4.9
CVE-2019-0197
- EPSS 2.09%
- Published 11.06.2019 22:29:04
- Last modified 21.11.2024 04:16:27
- Source security@apache.org
- Teams watchlist Login
- Open Login
A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set "H2Upgrade on" are unaffected by this issue.
Data is provided by the National Vulnerability Database (NVD)
Apache ≫ HTTP Server Version >= 2.4.34 <= 2.4.38
Canonical ≫ Ubuntu Linux Version16.04 SwEditionesm
Canonical ≫ Ubuntu Linux Version18.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version19.04
Fedoraproject ≫ Fedora Version30
Redhat ≫ Jboss Core Services Version1.0
Oracle ≫ Communications Session Report Manager Version8.0.0
Oracle ≫ Communications Session Report Manager Version8.1.0
Oracle ≫ Communications Session Report Manager Version8.1.1
Oracle ≫ Communications Session Report Manager Version8.2.0
Oracle ≫ Communications Session Route Manager Version8.0.0
Oracle ≫ Communications Session Route Manager Version8.1.0
Oracle ≫ Communications Session Route Manager Version8.1.1
Oracle ≫ Communications Session Route Manager Version8.2.0
Oracle ≫ Enterprise Manager Ops Center Version12.3.3
Oracle ≫ Enterprise Manager Ops Center Version12.4.0
Oracle ≫ HTTP Server Version12.2.1.3.0
Oracle ≫ Instantis Enterprisetrack Version17.1
Oracle ≫ Instantis Enterprisetrack Version17.2
Oracle ≫ Instantis Enterprisetrack Version17.3
Oracle ≫ Retail Xstore Point Of Service Version7.0
Oracle ≫ Retail Xstore Point Of Service Version7.1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 2.09% | 0.834 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 4.2 | 1.6 | 2.5 |
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
|
| nvd@nist.gov | 4.9 | 6.8 | 4.9 |
AV:N/AC:M/Au:S/C:N/I:P/A:P
|
CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.