NetSight
IP …
medium4.2

CVE-2019-0197

A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38.

Impact

A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set "H2Upgrade on" are unaffected by this issue.

Affected products

VendorProductAffected versions
ApacheHttp Server
from 2.4.34 through 2.4.38
CanonicalUbuntu Linux
Versions 16.04, 18.04, 19.04
FedoraprojectFedora
Version 30
OpensuseLeap
Versions 15.0, 42.3
RedhatJboss Core Services
Version 1.0
OracleCommunications Session Report Manager
Versions 8.0.0, 8.1.0, 8.1.1, 8.2.0
OracleCommunications Session Route Manager
Versions 8.0.0, 8.1.0, 8.1.1, 8.2.0
OracleEnterprise Manager Ops Center
Versions 12.3.3, 12.4.0
OracleHttp Server
Version 12.2.1.3.0
OracleInstantis Enterprisetrack
Versions 17.1, 17.2, 17.3
OracleRetail Xstore Point Of Service
Versions 7.0, 7.1

Weakness classification

CWE-444

References