PT-2019-3931 · Apache+3 · Apache Http Server+3

Published 2019-01-23 · Updated 2023-08-27 · CVE-2019-0215

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.37 through 2.4.38

Description The issue is related to a flaw in the mod ssl component of the Apache HTTP Server, specifically concerning inadequate access control. This flaw can be exploited by a remote attacker to bypass configured access control restrictions when client certificate verification is used with TLSv1.3. The attack can be launched remotely.

Recommendations For versions 2.4.37 and 2.4.38, consider disabling the use of TLSv1.3 with client certificate verification until a patch is available. As a temporary workaround, restrict access to locations using per-location client certificate verification to minimize the risk of exploitation.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

ALT-PU-2019-1580

BDU:2019-04409

CESA-2019_0980

CVE-2019-0215

DLA-3351-1

RHSA-2019:0980

RHSA-2019_0980

Affected Products

Alt Linux

Apache Http Server

Centos

Red Hat

References · 89

• 🔥 https://github.com/ozkanbilge/Apache-Exploit-2019 · Exploit
• 🔥 https://lists.apache.org/thread.html/2d6bd429a0ba9af1580da896575cfca6e42bb05e7536562d4b095fcf@%3Ccvs.httpd.apache.org%3E · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0197 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/ALIR5S3O7NRHEGFMIDMUSYQIZOE4TJJN · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0215 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/EZRMTEIGZKYFNGIDOTXN3GNEJTLVCYU7 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2019-0980.html · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3351-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10097 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0196 · Security Note
• https://bdu.fstec.ru/vul/2019-02559 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-0215 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/WETXNQWNQLWHV6XNW6YTO5UGDTIWAQGT · Vendor Advisory
• https://httpd.apache.org/security/vulnerabilities_24.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0217 · Security Note