USN-4558-1: libapreq2 vulnerabilities
30 September 2020
libapreq2 could be made to crash if it received specially crafted network traffic.
Releases
Packages
- libapreq2 - a safe, standards-compliant, high-performance library used for parsing HTTP cookies, query-strings and POST data
Details
It was discovered that libapreq2 did not properly sanitize the Content-Type
field in certain, crafted HTTP requests. An attacker could use this
vulnerability to cause libapreq2 to crash.
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 18.04
-
libapache2-mod-apreq2
-
2.13-7~deb10u1build0.18.04.1
-
libapache2-request-perl
-
2.13-7~deb10u1build0.18.04.1
-
libapreq2-3
-
2.13-7~deb10u1build0.18.04.1
-
libapreq2-dev
-
2.13-7~deb10u1build0.18.04.1
In general, a standard system update will make all the necessary changes.
References
Related notices
- USN-5041-1: libapache2-mod-apreq2, libapreq2, libapache2-request-perl, libapreq2-doc, libapreq2-3, libapreq2-dev