CVE-2019-0190

CWE-83511 documents10 sources
Severity
7.5HIGH
EPSS
17.4%
top 4.94%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Apache Software Foundation Apache Http ServerApache Http ServerOracle Enterprise Manager OPS Center+3 more
Timeline
PublishedJan 30
Latest updateMay 13

Description

A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request that would cause mod_ssl to enter a loop leading to a denial of service. This bug can be only triggered with Apache HTTP Server version 2.4.37 when using OpenSSL version 1.1.1 or later, due to an interaction in changes to handling of renegotiation attempts.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages7 packages

▶NVDapache/http_server2.4.37
▶CVEListV5apache_software_foundation/apache_http_serverApache HTTP Server 2.4.37
▶Debianapache2< 2.4.38-1+3
▶NVDoracle/instantis_enterprisetrack17.1, 17.2, 17.3+2

🔴Vulnerability Details

4
GHSA
GHSA-m3q7-x278-m229: A bug exists in the way mod_ssl handled client renegotiations↗2022-05-13
▶
CVEList
CVE-2019-0190: A bug exists in the way mod_ssl handled client renegotiations↗2019-01-30
▶
OSV
CVE-2019-0190: A bug exists in the way mod_ssl handled client renegotiations↗2019-01-30
▶
VulnCheck
Apache HTTP Server mod_ssl when used with OpenSSL Vulnerability↗2019
▶

📋Vendor Advisories

4
Oracle
Oracle Oracle Essbase Risk Matrix: Infrastructure (OpenSSL) — CVE-2019-0190↗2021-07-15
▶
Red Hat
httpd: mod_ssl: infinite loop triggered by client-initiated renegotiation when using OpenSSL 1.1.1↗2019-01-22
▶
Debian
CVE-2019-0190: apache2 - A bug exists in the way mod_ssl handled client renegotiations. A remote attacker...↗2019
▶
Apache
Apache httpd: CVE-2019-0190↗
▶

💬Community

2
Bugzilla
CVE-2019-0190 httpd: mod_ssl: infinite loop triggered by client-initiated renegotiation when using OpenSSL 1.1.1 [fedora-29]↗2019-01-22
▶
Bugzilla
CVE-2019-0190 httpd: mod_ssl: infinite loop triggered by client-initiated renegotiation when using OpenSSL 1.1.1↗2019-01-22
▶