In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions.

An update of the httpd package has been released.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:0980 advisory.

  - httpd: privilege escalation from modules scripts (CVE-2019-0211)

  - httpd: mod_ssl: access control bypass when using per-location client certification authentication     (CVE-2019-0215)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the httpd packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - In Apache HTTP Server 2.4.17 to 2.4.34, by sending     continuous, large SETTINGS frames a client can occupy a     connection, server thread and CPU time without any     connection timeout coming to effect. This affects only     HTTP/2 connections. A possible mitigation is to not     enable the h2 protocol.(CVE-2018-11763)

  - In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38,     with MPM event, worker or prefork, code executing in     less-privileged child processes or threads (including     scripts executed by an in-process scripting     interpreter) could execute arbitrary code with the     privileges of the parent process (usually root) by     manipulating the scoreboard. Non-Unix systems are not     affected.(CVE-2019-0211)

  - In Apache HTTP server versions 2.4.37 and prior, by     sending request bodies in a slow loris way to plain     resources, the h2 stream for that request unnecessarily     occupied a server thread cleaning up that incoming     data. This affects only HTTP/2 (mod_http2)     connections.(CVE-2018-17189)

  - In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a     bug in mod_ssl when using per-location client     certificate verification with TLSv1.3 allowed a client     to bypass configured access control     restrictions.(CVE-2019-0215)

  - A vulnerability was found in Apache HTTP Server 2.4.0     to 2.4.38. When the path component of a request URL     contains multiple consecutive slashes ('/'), directives     such as LocationMatch and RewriteRule must account for     duplicates in regular expressions while other aspects     of the servers processing will implicitly collapse     them.(CVE-2019-0220)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In Apache HTTP server versions 2.4.37 and prior, by     sending request bodies in a slow loris way to plain     resources, the h2 stream for that request unnecessarily     occupied a server thread cleaning up that incoming     data. This affects only HTTP/2 (mod_http2)     connections.(CVE-2018-17189)

  - In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a     bug in mod_ssl when using per-location client     certificate verification with TLSv1.3 allowed a client     to bypass configured access control     restrictions.(CVE-2019-0215)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-0980 advisory.

    - Resolves: #1695431 - CVE-2019-0211 httpd: privilege escalation       from modules scripts
    - Resolves: #1696090 - CVE-2019-0215 httpd:2.4/httpd: mod_ssl: access control       bypass when using per-location client certification authentication

    mod_http2

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Enterprise Manager Cloud Control installed on the remote host is affected by multiple vulnerabilities in Enterprise Manager Base Platform component:

  - An unspecified vulnerability in Networking (cURL) subcomponent     of Oracle Enterprise Manager Ops Center, which could allow     an unauthenticated attacker with network access to     compromise Enterprise Manager Ops Center. (CVE-2019-3822)

  - An unspecified vulnerability in Networking (OpenSSL) subcomponent     of Oracle Enterprise Manager Ops Center, which could allow     an unauthenticated attacker with network access to     compromise Enterprise Manager Ops Center. (CVE-2019-1559)

  - An unspecified vulnerability in Networking (OpenSSL) subcomponent     of Oracle Enterprise Manager Ops Center, which could allow     a low privileged attacker with network access to     compromise Enterprise Manager Ops Center. (CVE-2019-2728)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:0980 advisory.

    The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

    Security Fix(es):

    * httpd: privilege escalation from modules scripts (CVE-2019-0211)

    * httpd: mod_ssl: access control bypass when using per-location client certification authentication     (CVE-2019-0215)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Resolves: #1695046 CVE-2019-0196 CVE-2019-0197 CVE-2019-0215 CVE-2019-0217 CVE-2019-0220 httpd: various flaws Resolves: #1694510 httpd-2.4.39 is available Resolves: #1694986 - CVE-2019-0211 httpd:
privilege escalation from modules scripts

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

In Apache HTTP Server with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. (CVE-2019-0211)

mod_http2: read-after-free on a string compare (CVE-2019-0196)

mod_http2: possible crash on late upgrade (CVE-2019-0197)

httpd: URL normalization inconsistency (CVE-2019-0220)

In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions.(CVE-2019-0215)

A race condition was found in mod_auth_digest when the web server was running in a threaded MPM configuration. It could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.(CVE-2019-0217)

In Apache HTTP Server with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. (CVE-2019-0211)

A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes ('/'), directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects of the servers processing will implicitly collapse them.(CVE-2019-0220)

In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions.(CVE-2019-0215)

A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38.
Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly.(CVE-2019-0196)

A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set 'H2Upgrade on' are unaffected by this issue.(CVE-2019-0197)

A race condition was found in mod_auth_digest when the web server was running in a threaded MPM configuration. It could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.(CVE-2019-0217)

According to its banner, the version of Apache running on the remote host is 2.4.x prior to 2.4.39. It is, therefore, affected by multiple vulnerabilities:

 - A privilege escalation vulnerability exists in module scripts due to an ability to execute arbitrary code as the parent process by manipulating the scoreboard. (CVE-2019-0211)

 - An access control bypass vulnerability exists in mod_auth_digest due to a race condition when running in a threaded server. An attacker with valid credentials could authenticate using another username. (CVE-2019-0217)

 - An access control bypass vulnerability exists in mod_ssl when using per-location client certificate verification with TLSv1.3. (CVE-2019-0215)

In addition, Apache httpd is also affected by several additional vulnerabilities including a denial of service, read-after-free and URL path normalization inconsistencies.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Versions of Apache HTTP server prior to 2.4.39 are unpatched, and therefore affected by multiple vulnerabilities :

 - Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparision when determining the method of a request and thus process the request incorrectly. (CVE-2019-0196)
 - When HTTP/2 was enabled for a 'http: host' or H2Upgrade was enabled for h2 on a 'https: host', an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. A server that never enabled the h2 protocol or that only enabled it for HTTPS and did not configure the "H2Upgrade on" is unaffected by this. (CVE-2019-0197)
 - With MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process by manipulating the scoreboard. (CVE-2019-0211)
 - A bug in 'mod_ssl' when using per-location client certificate verification with TLSv1.3 allows a client supporting Post-Handshake Authentication to bypass configured access control restrictions. (CVE-2019-0215)
 - A race condition in 'mod_auth_digest' when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions. (CVE-2019-0217)
 - When the path component of a request URL contains multiple consecutive slashes ('/'), directives such as 'LocationMatch' and 'RewriteRule' must account for duplicates in regular expressions while other aspects of the servers processing will implicitly collapse them. (CVE-2019-0220)

This update includes the latest upstream release of **Apache httpd**, version **2.4.39**, including multiple bug and security fixes. To see the full list of changes in this release, see:
https://www.apache.org/dist/httpd/CHANGES_2.4.39

The following security vulnerabilities are addressed :

  - `CVE-2019-0211` - MPMs unix: Fix a local priviledge     escalation vulnerability by not maintaining each child's     listener bucket number in the scoreboard, preventing     unprivileged code like scripts run by/on the server     (e.g. via mod_php) from modifying it persistently to     abuse the priviledged main process.

  - `CVE-2019-0215` - mod_ssl: Fix access control bypass for     per-location/per-dir client certificate verification in     TLSv1.3.

  - `CVE-2019-0217` - mod_auth_digest: Fix a race condition     checking user credentials which could allow a user with     valid credentials to impersonate another, under a     threaded MPM.

  - `CVE-2019-0220`- Merge consecutive slashes in URL's.
    Opt-out with `MergeSlashes OFF`.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Apache httpd Project reports :

Apache HTTP Server privilege escalation from modules' scripts (CVE-2019-0211) (important)

mod_auth_digest access control bypass (CVE-2019-0217) (important)

mod_ssl access control bypass (CVE-2019-0215) (important)

mod_http2, possible crash on late upgrade (CVE-2019-0197) (low)

mod_http2, read-after-free on a string compare (CVE-2019-0196) (low)

Apache httpd URL normalization inconsistincy (CVE-2019-0220) (low)

According to its banner, the version of Apache running on the remote host is 2.4.x prior to 2.4.39. It is, therefore, affected by multiple vulnerabilities:

  - A privilege escalation vulnerability exists in     module scripts due to an ability to execute arbitrary     code as the parent process by manipulating the     scoreboard. (CVE-2019-0211)

  - An access control bypass vulnerability exists in     mod_auth_digest due to a race condition when running     in a threaded server. An attacker with valid credentials     could authenticate using another username. (CVE-2019-0217)

  - An access control bypass vulnerability exists in     mod_ssl when using per-location client certificate     verification with TLSv1.3. (CVE-2019-0215)

In addition, Apache httpd is also affected by several additional vulnerabilities including a denial of service, read-after-free and URL path normalization inconsistencies. 

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
203104	Photon OS 3.0: Httpd PHSA-2019-3.0-0013	Nessus	PhotonOS Local Security Checks	high
145599	CentOS 8 : httpd:2.4 (CESA-2019:0980)	Nessus	CentOS Local Security Checks	high
131476	EulerOS Virtualization for ARM 64 3.0.3.0 : httpd (EulerOS-SA-2019-2311)	Nessus	Huawei Local Security Checks	high
128204	EulerOS 2.0 SP8 : httpd (EulerOS-SA-2019-1835)	Nessus	Huawei Local Security Checks	high
127570	Oracle Linux 8 : httpd:2.4 (ELSA-2019-0980)	Nessus	Oracle Linux Local Security Checks	high
126777	Oracle Enterprise Manager Ops Center (Jul 2019 CPU)	Nessus	Misc.	critical
124870	Photon OS 1.0: Httpd PHSA-2019-1.0-0230	Nessus	PhotonOS Local Security Checks	high
124680	Photon OS 2.0: Httpd PHSA-2019-2.0-0157	Nessus	PhotonOS Local Security Checks	high
124667	RHEL 8 : httpd:2.4 (RHSA-2019:0980)	Nessus	Red Hat Local Security Checks	high
124541	Fedora 30 : httpd (2019-cf7695b470)	Nessus	Fedora Local Security Checks	high
124125	Amazon Linux 2 : httpd (ALAS-2019-1189)	Nessus	Amazon Linux Local Security Checks	high
123958	Amazon Linux AMI : httpd24 (ALAS-2019-1189)	Nessus	Amazon Linux Local Security Checks	high
98530	Apache 2.4.x < 2.4.39 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
700509	Apache HTTP Server < 2.4.39 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	high
123801	Fedora 29 : httpd (2019-119b14075a)	Nessus	Fedora Local Security Checks	high
123644	FreeBSD : Apache -- Multiple vulnerabilities (cf2105c6-551b-11e9-b95c-b499baebfeaf)	Nessus	FreeBSD Local Security Checks	high
123642	Apache 2.4.x < 2.4.39 Multiple Vulnerabilities	Nessus	Web Servers	high

Detections

Analytics

CVE-2019-0215

high

Tenable Plugins

high

high

high

high

high

critical

high

high

high

high

high

high

high

high

high

high

high