Apache HTTP Server Vulnerability: Denial of Service Risk in Versions 2.4.34 to 2.4.38
Summary
ALPINE-CVE-2019-0197: A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. Affects apache2 versions < 2.4.39-r0. Fixed in 2.4.39-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache HTTP Server is a widely-used open-source web server software that enables websites to serve content over the internet. It is known for its flexibility, power, and extensive feature set, including support for various protocols, modules, and configurations. However, certain versions of Apache HTTP Server, specifically from 2.4.34 to 2.4.38, have been found to be vulnerable to a Denial of Service (DoS) attack when HTTP/2 is enabled. This vulnerability can lead to server misconfigurations and crashes, impacting the availability of hosted websites.
Vulnerability Detail
A vulnerability was identified in Apache HTTP Server versions 2.4.34 to 2.4.38, where enabling HTTP/2 for a host could lead to a Denial of Service. Specifically, if an Upgrade request from HTTP/1.1 to HTTP/2 is made after the first request on a connection, it can cause a misconfiguration that results in the server crashing. This issue affects servers that have HTTP/2 enabled, particularly those that allow H2Upgrade for HTTPS connections. Servers that do not enable the h2 protocol or only enable it for HTTPS without H2Upgrade are not affected.
How To Fix
Minimum fixed version
2.4.39-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate update is not possible, consider disabling HTTP/2 or H2Upgrade on your server to mitigate the risk of this vulnerability. This can typically be done by modifying the server configuration files to remove or comment out the relevant directives.
Conclusion
The vulnerability in Apache HTTP Server versions 2.4.34 to 2.4.38 poses a significant risk of Denial of Service attacks when HTTP/2 is enabled. It is crucial to update to version 2.4.39 or later to mitigate this risk. Users should also consider disabling HTTP/2 as a temporary workaround until they can apply the update.
See every vulnerability recorded for apache2 →
FAQ
Apache HTTP Server versions 2.4.34 to 2.4.38 are affected by this vulnerability.
The CVSS score of this vulnerability is 4.2, indicating a moderate severity level.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
As a temporary measure, you can disable HTTP/2 or H2Upgrade in your server configuration to reduce the risk of exploitation.
Detailed information about this vulnerability can be found in the CVE database or through security advisories related to Apache HTTP Server.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
