NULL pointer dereference in Apache HTTP Server - CVE-2019-10097

Vulnerability identifier: #VU20385

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-10097

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error when processing PROXY header within the mod_remoteip. A remote attacker that controls a trusted proxy server can send a specially crafted PROXY header,  trigger stack overflow and perform a denial of service (DoS) attack.

Apache HTTP Server
JBoss Core Services
Amazon Linux AMI
Gentoo Linux
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Slackware Linux
Opensuse
openEuler
Fedora
Red Hat Software Collections
jbcs-httpd24-brotli (Red Hat package)
jbcs-httpd24-apr (Red Hat package)
jbcs-httpd24-mod_http2 (Red Hat package)
apache2 (Ubuntu package)
apache2 (Debian package)
jbcs-httpd24-httpd (Red Hat package)
apache2 (Alpine package)
mod_md
mod_ldap
httpd-tools
httpd-help
httpd-filesystem
httpd-devel
httpd-debugsource
httpd-debuginfo
httpd
mod_proxy_html
mod_session
mod_ssl
Oracle HTTP Server
Maximo Application Suite - IoT Component

Install updates from vendor's website.

Apache HTTP Server - update to 2.4.41
jbcs-httpd24-brotli (Red Hat package) - addressed in versions 1.0.6-21.jbcs.el6, 1.0.6-21.jbcs.el7
jbcs-httpd24-apr (Red Hat package) - addressed in versions 1.6.3-86.jbcs.el6, 1.6.3-86.jbcs.el7
jbcs-httpd24-mod_http2 (Red Hat package) - addressed in versions 1.11.3-22.jbcs.el6, 1.11.3-22.jbcs.el7
apache2 (Ubuntu package) - addressed in versions 2.4.18-2ubuntu3.12, 2.4.18-2ubuntu3.13, 2.4.29-1ubuntu4.10, 2.4.29-1ubuntu4.11, 2.4.38-2ubuntu2.2, 2.4.38-2ubuntu2.3
apache2 (Debian package) - update to 2.4.25-3+deb9u8
jbcs-httpd24-httpd (Red Hat package) - addressed in versions 2.4.37-52.jbcs.el6, 2.4.37-52.jbcs.el7
apache2 (Alpine package) - update to 2.4.41-r0
mod_md - addressed in versions 2.0.8-2.fc30, 2.0.8-3.fc29
mod_md - update to 2.4.34-18
mod_ldap - update to 2.4.34-18
httpd-tools - update to 2.4.34-18
httpd-help - update to 2.4.34-18
httpd-filesystem - update to 2.4.34-18
httpd-devel - update to 2.4.34-18
httpd-debugsource - update to 2.4.34-18
httpd-debuginfo - update to 2.4.34-18
httpd - update to 2.4.34-18
mod_proxy_html - update to 2.4.34-18
mod_session - update to 2.4.34-18
mod_ssl - update to 2.4.34-18
httpd - addressed in versions 2.4.41-1.fc29, 2.4.41-1.fc30
Maximo Application Suite - IoT Component - addressed in versions 8.7.20, 8.8.16, 9.0.6

• https://httpd.apache.org/security/vulnerabilities_24.html

• Multiple vulnerabilities in Apache HTTP Server
• Debian update for apache2
• Ubuntu update for Apache HTTP Server
• OpenSUSE Linux update for apache2
• Gentoo update for Apache
• Ubuntu regression update for Apache HTTP Server
• Amazon Linux AMI update for httpd24
• Red Hat Software Collections update for httpd24-httpd
• Slackware Linux update for httpd
• Red Hat JBoss Core Services update for Apache HTTP Server
• NULL pointer dereference in apache2 (Alpine package)
• Multiple vulnerabilities in Oracle HTTP Server
• Red Hat Enterprise Linux 8 update for the httpd:2.4 module
• openEuler 20.03 LTS update for httpd
• Multiple vulnerabilities in IBM Maximo Application Suite - IoT Component
• Fedora 30 update for httpd, mod_md
• Fedora 29 update for httpd, mod_md