A flaw was found in httpd before version 2.4.46. Logging using the wrong pool by mod_http2 at debug/trace log level may lead to potential crashes and denial of service. Upstream patch: https://github.com/icing/mod_h2/commit/89773a4f98ee9a9fb402470e04b6f4044faa7fdf
Acknowledgments: Name: the Apache project
This vulnerability is out of security support scope for the following product: * Red Hat JBoss Enterprise Web Server 2 Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.
Created httpd tracking bugs for this issue: Affects: fedora-all [bug 1868149]
External References: https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2020-11993
Statement: Red Hat Enterprise Linux 5, 6, and 7 do not ship the vulnerable version of httpd and, thus, are not affected.
This issue has been addressed in the following products: Red Hat JBoss Core Services Via RHSA-2020:4383 https://access.redhat.com/errata/RHSA-2020:4383
This issue has been addressed in the following products: JBoss Core Services on RHEL 7 JBoss Core Services on RHEL 6 Via RHSA-2020:4384 https://access.redhat.com/errata/RHSA-2020:4384
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-11993
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2021:1809 https://access.redhat.com/errata/RHSA-2021:1809