CVE-2020-11985

IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules...

Original description

The description as published by the source.

IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip and certain mod_rewrite rules, an attacker could spoof their IP address for logging and PHP scripts. Note this issue was fixed in Apache HTTP Server 2.4.24 but was retrospectively allocated a low severity CVE in 2020.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Bitnami apache

[{"type":"SEMVER","events":[{"introduced":"2.4.1"},{"fixed":"2.4.24"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2020-11985 apache2 Fixed in: 2.4.25-1
Ubuntu UBUNTU-CVE-2020-11985 apache2

References

advisory httpd.apache.org
advisory security.gentoo.org
advisory security.netapp.com
web lists.apache.org
web lists.apache.org
web lists.apache.org
web lists.apache.org
web lists.apache.org
web lists.apache.org
web lists.apache.org
web lists.apache.org
web lists.apache.org
web lists.apache.org
web lists.fedoraproject.org
web lists.fedoraproject.org
web oracle.com
web nvd.nist.gov