This update for apache2 fixes the following issues :

  - CVE-2019-0220: The Apache HTTP server did not use a     consistent strategy for URL normalization throughout all     of its components. In particular, consecutive slashes     were not always collapsed. Attackers could potentially     abuse these inconsistencies to by-pass access control     mechanisms and thus gain unauthorized access to     protected parts of the service. [bsc#1131241]

  - CVE-2019-0217: A race condition in Apache's     'mod_auth_digest' when running in a threaded server     could have allowed users with valid credentials to     authenticate using another username, bypassing     configured access control restrictions. [bsc#1131239]

  - CVE-2019-0211: A flaw in the Apache HTTP Server allowed     less-privileged child processes or threads to execute     arbitrary code with the privileges of the parent     process. Attackers with control over CGI scripts or     extension modules run by the server could have abused     this issue to potentially gain super user privileges.
    [bsc#1131233]

  - CVE-2019-0197: When HTTP/2 support was enabled in the     Apache server for a 'http' host or H2Upgrade was enabled     for h2 on a 'https' host, an Upgrade request from     http/1.1 to http/2 that was not the first request on a     connection could lead to a misconfiguration and crash.
    This issue could have been abused to mount a     denial-of-service attack. Servers that never enabled the     h2 protocol or that only enabled it for https: and did     not configure the 'H2Upgrade on' are unaffected.
    [bsc#1131245]

  - CVE-2019-0196: Through specially crafted network input     the Apache's http/2 request handler could be lead to     access previously freed memory while determining the     method of a request. This resulted in the request being     misclassified and thus being processed incorrectly.
    [bsc#1131237]

This update was imported from the SUSE:SLE-12-SP2:Update update project.

Resolves: #1695046 CVE-2019-0196 CVE-2019-0197 CVE-2019-0215 CVE-2019-0217 CVE-2019-0220 httpd: various flaws Resolves: #1694510 httpd-2.4.39 is available Resolves: #1694986 - CVE-2019-0211 httpd:
privilege escalation from modules scripts

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 6.06, has httpd packages installed that are affected by multiple vulnerabilities:

  - In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain     resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming     data. This affects only HTTP/2 (mod_http2) connections. (CVE-2018-17189)

  - In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before     decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since     the expiry time is loaded when the session is decoded. (CVE-2018-17199)

  - A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2     request handling could be made to access freed memory in string comparison when determining the method of     a request and thus process the request incorrectly. (CVE-2019-0196)

  - A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host     or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not     the first request on a connection could lead to a misconfiguration and crash. Server that never enabled     the h2 protocol or that only enabled it for https: and did not set H2Upgrade on are unaffected by this     issue. (CVE-2019-0197)

  - HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with H2PushResource, could lead     to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of     the configured push link header values, not data supplied by the client. (CVE-2019-10081)

  - In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made     to read memory after being freed, during connection shutdown. (CVE-2019-10082)

  - In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the     mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point     to a page of their choice. This would only be exploitable where a server was set up with proxying enabled     but was misconfigured in such a way that the Proxy Error page was displayed. (CVE-2019-10092)

  - Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on     certain traffic edge patterns, logging statements were made on the wrong connection, causing concurrent     use of memory pools. Configuring the LogLevel of mod_http2 above info will mitigate this vulnerability     for unpatched servers. (CVE-2020-11993)

  - In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be     self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within     the request URL. (CVE-2020-1927)

  - Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can     cause a NULL pointer dereference and crash, leading to a possible Denial Of Service (CVE-2021-26690)

  - In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server     could cause a heap overflow (CVE-2021-26691)

  - ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules     pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache     HTTP Server 2.4.48 and earlier. (CVE-2021-39275)

  - A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser     (r:parsebody() called from Lua scripts). The Apache httpd team is not aware of an exploit for the     vulnerabilty though it might be possible to craft one. This issue affects Apache HTTP Server 2.4.51 and     earlier. (CVE-2021-44790)

  - Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered     discarding the request body, exposing the server to HTTP Request Smuggling (CVE-2022-22720)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
124264	openSUSE Security Update : apache2 (openSUSE-2019-1258)	Nessus	SuSE Local Security Checks	2019/4/24	2024/5/31	high
124541	Fedora 30 : httpd (2019-cf7695b470)	Nessus	Fedora Local Security Checks	2019/5/2	2022/12/6	high
174760	NewStart CGSL MAIN 6.06 : httpd Multiple Vulnerabilities (NS-SA-2023-1001)	Nessus	NewStart CGSL Local Security Checks	2023/4/25	2023/4/26	critical

偵測

搜尋 Plugin

high

high

critical