Use-after-free in Apache HTTP Server - CVE-2019-0196

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU18109

Use-after-free in Apache HTTP Server - CVE-2019-0196

Published: April 2, 2019 / Updated: June 13, 2019


Vulnerability identifier: #VU18109
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-0196
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform denial of service attack.

The vulnerability exists due to a use-after-free error within the mod_http2 module when processing HTTP/2 requests. A remote attacker can make the application to access freed memory during string comparison when determining the method of a request and process the request incorrectly.

Successful exploitation of the vulnerability may allow an attacker to gain access to sensitive information or perform a denial of service attack.


Affected software

Apache HTTP Server
JBoss Core Services
jbcs-httpd24-mod_http2 (Red Hat package)
jbcs-httpd24-nghttp2 (Red Hat package)
apache2 (Debian package)
apache2 (Ubuntu package)
apache2 (Alpine package)
jbcs-httpd24-httpd (Red Hat package)
jbcs-httpd24-mod_security (Red Hat package)
jbcs-httpd24-curl (Red Hat package)
jbcs-httpd24-openssl-pkcs11 (Red Hat package)
mod_http2
jbcs-httpd24-mod_md (Red Hat package)
httpd-debugsource
mod_ssl
mod_session
mod_proxy_html
mod_md
mod_ldap
httpd-tools
httpd-help
httpd-filesystem
httpd-devel
httpd-debuginfo
httpd
Dell Secure Connect Gateway
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Opensuse
openEuler
Fedora
Maximo Application Suite - IoT Component

How to mitigate CVE-2019-0196

Install updates from vendor's website.

Apache HTTP Server - update to 2.4.39
jbcs-httpd24-mod_http2 (Red Hat package) - addressed in versions 1.15.7-3.jbcs.el6, 1.15.7-3.jbcs.el7
jbcs-httpd24-nghttp2 (Red Hat package) - addressed in versions 1.39.2-25.jbcs.el6, 1.39.2-25.jbcs.el7
apache2 (Debian package) - update to 2.4.25-3+deb9u7
apache2 (Ubuntu package) - addressed in versions 2.4.7-1ubuntu4.22, 2.4.18-2ubuntu3.10, 2.4.29-1ubuntu4.6, 2.4.34-1ubuntu2.1
apache2 (Alpine package) - update to 2.4.39-r0
jbcs-httpd24-httpd (Red Hat package) - addressed in versions 2.4.37-57.jbcs.el6, 2.4.37-57.jbcs.el7
jbcs-httpd24-mod_security (Red Hat package) - addressed in versions 2.9.2-51.GA.jbcs.el6, 2.9.2-51.GA.jbcs.el7
Dell Secure Connect Gateway - update to 5.12.00.10
jbcs-httpd24-curl (Red Hat package) - addressed in versions 7.64.1-36.jbcs.el6, 7.64.1-36.jbcs.el7
jbcs-httpd24-openssl-pkcs11 (Red Hat package) - update to 0.4.10-7.jbcs.el7
mod_http2 - addressed in versions 1.15.0-1.fc28, 1.15.0-1.fc29, 1.15.0-1.fc30, 1.15.1-1.fc29
jbcs-httpd24-mod_md (Red Hat package) - addressed in versions 2.0.8-24.jbcs.el6, 2.0.8-24.jbcs.el7
httpd-debugsource - update to 2.4.34-18
mod_ssl - update to 2.4.34-18
mod_session - update to 2.4.34-18
mod_proxy_html - update to 2.4.34-18
mod_md - update to 2.4.34-18
mod_ldap - update to 2.4.34-18
httpd-tools - update to 2.4.34-18
httpd-help - update to 2.4.34-18
httpd-filesystem - update to 2.4.34-18
httpd-devel - update to 2.4.34-18
httpd-debuginfo - update to 2.4.34-18
httpd - update to 2.4.34-18
httpd - update to 2.4.39-2.fc30
Maximo Application Suite - IoT Component - addressed in versions 8.7.20, 8.8.16, 9.0.6

External References

Related Security Bulletins