CVE-2011-1928
NoneCVSS
—
EPSS
10.3%
Published
May 24, 2011
CISA due date
—
The record
The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3 and 1.4.4, and the Apache HTTP Server 2.2.18, allows remote attackers to cause a denial of service (infinite loop) via a URI that does not match unspecified types of wildcard patterns, as demonstrated by attacks against mod_autoindex in httpd when a /*/WEB-INF/ configuration pattern is used. NOTE: this issue exists because of an incorrect fix for CVE-2011-0419.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | apr | 0 | 1.4.5-1 |
| Debian:12 | apr | 0 | 1.4.5-1 |
| Debian:13 | apr | 0 | 1.4.5-1 |
| Debian:5.0 | apr | 0 | 1.2.12-5+lenny4 |
| Debian:6.0 | apr | 0 | 1.4.2-6+squeeze2 |
| Red Hat:enterprise_linux:4::as | apr | 0 | 0:0.9.4-26.el4 |
| Red Hat:enterprise_linux:4::as | apr-debuginfo | 0 | 0:0.9.4-26.el4 |
| Red Hat:enterprise_linux:4::as | apr-devel | 0 | 0:0.9.4-26.el4 |
| Red Hat:enterprise_linux:4::desktop | apr | 0 | 0:0.9.4-26.el4 |
| Red Hat:enterprise_linux:4::desktop | apr-debuginfo | 0 | 0:0.9.4-26.el4 |
| Red Hat:enterprise_linux:4::desktop | apr-devel | 0 | 0:0.9.4-26.el4 |
| Red Hat:enterprise_linux:4::es | apr | 0 | 0:0.9.4-26.el4 |
| Red Hat:enterprise_linux:4::es | apr-debuginfo | 0 | 0:0.9.4-26.el4 |
| Red Hat:enterprise_linux:4::es | apr-devel | 0 | 0:0.9.4-26.el4 |
| Red Hat:enterprise_linux:4::ws | apr | 0 | 0:0.9.4-26.el4 |
| Red Hat:enterprise_linux:4::ws | apr-debuginfo | 0 | 0:0.9.4-26.el4 |
| Red Hat:enterprise_linux:4::ws | apr-devel | 0 | 0:0.9.4-26.el4 |
| Red Hat:enterprise_linux:5::client | apr | 0 | 0:1.2.7-11.el5_6.5 |
| Red Hat:enterprise_linux:5::client | apr-debuginfo | 0 | 0:1.2.7-11.el5_6.5 |
| Red Hat:enterprise_linux:5::client | apr-devel | 0 | 0:1.2.7-11.el5_6.5 |
| Red Hat:enterprise_linux:5::client | apr-docs | 0 | 0:1.2.7-11.el5_6.5 |
| Red Hat:enterprise_linux:5::client_workstation | apr | 0 | 0:1.2.7-11.el5_6.5 |
| Red Hat:enterprise_linux:5::client_workstation | apr-debuginfo | 0 | 0:1.2.7-11.el5_6.5 |
| Red Hat:enterprise_linux:5::client_workstation | apr-devel | 0 | 0:1.2.7-11.el5_6.5 |
| Red Hat:enterprise_linux:5::client_workstation | apr-docs | 0 | 0:1.2.7-11.el5_6.5 |
| Red Hat:enterprise_linux:5::server | apr | 0 | 0:1.2.7-11.el5_6.5 |
| Red Hat:enterprise_linux:5::server | apr-debuginfo | 0 | 0:1.2.7-11.el5_6.5 |
| Red Hat:enterprise_linux:5::server | apr-devel | 0 | 0:1.2.7-11.el5_6.5 |
| Red Hat:enterprise_linux:5::server | apr-docs | 0 | 0:1.2.7-11.el5_6.5 |
| Red Hat:enterprise_linux:6::server | apr | 0 | 0:1.3.9-3.el6_1.2 |
| Red Hat:enterprise_linux:6::server | apr-debuginfo | 0 | 0:1.3.9-3.el6_1.2 |
| Red Hat:enterprise_linux:6::server | apr-devel | 0 | 0:1.3.9-3.el6_1.2 |
| openSUSE:Tumbleweed | apr | 0 | 1.5.2-3.4 |
| openSUSE:Tumbleweed | apr | 0 | 1.7.0-3.1 |
Related vulnerabilities
- CVE-2012-0840 tables/apr_hash.c in the Apache Portable Runtime (APR) library through 1.4.5 computes… Also affects apr
- CVE-2011-0419 Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the… Also affects apr
- CVE-2009-2412 Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache… Also affects apr
- CVE-2026-41983 Null pointer dereference vulnerability in the browser module. Impact: Successful… CWE-399
- CVE-2015-9252 An issue was discovered in QPDF before 7.0.0. CWE-399
- CVE-2012-0881 Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of… CWE-399
- CVE-2015-7944 The RESTful control interface (aka RAPI or ganeti-rapi) in Ganeti before 2.9.7, 2.10.x… CWE-399
- CVE-2015-8855 The semver package before 4.3.2 for Node.js allows attackers to cause a denial of service… CWE-399