CVE-2003-0020 Apache does not filter terminal escape sequences from its error logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to e...
MediumCVSS 5.0
EPSS 16.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Apache does not filter terminal escape sequences from its error logs, which could make it easier for attackers to insert those sequences into terminal emulators containing vulnerabilities related to escape sequences.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache HTTP Server | >= 1.3.0, < 1.3.31 | 1.3.31 |
| Apache HTTP Server | >= 2.0.0, < 2.0.49 | 2.0.49 |
| debian/apache2(Debian:12) | < 2.0.49 | 2.0.49 |
| debian/apache2(Debian:13) | < 2.0.49 | 2.0.49 |
| debian/apache2(Debian:14) | < 2.0.49 | 2.0.49 |
References
- 20030224 Terminal Emulator Security Issues broken-link mailing-list
- MDKSA-2004:046 third-party-advisory vendor-advisory
- 20030224 Terminal Emulator Security Issues mailing-list third-party-advisory
- APPLE-SA-2004-05-03 third-party-advisory vendor-advisory
- 20040512 [OpenPKG-SA-2004.021] OpenPKG Security Advisory (apache) mailing-list third-party-advisory
- SSRT4717 third-party-advisory vendor-advisory
- GLSA-200405-22 third-party-advisory vendor-advisory
- 101555 broken-link vendor-advisory
- 57628 broken-link vendor-advisory
- apache-esc-seq-injection(11412) broken-link vdb-entry
- MDKSA-2003:050 broken-link vendor-advisory
- RHSA-2003:082 third-party-advisory vendor-advisory
- RHSA-2003:083 third-party-advisory vendor-advisory
- RHSA-2003:104 third-party-advisory vendor-advisory
- RHSA-2003:139 third-party-advisory vendor-advisory
- RHSA-2003:243 third-party-advisory vendor-advisory
- RHSA-2003:244 third-party-advisory vendor-advisory
- 9930 third-party-advisory vdb-entry
- SSA:2004-133 mailing-list third-party-advisory vendor-advisory
- 2004-0017 broken-link vendor-advisory
- 2004-0027 broken-link vendor-advisory
- [httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20200401 svn commit: r1058586 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20210330 svn commit: r1073140 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20210606 svn commit: r1075470 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20210330 svn commit: r1073140 [1/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20210330 svn commit: r1888194 [2/13] - /httpd/site/trunk/content/security/json/ mailing-list
- [httpd-cvs] 20200401 svn commit: r1058587 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20210330 svn commit: r1073143 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [2/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073139 [2/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
- [httpd-cvs] 20210606 svn commit: r1075470 [1/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
- oval:org.mitre.oval:def:100109 signature third-party-advisory vdb-entry
- oval:org.mitre.oval:def:150 signature third-party-advisory vdb-entry
- oval:org.mitre.oval:def:4114 signature third-party-advisory vdb-entry
- Debian Security Tracker CVE-2003-0020 vendor-advisory