November 20, 2023
Severity Medium Analysis Summary Agent Tesla is a very popular spyware Trojan built for the.NET framework. Since its initial appearance in 2014, this has been deployed […]
Rewterz threat Advisory – Advantech WebAccess/SCADA Multiple Vulnerabilities
April 3, 2019Rewterz Threat Advisory – Red Hat update for freerdp Multiple Vulnerabilities
April 3, 2019Rewterz threat Advisory – Advantech WebAccess/SCADA Multiple Vulnerabilities
April 3, 2019Rewterz Threat Advisory – Red Hat update for freerdp Multiple Vulnerabilities
April 3, 2019
Analysis Summary
CVE-2019-0215
In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client supporting Post-Handshake Authentication to bypass configured access control restrictions.
CVE-2019-0196
Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparision when determining the method of a request and thus process the request incorrectly.
CVE-2019-0211
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.
CVE-2019-0220
When the path component of a request URL contains multiple consecutive slashes (‘/’), directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects of the servers processing will implicitly collapse them.
CVE-2019-0197
When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. A server that never enabled the h2 protocol or that only enabled it for https: and did not configure the “H2Upgrade on” is unaffected by this.
CVE-2019-0217
In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.
Impact
- Denial of Service
- Privilege escalation
- Security Bypass
Affected Vendors
Apache Foundation
Affected Products
- Apache HTTP Server 2.x
- Apache HTTP Server 2.4.x
Remediation
Update to version 2.4.39.