Apache2 - Race Condition and URL Normalization Vulnerabilities
Summary
DLA-1748-1: apache2 - security update. Affects apache2 versions < 2.4.10-10+deb8u14. Fixed in 2.4.10-10+deb8u14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache2 is a widely used open-source web server software that provides a robust and secure platform for hosting websites. It offers various features and modules to handle HTTP requests, including authentication and URL rewriting. However, two vulnerabilities have been discovered in Apache2 that could potentially compromise its security.
Vulnerability Detail
The first vulnerability, identified as CVE-2019-0217, is a race condition in the mod_auth_digest module when running in a threaded server. This flaw allows a user with valid credentials to authenticate using another username, bypassing configured access control restrictions. The second vulnerability, CVE-2019-0220, involves inconsistent handling of URL normalizations. When the path component of a request URL contains multiple consecutive slashes ('/'), certain directives like LocationMatch and RewriteRule fail to account for duplicates in regular expressions, potentially leading to unintended consequences in the server's processing.
How To Fix
Minimum fixed version
2.4.10-10+deb8u14
This is the first release that contains the fix.
sudo apt-get install --only-upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workarounds have been mentioned for these vulnerabilities. Upgrading to the fixed version is the recommended solution.
Conclusion
The vulnerabilities in Apache2, namely CVE-2019-0217 and CVE-2019-0220, can potentially allow unauthorized access and cause inconsistencies in URL normalizations. It is crucial to upgrade to the fixed version to ensure the security and stability of your Apache2 server. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache2 →
FAQ
CVE-2019-0217 allows an attacker with valid credentials to authenticate using another username, potentially bypassing access control restrictions. This could lead to unauthorized access to sensitive resources or information.
CVE-2019-0220 can cause inconsistencies in URL normalizations, particularly when the path component of a request URL contains multiple consecutive slashes ('/'). This can result in unexpected behavior in directives like LocationMatch and RewriteRule.
At the time of this report, there are no known public exploits targeting these vulnerabilities. However, it is crucial to apply the recommended updates to mitigate any potential risks.
Yes, both CVE-2019-0217 and CVE-2019-0220 can be exploited remotely if the affected Apache2 server is accessible over the network.
In addition to keeping the software up to date, it is advisable to regularly review and adjust access control configurations, implement strong authentication mechanisms, and monitor server logs for any suspicious activity.
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
