Permissions, Privileges, and Access Controls in Apache HTTP Server - CVE-2019-0215
Published: April 2, 2019
Vulnerability identifier: #VU18112
CSH Severity: Medium
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-0215
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to escalate privileges on the system.
The vulnerability exists within the mod_ssl module when processing access controls for per-location/per-dir client certificate verification in TLSv1.3. A remote authenticated attacker can gain access to restricted directories on the server.
Affected software
Apache HTTP Server
apache2 (Alpine package)
httpd
Red Hat Enterprise Linux for x86_64
Fedora
Maximo Application Suite - IoT Component
apache2 (Alpine package)
httpd
Red Hat Enterprise Linux for x86_64
Fedora
Maximo Application Suite - IoT Component
How to mitigate CVE-2019-0215
Install updates from vendor's website.
Apache HTTP Server - update to 2.4.39
apache2 (Alpine package) - update to 2.4.39-r0
httpd - addressed in versions 2.4.39-1.1.fc28, 2.4.39-2.fc29, 2.4.39-2.fc30
Maximo Application Suite - IoT Component - addressed in versions 8.7.20, 8.8.16, 9.0.6
apache2 (Alpine package) - update to 2.4.39-r0
httpd - addressed in versions 2.4.39-1.1.fc28, 2.4.39-2.fc29, 2.4.39-2.fc30
Maximo Application Suite - IoT Component - addressed in versions 8.7.20, 8.8.16, 9.0.6
External References
Related Security Bulletins
- Multiple vulnerabilities in Apache HTTP Server
- Red Hat update for httpd:2.4
- Permissions, Privileges, and Access Controls in apache2 (Alpine package)
- Multiple vulnerabilities in IBM Maximo Application Suite - IoT Component
- Fedora 29 update for httpd
- Fedora 28 update for httpd
- Fedora 30 update for httpd