PT-2019-3932 · Apache+7 · Apache Http Server+7

Published 2019-01-29 · Updated 2022-09-07 · CVE-2019-0197

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.34 through 2.4.38

Description A vulnerability was found in the implementation of the HTTP/2 protocol in the Apache HTTP Server. The issue is related to the handling of HTTP requests. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. The vulnerability can be exploited by a remote attacker to cause a denial of service or lead to incorrect server configuration.

Recommendations For Apache HTTP Server versions 2.4.34 through 2.4.38, consider disabling the HTTP/2 protocol for http: hosts or disabling the H2Upgrade option for h2 on https: hosts as a temporary workaround until a patch is available. Restrict access to the H2Upgrade configuration to minimize the risk of exploitation. Avoid using the H2Upgrade option until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

ALSA-2020:4751

ALT-PU-2019-1580

BDU:2019-04410

CESA-2020_4751

CVE-2019-0197

OPENSUSE-SU-2019:1209-1

OPENSUSE-SU-2019_1190-1

OPENSUSE-SU-2019_1209-1

OPENSUSE-SU-2019_1258-1

RHSA-2019:3932

RHSA-2019:3933

RHSA-2020:2644

RHSA-2020:4751

RHSA-2020_4751

RLSA-2020:4751

SUSE-SU-2019:0873-1

SUSE-SU-2019:0878-1

USN-4113-1

USN-4113-2

Affected Products

Alt Linux

Almalinux

Apache Http Server

Centos

Red Hat

Rocky Linux

Suse

Ubuntu

References · 103

• https://nvd.nist.gov/vuln/detail/CVE-2019-0197 · Security Note
• https://ubuntu.com/security/CVE-2019-0197 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-10092 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-10097 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-10082 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:0873-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04410 · Security Note
• https://access.redhat.com/errata/RHSA-2019:3932 · Vendor Advisory
• https://httpd.apache.org/security/vulnerabilities_24.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-4113-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:1209-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:0878-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-4751.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-4113-2 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2020:4751 · Vendor Advisory