NetSight
IP …
high7.8Known exploitedPublic exploit code

CVE-2019-0211

Apache HTTP Server Privilege Escalation Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2021-11-03. Federal due date: 2022-05-03.

Apply updates per vendor instructions.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.

Affected products

VendorProductAffected versions
ApacheHttp Server
from 2.4.17 through 2.4.38
FedoraprojectFedora
Versions 28, 29, 30
CanonicalUbuntu Linux
Versions 14.04, 16.04, 18.04, 18.10
DebianDebian Linux
Version 9.0
OpensuseLeap
Versions 15.0, 42.3
NetappOncommand Unified Manager
All versions
RedhatJboss Core Services
Version 1.0
RedhatOpenshift Container Platform
Version 3.11
RedhatOpenshift Container Platform For Power
Version 3.11_ppc64le
RedhatSoftware Collections
Version 1.0
RedhatEnterprise Linux
Version 8.0
RedhatEnterprise Linux Eus
Versions 8.1, 8.2, 8.4, 8.6, 8.8

Weakness classification

CWE-416

References