Attacker Value
Very Low
CVE-2020-9490
CVE-2020-9490
(Last updated November 08, 2023) ▾
MITRE ATT&CK
Log in to add MITRE ATT&CK tag
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Description
Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the ‘Cache-Digest’ header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. Configuring the HTTP/2 feature via “H2Push off” will mitigate this vulnerability for unpatched servers.
Add Assessment
1
CVSS V3 Severity and Metrics
Data provided by the National Vulnerability Database (NVD)
Base Score:
7.5 High
Impact Score:
3.6
Exploitability Score:
3.9
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
None
Integrity (I):
None
Availability (A):
High
General Information
Vendors
- apache,
- canonical,
- debian,
- fedoraproject,
- opensuse,
- oracle,
- redhat
Products
- communications element manager,
- communications session report manager,
- communications session route manager,
- debian linux 10.0,
- enterprise linux 8.0,
- enterprise linux eus 8.1,
- enterprise linux eus 8.2,
- enterprise linux eus 8.4,
- enterprise linux eus 8.6,
- enterprise linux for ibm z systems 8.0,
- enterprise linux for ibm z systems eus 8.1,
- enterprise linux for ibm z systems eus 8.2,
- enterprise linux for ibm z systems eus 8.4,
- enterprise linux for ibm z systems eus 8.6,
- enterprise linux for power little endian 8.0,
- enterprise linux for power little endian eus 8.1,
- enterprise linux for power little endian eus 8.2,
- enterprise linux for power little endian eus 8.4,
- enterprise linux for power little endian eus 8.6,
- enterprise linux server aus 8.2,
- enterprise linux server aus 8.4,
- enterprise linux server aus 8.6,
- enterprise linux server for power little endian update services for sap solutions 8.1,
- enterprise linux server for power little endian update services for sap solutions 8.2,
- enterprise linux server for power little endian update services for sap solutions 8.4,
- enterprise linux server for power little endian update services for sap solutions 8.6,
- enterprise linux server tus 8.2,
- enterprise linux server tus 8.4,
- enterprise linux server tus 8.6,
- enterprise linux server update services for sap solutions 8.1,
- enterprise linux server update services for sap solutions 8.2,
- enterprise linux server update services for sap solutions 8.4,
- enterprise linux server update services for sap solutions 8.6,
- enterprise manager ops center 12.4.0.0,
- fedora 31,
- fedora 32,
- http server,
- hyperion infrastructure technology 11.1.2.4,
- instantis enterprisetrack 17.1,
- instantis enterprisetrack 17.2,
- instantis enterprisetrack 17.3,
- leap 15.1,
- leap 15.2,
- openstack 16.1,
- openstack for ibm power 16.1,
- software collections 1.0,
- ubuntu linux 16.04,
- ubuntu linux 18.04,
- ubuntu linux 20.04,
- zfs storage appliance kit 8.8
References
Advisory
