Skip to content
OpenAdvisories
High RHSA-2019:2893 1 CVE

Red Hat Security Advisory: httpd:2.4 security update

Published Sep 13, 2024 · Updated Oct 13, 2026

Ecosystem: Red Hat

Fixed packages 21

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream httpd 0:2.4.37-12.module+el8.0.0+4096+eb40e6da
Red Hat · RHEL 8 enterprise_linux:8::appstream httpd-debuginfo 0:2.4.37-12.module+el8.0.0+4096+eb40e6da
Red Hat · RHEL 8 enterprise_linux:8::appstream httpd-debugsource 0:2.4.37-12.module+el8.0.0+4096+eb40e6da
Red Hat · RHEL 8 enterprise_linux:8::appstream httpd-devel 0:2.4.37-12.module+el8.0.0+4096+eb40e6da
Red Hat · RHEL 8 enterprise_linux:8::appstream httpd-filesystem 0:2.4.37-12.module+el8.0.0+4096+eb40e6da
Red Hat · RHEL 8 enterprise_linux:8::appstream httpd-manual 0:2.4.37-12.module+el8.0.0+4096+eb40e6da
Red Hat · RHEL 8 enterprise_linux:8::appstream httpd-tools 0:2.4.37-12.module+el8.0.0+4096+eb40e6da
Red Hat · RHEL 8 enterprise_linux:8::appstream httpd-tools-debuginfo 0:2.4.37-12.module+el8.0.0+4096+eb40e6da
Red Hat · RHEL 8 enterprise_linux:8::appstream mod_http2 0:1.11.3-3.module+el8.0.0+4096+eb40e6da
Red Hat · RHEL 8 enterprise_linux:8::appstream mod_http2-debuginfo 0:1.11.3-3.module+el8.0.0+4096+eb40e6da
Red Hat · RHEL 8 enterprise_linux:8::appstream mod_http2-debugsource 0:1.11.3-3.module+el8.0.0+4096+eb40e6da
Red Hat · RHEL 8 enterprise_linux:8::appstream mod_ldap 0:2.4.37-12.module+el8.0.0+4096+eb40e6da
Red Hat · RHEL 8 enterprise_linux:8::appstream mod_ldap-debuginfo 0:2.4.37-12.module+el8.0.0+4096+eb40e6da
Red Hat · RHEL 8 enterprise_linux:8::appstream mod_md 0:2.4.37-12.module+el8.0.0+4096+eb40e6da
Red Hat · RHEL 8 enterprise_linux:8::appstream mod_md-debuginfo 0:2.4.37-12.module+el8.0.0+4096+eb40e6da
Red Hat · RHEL 8 enterprise_linux:8::appstream mod_proxy_html 1:2.4.37-12.module+el8.0.0+4096+eb40e6da
Red Hat · RHEL 8 enterprise_linux:8::appstream mod_proxy_html-debuginfo 1:2.4.37-12.module+el8.0.0+4096+eb40e6da
Red Hat · RHEL 8 enterprise_linux:8::appstream mod_session 0:2.4.37-12.module+el8.0.0+4096+eb40e6da
Red Hat · RHEL 8 enterprise_linux:8::appstream mod_session-debuginfo 0:2.4.37-12.module+el8.0.0+4096+eb40e6da
Red Hat · RHEL 8 enterprise_linux:8::appstream mod_ssl 1:2.4.37-12.module+el8.0.0+4096+eb40e6da
Red Hat · RHEL 8 enterprise_linux:8::appstream mod_ssl-debuginfo 1:2.4.37-12.module+el8.0.0+4096+eb40e6da

Vulnerabilities 1

  • High 7.5
    CVE-2019-9517 EPSS 27%

    Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service

    Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer…

    apache2 apache2 nodejs apache2 Debian Ubuntu Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1741868
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2893.json
  • report
    https://access.redhat.com/security/cve/CVE-2019-9517
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2019-9517
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2019-9517
  • article
    https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
  • article
    https://kb.cert.org/vuls/id/605641/
  • article
    https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/