Race Condition Vulnerability in Apache HTTP Server 2.4 - CVE-2019-0217
Summary
ALPINE-CVE-2019-0217: In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing config... Affects apache2 versions < 2.4.39-r0. Fixed in 2.4.39-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server, commonly referred to as Apache, is a widely-used open-source web server software that enables the hosting of websites and web applications. It is known for its flexibility, security features, and extensive support for various modules. However, certain versions of Apache HTTP Server prior to 2.4.39 are vulnerable to a race condition in the mod_auth_digest module, which can lead to unauthorized access under specific conditions.
Vulnerability Detail
The vulnerability, identified as CVE-2019-0217, arises from a race condition in the mod_auth_digest module when operating in a threaded server environment. This flaw allows an authenticated user to bypass access control restrictions by authenticating with a different username. The potential ramifications include unauthorized access to sensitive resources, which could compromise the integrity and confidentiality of the server's data.
How To Fix
Minimum fixed version
2.4.39-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider switching from a threaded server configuration to a process-based configuration if feasible. This may mitigate the risk of the race condition until the server can be updated to a patched version.
Conclusion
CVE-2019-0217 represents a significant security risk for users of Apache HTTP Server versions prior to 2.4.39. It is crucial to update to the patched version to mitigate the risk of unauthorized access. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in real-time.
See every vulnerability recorded for apache2 →
FAQ
CVE-2019-0217 is a vulnerability in Apache HTTP Server that allows an authenticated user to bypass access control restrictions due to a race condition in the mod_auth_digest module.
Apache HTTP Server versions prior to 2.4.39 are affected by this vulnerability.
The primary risk is unauthorized access to sensitive resources, which can lead to data breaches and compromise the server's security.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of CVE-2019-0217 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
