CVE-2019-0197
Medium
Description
A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set "H2Upgrade on" are unaffected by this issue.
SeverityMedium
CVSS4.2
Exploit probability—
Product
Apache Http Server
PublishedJun 11, 2019
First seenJun 11, 2019
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache http_server | 2.4.34 ≤ v ≤ 2.4.38 | — |
| canonical ubuntu_linux | 16.04, 18.04, 19.04 | — |
| fedoraproject fedora | 30 | — |
| opensuse leap | 15.0, 42.3 | — |
| redhat jboss_core_services | 1.0 | — |
| oracle communications_session_report_manager | 8.0.0, 8.1.0, 8.1.1, 8.2.0 | — |
| oracle communications_session_route_manager | 8.0.0, 8.1.0, 8.1.1, 8.2.0 | — |
| oracle enterprise_manager_ops_center | 12.3.3, 12.4.0 | — |
| oracle http_server | 12.2.1.3.0 | — |
| oracle instantis_enterprisetrack | 17.1, 17.2, 17.3 | — |
| oracle retail_xstore_point_of_service | 7.0, 7.1 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.