CVE-2014-0242

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-12-09 · updated 2026-06-17
Weakness: CWE-200

Description

mod_wsgi module before 3.4 for Apache, when used in embedded mode, might allow remote attackers to obtain sensitive information via the Content-Type header which is generated from memory that may have been freed and then overwritten by a separate thread.

Affected products

mod_wsgi: before 3.4 — fixed in 3.4

How to fix

Upgrade to a fixed version: mod_wsgi 3.4. Check the vendor advisory for mitigations.

References

http://blog.dscpl.com.au/2014/05/security-release-for-modwsgi-version-35.html
http://modwsgi.readthedocs.org/en/latest/release-notes/version-3.4.html
http://www.openwall.com/lists/oss-security/2014/05/21/1
http://www.securityfocus.com/bid/67534
http://blog.dscpl.com.au/2014/05/security-release-for-modwsgi-version-35.html
http://modwsgi.readthedocs.org/en/latest/release-notes/version-3.4.html
http://www.openwall.com/lists/oss-security/2014/05/21/1
http://www.securityfocus.com/bid/67534

Get alerted when CVE-2014-0242 or the next vulnerability affects your stack