NULL pointer dereference in libapreq2 - CVE-2019-12412

Vulnerability identifier: #VU21564

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-12412

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error when processing nested "multipart" body. A remote attacker can send a specially crafted HTTP request and perform a denial of service (DoS) attack.

libapreq2
Amazon Linux AMI
Fedora
Ubuntu
libapreq2 (Debian package)
libapreq2
libapache2-mod-apreq2 (Ubuntu package)
libapache2-request-perl (Ubuntu package)
libapreq2-3 (Ubuntu package)
libapreq2-dev (Ubuntu package)

Install update from vendor's website.

libapreq2 (Debian package) - addressed in versions 2.13-7~deb9u1, 2.13-7~deb10u1
libapreq2 - addressed in versions 2.13-2.el6, 2.13-13.el7, 2.13-38.fc29, 2.13-38.fc30, 2.13-38.fc31
libapache2-mod-apreq2 (Ubuntu package) - update to 2.13-7~deb10u1build0.18.04.1
libapache2-request-perl (Ubuntu package) - update to 2.13-7~deb10u1build0.18.04.1
libapreq2-3 (Ubuntu package) - update to 2.13-7~deb10u1build0.18.04.1
libapreq2-dev (Ubuntu package) - update to 2.13-7~deb10u1build0.18.04.1

• https://www.debian.org/security/2019/dsa-4541

• Denial of service in libapreq2
• Debian update for libapreq2
• Amazon Linux AMI update for libapreq2
• Ubuntu update for libapreq2
• Fedora 29 update for libapreq2
• Fedora EPEL 7 update for libapreq2
• Fedora 31 update for libapreq2
• Fedora EPEL 6 update for libapreq2
• Fedora 30 update for libapreq2