Critical Memory Management Vulnerability in Apache2: CVE-2019-10082
Summary
ALPINE-CVE-2019-10082: In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection shutdown. Affects apache2 versions < 2.4.41-r0. Fixed in 2.4.41-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server, commonly referred to as Apache2, is a widely-used open-source web server software that enables users to serve web content over the internet. Known for its flexibility, power, and extensive features, Apache2 supports various modules and configurations, making it a popular choice for hosting websites. However, versions 2.4.18 through 2.4.39 are vulnerable to a critical memory management issue that can be exploited through fuzzed network input, potentially leading to severe security breaches.
Vulnerability Detail
The vulnerability, identified as CVE-2019-10082, arises from improper handling of HTTP/2 session management in Apache HTTP Server versions 2.4.18 to 2.4.39. When an attacker sends fuzzed network input, it can cause the server to read memory that has already been freed during the connection shutdown process. This flaw can lead to information disclosure, allowing attackers to access sensitive data that should not be available, thereby compromising the integrity and confidentiality of the server's operations.
How To Fix
Minimum fixed version
2.4.41-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable HTTP/2 support in your Apache configuration until the server is updated. This can be done by commenting out or removing the 'Protocols h2 http/1.1' line in your Apache configuration file.
Conclusion
CVE-2019-10082 is a critical vulnerability affecting Apache HTTP Server versions 2.4.18 to 2.4.39, which can lead to serious security risks if not addressed. It is crucial to update to the patched version 2.4.41-r0 or later to mitigate the risks associated with this vulnerability. Additionally, using tools like Vulert can help monitor and alert for open-source vulnerabilities in your software.
See every vulnerability recorded for apache2 →
FAQ
CVE-2019-10082 is a critical vulnerability in Apache HTTP Server that allows attackers to exploit memory management issues during HTTP/2 session handling.
The affected versions are Apache HTTP Server 2.4.18 through 2.4.39.
Exploitation of this vulnerability can lead to memory disclosure, allowing attackers to access sensitive information from the server.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for CVE-2019-10082 is 9.1, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
