Memory Access Vulnerability in Apache2 Package: CVE-2019-0196
Summary
ALPINE-CVE-2019-0196: A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Affects apache2 versions < 2.4.39-r0. Fixed in 2.4.39-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server, commonly referred to as Apache2, is a widely used open-source web server software that enables the hosting of websites and web applications. It is known for its flexibility, power, and extensive features, including support for various protocols, modules, and configurations. However, certain versions of Apache2 are vulnerable to a memory access issue that can lead to improper request handling, potentially affecting the stability and security of web applications.
Vulnerability Detail
A vulnerability was identified in Apache HTTP Server versions 2.4.17 to 2.4.38, where fuzzed network input could exploit the http/2 request handling mechanism. This flaw allows access to freed memory during string comparison when determining the method of a request, leading to incorrect processing of requests. The ramifications of this vulnerability include potential denial of service and exposure to further attacks, as it may allow attackers to manipulate server behavior.
How To Fix
Minimum fixed version
2.4.39-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the http/2 protocol in your Apache configuration until the package is updated. This can be done by commenting out or removing the 'Protocols h2 http/1.1' line in your Apache configuration file.
Conclusion
The CVE-2019-0196 vulnerability in Apache2 poses a significant risk to web applications running affected versions. It is crucial to update to the patched version to mitigate potential threats. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for apache2 →
FAQ
Apache2 versions 2.4.17 to 2.4.38 are affected by this vulnerability.
The CVSS score for this vulnerability is 5.3, indicating a medium severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to denial of service and may expose the server to further attacks due to improper request handling.
Yes, Vulert provides a service that monitors and alerts in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
