CVE-2019-0197
A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set "H2Upgrade on" are unaffected by this issue.
Timeline
- CVE published
- Record last updated
Affected versions
- Apache Software Foundation Apache HTTP Server
2.4.34 to 2.4.38
References 25
httpd.apache.org
openwall.com
securityfocus.com
lists.fedoraproject.org
lists.apache.org
- thread.html/e0b8f6e858b1c8ec2ce8e291a2c543d438915037c7af661ab6d33808@<dev.httpd.apache.org>
- thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@<cvs.httpd.apache.org>
- thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830@<cvs.httpd.apache.org>
- thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f@<cvs.httpd.apache.org>
- thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234@<cvs.httpd.apache.org>
- thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@<cvs.httpd.apache.org>
- thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf@<cvs.httpd.apache.org>
- thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@<cvs.httpd.apache.org>