Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2019-0220: 1695036: CVE-2019-0220 httpd: URL normalization inconsistency CVE-2019-0217: A race condition was found in mod_auth_digest when the web server was running in a threaded MPM configuration. It could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions. 1695020: CVE-2019-0217 httpd: mod_auth_digest: access control bypass due to race condition CVE-2019-0215: In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions. 1695025: CVE-2019-0215 httpd: mod_ssl: access control bypass when using per-location client certification authentication CVE-2019-0211: 1694980: CVE-2019-0211 httpd: privilege escalation from modules scripts CVE-2019-0197: 1695042: CVE-2019-0197 httpd: mod_http2: possible crash on late upgrade CVE-2019-0196: 1695030: CVE-2019-0196 httpd: mod_http2: read-after-free on a string compare
Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | httpd | 0:2.4.39-1.amzn2.0.1 |
| Amazon Linux · 2 | httpd-debuginfo | 0:2.4.39-1.amzn2.0.1 |
| Amazon Linux · 2 | httpd-devel | 0:2.4.39-1.amzn2.0.1 |
| Amazon Linux · 2 | httpd-filesystem | 0:2.4.39-1.amzn2.0.1 |
| Amazon Linux · 2 | httpd-manual | 0:2.4.39-1.amzn2.0.1 |
| Amazon Linux · 2 | httpd-tools | 0:2.4.39-1.amzn2.0.1 |
| Amazon Linux · 2 | mod_ldap | 0:2.4.39-1.amzn2.0.1 |
| Amazon Linux · 2 | mod_md | 0:2.4.39-1.amzn2.0.1 |
| Amazon Linux · 2 | mod_proxy_html | 1:2.4.39-1.amzn2.0.1 |
| Amazon Linux · 2 | mod_session | 0:2.4.39-1.amzn2.0.1 |
| Amazon Linux · 2 | mod_ssl | 1:2.4.39-1.amzn2.0.1 |
Vulnerabilities 6
-
High 7.8
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileg…
KEV Nov 3, 2021 -
Unscored —CVE-2019-0196 EPSS 19%
A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handli…
-
Unscored —
A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade…
-
Unscored —CVE-2019-0215 EPSS 10%
In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verif…
-
Unscored —
In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded serv…
-
Unscored —CVE-2019-0220 EPSS 18%
A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains mult…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2019-0196.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2019-0197.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2019-0211.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2019-0215.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2019-0217.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2019-0220.html