Denial of Service Vulnerability in Apache2: CVE-2019-0190
Summary
ALPINE-CVE-2019-0190: A bug exists in the way mod_ssl handled client renegotiations. Affects apache2 versions < 2.4.38-r0. Fixed in 2.4.38-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server, commonly referred to as Apache2, is a widely used open-source web server software that enables users to serve web content over the internet. It is known for its flexibility, power, and extensive feature set, including support for various modules and configurations. However, certain versions of Apache2 are vulnerable to a specific denial of service (DoS) issue due to improper handling of client renegotiations in mod_ssl, particularly when used with OpenSSL version 1.1.1 or later.
Vulnerability Detail
The vulnerability identified as CVE-2019-0190 arises from a bug in mod_ssl that improperly handles client renegotiations. A remote attacker can exploit this vulnerability by sending a carefully crafted request, causing mod_ssl to enter an infinite loop, which leads to a denial of service. This issue is specifically present in Apache HTTP Server version 2.4.37 when paired with OpenSSL version 1.1.1 or later. The ramifications of this vulnerability can result in service outages, affecting the availability of web services hosted on the affected server.
How To Fix
Minimum fixed version
2.4.38-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable SSL renegotiation in your Apache configuration. This can be done by adding the following line to your Apache configuration file: 'SSLInsecureRenegotiation off'. However, this is not a permanent solution and updating to the patched version is highly recommended.
Conclusion
CVE-2019-0190 is a significant denial of service vulnerability affecting Apache2, particularly in versions prior to 2.4.38-r0. It is crucial for users to update their Apache installations to the patched version to ensure the security and availability of their web services. Temporary workarounds can mitigate the risk, but they should not replace a proper update.
See every vulnerability recorded for apache2 →
FAQ
CVE-2019-0190 is a vulnerability in Apache2 that allows remote attackers to cause a denial of service by exploiting improper handling of client renegotiations in mod_ssl.
Apache2 versions prior to 2.4.38-r0 are affected by this vulnerability, particularly version 2.4.37 when used with OpenSSL version 1.1.1 or later.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of CVE-2019-0190 is 7.5, indicating a high severity level.
If immediate updating is not possible, consider implementing the workaround by disabling SSL renegotiation in your Apache configuration until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
