Resource management error in Apache HTTP Server - CVE-2019-0197

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU18108

Resource management error in Apache HTTP Server - CVE-2019-0197

Published: April 2, 2019 / Updated: June 13, 2019


Vulnerability identifier: #VU18108
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-0197
CWE-ID: CWE-399
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an error within the mod_http2 module when processing update requests from http/1.1 to http/2, if this was not the first request on a connection. A remote attacker can send specially crafted requests to the affected server and perform denial of service attack.

Successful exploitation of the vulnerability requires that HTTP/2 protocol is enabled for a "http:" host or H2Upgrade is enabled for h2 on a "https:" host.


Affected software

Apache HTTP Server
JBoss Core Services
jbcs-httpd24-mod_http2 (Red Hat package)
jbcs-httpd24-nghttp2 (Red Hat package)
apache2 (Ubuntu package)
apache2 (Alpine package)
jbcs-httpd24-httpd (Red Hat package)
jbcs-httpd24-mod_security (Red Hat package)
jbcs-httpd24-curl (Red Hat package)
jbcs-httpd24-openssl-pkcs11 (Red Hat package)
jbcs-httpd24-mod_md (Red Hat package)
mod_ldap
httpd-debugsource
httpd-debuginfo
httpd
httpd-devel
httpd-filesystem
httpd-help
httpd-tools
mod_ssl
mod_session
mod_md
mod_proxy_html
Dell Secure Connect Gateway
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Opensuse
openEuler
Fedora
Maximo Application Suite - IoT Component

How to mitigate CVE-2019-0197

Install updates from vendor's website.

Apache HTTP Server - update to 2.4.39
jbcs-httpd24-mod_http2 (Red Hat package) - addressed in versions 1.15.7-3.jbcs.el6, 1.15.7-3.jbcs.el7
jbcs-httpd24-nghttp2 (Red Hat package) - addressed in versions 1.39.2-25.jbcs.el6, 1.39.2-25.jbcs.el7
apache2 (Ubuntu package) - addressed in versions 2.4.18-2ubuntu3.12, 2.4.18-2ubuntu3.13, 2.4.29-1ubuntu4.10, 2.4.29-1ubuntu4.11, 2.4.38-2ubuntu2.2, 2.4.38-2ubuntu2.3
apache2 (Alpine package) - update to 2.4.39-r0
jbcs-httpd24-httpd (Red Hat package) - addressed in versions 2.4.37-57.jbcs.el6, 2.4.37-57.jbcs.el7
jbcs-httpd24-mod_security (Red Hat package) - addressed in versions 2.9.2-51.GA.jbcs.el6, 2.9.2-51.GA.jbcs.el7
Dell Secure Connect Gateway - update to 5.12.00.10
jbcs-httpd24-curl (Red Hat package) - addressed in versions 7.64.1-36.jbcs.el6, 7.64.1-36.jbcs.el7
jbcs-httpd24-openssl-pkcs11 (Red Hat package) - update to 0.4.10-7.jbcs.el7
jbcs-httpd24-mod_md (Red Hat package) - addressed in versions 2.0.8-24.jbcs.el6, 2.0.8-24.jbcs.el7
mod_ldap - update to 2.4.34-18
httpd-debugsource - update to 2.4.34-18
httpd-debuginfo - update to 2.4.34-18
httpd - update to 2.4.34-18
httpd-devel - update to 2.4.34-18
httpd-filesystem - update to 2.4.34-18
httpd-help - update to 2.4.34-18
httpd-tools - update to 2.4.34-18
mod_ssl - update to 2.4.34-18
mod_session - update to 2.4.34-18
mod_md - update to 2.4.34-18
mod_proxy_html - update to 2.4.34-18
httpd - update to 2.4.39-2.fc30
Maximo Application Suite - IoT Component - addressed in versions 8.7.20, 8.8.16, 9.0.6

External References

Related Security Bulletins