Critical Buffer Overflow Vulnerability in Apache2 Package - CVE-2019-10097
Summary
ALPINE-CVE-2019-10097: In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could trigger a stack buffer overflow or NULL... Affects apache2 versions < 2.4.41-r0. Fixed in 2.4.41-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache HTTP Server, commonly referred to as Apache2, is a widely used open-source web server software that enables the hosting of websites and web applications. It is known for its flexibility, scalability, and robust performance. However, certain configurations, particularly involving the mod_remoteip module, can expose the server to vulnerabilities, such as CVE-2019-10097, which affects versions 2.4.32 to 2.4.39.
Vulnerability Detail
CVE-2019-10097 is a vulnerability that arises when the mod_remoteip module is configured to trust a proxy server using the 'PROXY' protocol. A specially crafted PROXY header can lead to a stack buffer overflow or a NULL pointer dereference. This vulnerability can only be exploited by a trusted proxy, making it a significant risk for environments relying on such configurations. The potential ramifications include server crashes and unauthorized access to sensitive data, with a CVSS score of 7.2 indicating its severity.
How To Fix
Minimum fixed version
2.4.41-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the mod_remoteip module if it is not essential for your application. This can be done by commenting out or removing the relevant configuration lines in the Apache configuration file.
Conclusion
CVE-2019-10097 is a critical vulnerability affecting the Apache2 package, specifically in configurations that trust proxy servers. It is crucial to update to the patched version to safeguard against potential exploits. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for apache2 →
FAQ
CVE-2019-10097 is a vulnerability in the Apache HTTP Server that can lead to a buffer overflow or NULL pointer dereference when using the mod_remoteip module with trusted proxies.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can result in server crashes and unauthorized access to sensitive information, posing a significant risk to web applications.
You can update the Apache2 package to the patched version by running the command 'apk add apache2=2.4.41-r0' in your Alpine package manager.
Yes, you can temporarily disable the mod_remoteip module if it is not critical for your application to mitigate the risk until an update can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
