Denial of Service Vulnerability in Apache2 Package - CVE-2019-17657
Summary
ALPINE-CVE-2019-17657: An Uncontrolled Resource Consumption vulnerability in Fortinet FortiSwitch below 3.6.11, 6.0.6 and 6.2.2, FortiAnalyzer below 6.2.3, FortiManager below 6.2.3 and FortiAP-S/W2 below 6.2.2 may allow an attacker to cause ad... Affects apache2 versions < 2.4.48-r0. Fixed in 2.4.48-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache2 is a widely used open-source web server software that provides a robust, flexible, and secure platform for hosting websites and applications. It supports various features such as customizable modules, URL redirection, and authentication mechanisms. However, certain versions of Apache2 are vulnerable to an Uncontrolled Resource Consumption issue, which can lead to denial of service (DoS) attacks, impacting the availability of web services.
Vulnerability Detail
The vulnerability, identified as CVE-2019-17657, arises from the handling of specially crafted HTTP requests and responses. Attackers can exploit this flaw by sending these requests in a slow manner, leading to resource exhaustion on the server. This can result in the admin web UI becoming unresponsive, effectively denying access to legitimate users. The vulnerability affects multiple versions of the Apache2 package across various Alpine Linux releases, making it critical for users to address it promptly.
How To Fix
Minimum fixed version
2.4.48-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can implement rate limiting on incoming HTTP requests to mitigate the impact of potential DoS attacks. This can be done by configuring the web server settings to limit the number of requests from a single IP address over a specified time period.
Conclusion
CVE-2019-17657 represents a significant risk to the availability of web services hosted on vulnerable versions of the Apache2 package. It is crucial for users to update to the patched version to mitigate the risk of denial of service attacks. Additionally, temporary workarounds can help reduce exposure until a full update can be applied.
See every vulnerability recorded for apache2 →
FAQ
CVE-2019-17657 is a vulnerability in the Apache2 package that allows attackers to perform denial of service attacks by sending specially crafted HTTP requests.
The vulnerability affects Apache2 versions prior to 2.4.48-r0 across multiple Alpine Linux releases.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2019-17657 is 7.5, indicating a high severity level.
If immediate updates are not possible, consider implementing rate limiting on your server to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
