CVE-2019-10082

Severity

Theme

CVE-2019-10082

critical

New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection shutdown.

References

https://httpd.apache.org/security/vulnerabilities_24.html

https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://www.oracle.com/security-alerts/cpuapr2020.html

https://www.oracle.com/security-alerts/cpujul2020.html

https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E

https://www.oracle.com/security-alerts/cpuoct2021.html

Details

Source: MITRE

Published: 2019-09-26

Updated: 2021-10-20

Type: CWE-416

Risk Information

CVSS v2

Base Score: 6.4

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:P

Impact Score: 4.9

Exploitability Score: 10

Severity: MEDIUM

CVSS v3

Base Score: 9.1

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Impact Score: 5.2

Exploitability Score: 3.9

Severity: CRITICAL

Vulnerable Software

Configuration 1

cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* versions from 2.4.18 to 2.4.39 (inclusive)

Tenable Plugins

View all (21 total)

ID	Name	Product	Family	Severity
145821	CentOS 8 : httpd:2.4 (CESA-2020:4751)	Nessus	CentOS Local Security Checks	critical
142762	Oracle Linux 8 : httpd:2.4 (ELSA-2020-4751)	Nessus	Oracle Linux Local Security Checks	critical
142397	RHEL 8 : httpd:2.4 (RHSA-2020:4751)	Nessus	Red Hat Local Security Checks	critical
135235	RHEL 6 : Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP2 (RHSA-2020:1337)	Nessus	Red Hat Local Security Checks	critical
135160	Slackware 14.0 / 14.1 / 14.2 / current : httpd (SSA:2020-091-02) (Internal Data Buffering)	Nessus	Slackware Local Security Checks	critical
135146	EulerOS Virtualization for ARM 64 3.0.6.0 : httpd (EulerOS-SA-2020-1359)	Nessus	Huawei Local Security Checks	critical
133989	EulerOS 2.0 SP8 : httpd (EulerOS-SA-2020-1155)	Nessus	Huawei Local Security Checks	critical
130281	Amazon Linux AMI : httpd24 (ALAS-2019-1311) (Internal Data Buffering)	Nessus	Amazon Linux Local Security Checks	critical
130109	Photon OS 1.0: Httpd PHSA-2019-1.0-0253	Nessus	PhotonOS Local Security Checks	critical
130101	Photon OS 3.0: Httpd PHSA-2019-3.0-0035	Nessus	PhotonOS Local Security Checks	critical
129688	Photon OS 2.0: Httpd PHSA-2019-2.0-0178	Nessus	PhotonOS Local Security Checks	critical
128993	Ubuntu 16.04 LTS / 18.04 LTS / 19.04 : Apache HTTP Server regression (USN-4113-2) (Internal Data Buffering)	Nessus	Ubuntu Local Security Checks	critical
128612	SUSE SLES12 Security Update : apache2 (SUSE-SU-2019:2329-1) (Internal Data Buffering)	Nessus	SuSE Local Security Checks	critical
128593	GLSA-201909-04 : Apache: Multiple vulnerabilities (Internal Data Buffering)	Nessus	Gentoo Local Security Checks	critical
128460	openSUSE Security Update : apache2 (openSUSE-2019-2051) (Internal Data Buffering)	Nessus	SuSE Local Security Checks	critical
128412	Ubuntu 16.04 LTS / 18.04 LTS / 19.04 : Apache HTTP Server vulnerabilities (USN-4113-1) (Internal Data Buffering)	Nessus	Ubuntu Local Security Checks	critical
128316	SUSE SLED15 / SLES15 Security Update : apache2 (SUSE-SU-2019:2237-1) (Internal Data Buffering)	Nessus	SuSE Local Security Checks	critical
128182	Debian DSA-4509-1 : apache2 - security update (Internal Data Buffering)	Nessus	Debian Local Security Checks	critical
98669	Apache 2.4.x < 2.4.41 Multiple Vulnerabilities	Web Application Scanning	Component Vulnerability	critical
128033	Apache 2.4.x < 2.4.41 Multiple Vulnerabilities	Nessus	Web Servers	critical
127951	FreeBSD : Apache -- Multiple vulnerabilities (caf545f2-c0d9-11e9-9051-4c72b94353b5) (Internal Data Buffering)	Nessus	FreeBSD Local Security Checks	critical