-30641 [bsc#1187174]: MergeSlashes regression - fixed CVE-2021-31618 [bsc#1186924]: NULL pointer dereference on specially crafted HTTP/2 request - fixed CVE-2020-35452 [bsc#1186922]: Single zero byte stack overflow in mod_auth_digest - fixed CVE-2021-26690 [bsc#1186923]: mod_session NULL pointer dereference in parser - fixed CVE-2021-26691 [bsc#1187017]: Heap overflow in mod_session
02 / AFFECTED SOFTWARE
Affected packages
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
This update for apache2 fixes the following issues: - fixed CVE-2021-30641 [bsc#1187174]: MergeSlashes regression - fixed CVE-2021-31618 [bsc#1186924]: NULL pointer dereference on specially crafted HTTP/2 request - fixed CVE-2020-35452 [bsc#1186922]: Single zero byte stack overflow in mod_auth_digest - fixed CVE-2021-26690 [bsc#1186923]: mod_session NULL pointer dereference in parser - fixed CVE-2021-26691 [bsc#1187017]: Heap overflow in mod_session
05 / REFERENCES
Further evidence
- https://bugzilla.suse.com/1186922
- https://bugzilla.suse.com/1186923
- https://bugzilla.suse.com/1186924
- https://bugzilla.suse.com/1187017
- https://bugzilla.suse.com/1187174
- https://www.suse.com/security/cve/CVE-2020-35452
- https://www.suse.com/security/cve/CVE-2021-26690
- https://www.suse.com/security/cve/CVE-2021-26691
- https://www.suse.com/security/cve/CVE-2021-30641
- https://www.suse.com/security/cve/CVE-2021-31618
- https://www.suse.com/support/update/announcement/2021/suse-su-20212006-1/