Information disclosure in mod_wsgi - CVE-2014-0242

Vulnerability identifier: #VU30558

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2014-0242

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

mod_wsgi module before 3.4 for Apache, when used in embedded mode, might allow remote attackers to obtain sensitive information via the Content-Type header which is generated from memory that may have been freed and then overwritten by a separate thread.

mod_wsgi
libapache2-mod-wsgi (Ubuntu package)
libapache2-mod-wsgi-py3 (Ubuntu package)
python26-mod_wsgi
Amazon Linux AMI
Gentoo Linux
Fedora
Ubuntu

Install update from vendor's website.

mod_wsgi - update to 3.4
libapache2-mod-wsgi (Ubuntu package) - addressed in versions 3.3-4ubuntu0.1, 3.4-4ubuntu2.1.13.10.1, 3.4-4ubuntu2.1.14.04.1
libapache2-mod-wsgi-py3 (Ubuntu package) - addressed in versions 3.3-4ubuntu0.1, 3.4-4ubuntu2.1.13.10.1, 3.4-4ubuntu2.1.14.04.1
mod_wsgi - update to 3.5-1.el5
python26-mod_wsgi - update to 3.5-1.el5

• Exploit #3563 - Apache mod_wsgi - Information Disclosure (July 20, 2020)

• http://blog.dscpl.com.au/2014/05/security-release-for-modwsgi-version-35.html
• http://modwsgi.readthedocs.org/en/latest/release-notes/version-3.4.html
• http://www.openwall.com/lists/oss-security/2014/05/21/1
• http://www.securityfocus.com/bid/67534

• Information disclosure in mod_wsgi
• Amazon Linux AMI update for mod_wsgi
• Amazon Linux AMI update for mod24_wsgi
• Gentoo update for mod_wsgi
• Fedora EPEL 5 update for mod_wsgi, python26-mod_wsgi
• Ubuntu update for mod-wsgi