Apache HTTP Server 2.4.34 to 2.4.38 HTTP/2 Upgrade Request Misconfiguration Vulnerability (CVE-2019-0197)
Summary
CVE-2019-0197: A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. Affects apache2 across 3 version ranges.
< 2.4.39-r0
< 8048373d9a8bd8c7237829b56a06485d5f5bf2e4
>= e0b198f98b01973f75cb734b3864c429945dbdb0, <= 3090a40b568b675c6b09a4f008b421a747e2731c
Fixed in 2.4.39-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server is a widely used open-source web server software. It provides a reliable and secure platform for hosting websites and applications. The vulnerability identified as CVE-2019-0197 affects Apache HTTP Server versions 2.4.34 to 2.4.38. This vulnerability arises when HTTP/2 is enabled for a http: host or H2Upgrade is enabled for h2 on a https: host. If an Upgrade request from http/1.1 to http/2 is made, which is not the first request on a connection, it can lead to a misconfiguration and crash. Servers that have not enabled the h2 protocol or have only enabled it for https: and did not set "H2Upgrade on" are not affected by this issue.
Vulnerability Detail
The vulnerability (CVE-2019-0197) in Apache HTTP Server versions 2.4.34 to 2.4.38 allows an attacker to crash the server by sending a specific Upgrade request from http/1.1 to http/2. This vulnerability can be exploited if HTTP/2 is enabled for a http: host or H2Upgrade is enabled for h2 on a https: host. The misconfiguration caused by this request can lead to a crash, impacting the availability of the server. It is important to note that servers that have not enabled the h2 protocol or have only enabled it for https: and did not set "H2Upgrade on" are not affected by this vulnerability.
How To Fix
Minimum fixed version
2.4.39-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to Apache HTTP Server version 2.4.39 or later.
Conclusion
The vulnerability (CVE-2019-0197) in Apache HTTP Server versions 2.4.34 to 2.4.38 can lead to a misconfiguration and crash when a specific Upgrade request from http/1.1 to http/2 is made. To mitigate this vulnerability, it is crucial to upgrade to Apache HTTP Server version 2.4.39 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache2 →
FAQ
Apache HTTP Server is an open-source web server software widely used for hosting websites and applications.
The vulnerability affects Apache HTTP Server versions 2.4.34 to 2.4.38.
An attacker can exploit this vulnerability by sending a specific Upgrade request from http/1.1 to http/2, causing a misconfiguration and crash on the server.
No, servers that have not enabled the h2 protocol or have only enabled it for https: and did not set "H2Upgrade on" are not affected by this vulnerability.
The recommended solution is to upgrade to Apache HTTP Server version 2.4.39 or later.
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
