PT-2019-3930 · Apache+5 · Apache Http Server+5

Published 2019-04-01 · Updated 2021-06-06 · CVE-2019-0217

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.38 and prior

Description A race condition in the mod auth digest component of the Apache HTTP Server could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions. This issue is caused by synchronization errors when using a shared resource. The exploitation of this issue may allow a remote attacker to authenticate using a different username.

Recommendations For Apache HTTP Server versions 2.4.38 and prior, consider disabling the mod auth digest module until a patch is available to prevent potential exploitation. Restrict access to sensitive areas of the server to minimize the risk of unauthorized access.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

ALT-PU-2019-1580

BDU:2019-04408

CESA-2019_2343

CESA-2019_3436

CVE-2019-0217

DLA-1748-1

DSA-4422-1

OPENSUSE-SU-2019:1209-1

OPENSUSE-SU-2019_1190-1

OPENSUSE-SU-2019_1209-1

OPENSUSE-SU-2019_1258-1

RHSA-2019:2343

RHSA-2019:3436

RHSA-2019:3932

RHSA-2019:3933

RHSA-2019:4126

RHSA-2019_2343

RHSA-2019_3436

SUSE-SU-2019:0873-1

SUSE-SU-2019:0878-1

SUSE-SU-2019:0888-1

SUSE-SU-2019:0888-2

SUSE-SU-2019:0889-1

USN-3937-1

USN-3937-2

Affected Products

Alt Linux

Apache Http Server

Centos

Red Hat

Suse

Ubuntu

References · 99

• https://osv.dev/vulnerability/DLA-1748-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-17199 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:0888-2 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-0217 · Vendor Advisory
• https://usn.ubuntu.com/3937-2 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-0217 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-0217 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:2343 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:0873-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZRMTEIGZKYFNGIDOTXN3GNEJTLVCYU7 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:3932 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-0217 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ALIR5S3O7NRHEGFMIDMUSYQIZOE4TJJN · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3937-1 · Vendor Advisory