CVE-2019-10081
published 2019-08-15CVE-2019-10081: HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's…
PriorityP347high7.5CVSS 3.0
AVNACLPRNUINSUCNINAH
EPSS
14.56%
96.3th percentile
HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | 2.4.20 – 2.4.39 | — |
| debian | apache2 | < apache2 2.4.41-1 (bookworm) | apache2 2.4.41-1 (bookworm) |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| paloalto | pan-os | — | — |
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu4.2MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Palo Alto
PAN-SA-2024-0004 Informational Bulletin: OSS CVEs fixed in PAN-OS
vendor_paloalto·2024-04-10·CVSS 9.8
CVE-2015-5739 [CRITICAL] PAN-SA-2024-0004 Informational Bulletin: OSS CVEs fixed in PAN-OS
PAN-SA-2024-0004 Informational Bulletin: OSS CVEs fixed in PAN-OS
The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS. While it was not determined that these CVEs have any significant impact on PAN-OS, they have been fixed out of an abundance of caution. CVE Summary CVE-2015-5739 This CVE is fixed in PAN-OS 11.0.4, and all later PAN-OS versions. CVE-2016-10228 This CVE is fixed in PAN-OS 11.1.3, and all later PAN-OS versions. CVE-2017-8923 This CVE is fixed in PAN-OS 10.2.8, 11.0.3, and all later PAN-OS versions. CVE-2017-9120 This CVE is fixed in PAN-OS 10.2.8, 11.0.3, and all later PAN-OS versions. CVE-2018-25009 This CVE is fixed in PAN-OS 10.2.8, 11.0.4, 11.1.3, and all later PAN-OS versions. CVE-2
Ubuntu
Apache HTTP Server regression
vendor_ubuntu·2019-09-17·CVSS 4.2
[MEDIUM] Apache HTTP Server regression
Title: Apache HTTP Server regression
Summary: USN-4113-1 introduced a regression in Apache.
USN-4113-1 fixed vulnerabilities in the Apache HTTP server.
Unfortunately, that update introduced a regression when proxying
balancer manager connections in some configurations. This update
fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Stefan Eissing discovered that the HTTP/2 implementation in Apache
did not properly handle upgrade requests from HTTP/1.1 to HTTP/2 in
some situations. A remote attacker could use this to cause a denial
of service (daemon crash). This issue only affected Ubuntu 18.04 LTS
and Ubuntu 19.04. (CVE-2019-0197)
Craig Young discovered that a memory overwrite error existed in
Apache when performing HTTP/2 very early pushes in some situ
Ubuntu
Apache HTTP Server vulnerabilities
vendor_ubuntu·2019-08-29·CVSS 4.2
CVE-2019-0197 [MEDIUM] Apache HTTP Server vulnerabilities
Title: Apache HTTP Server vulnerabilities
Summary: Several security issues were fixed in Apache.
Stefan Eissing discovered that the HTTP/2 implementation in Apache
did not properly handle upgrade requests from HTTP/1.1 to HTTP/2 in
some situations. A remote attacker could use this to cause a denial
of service (daemon crash). This issue only affected Ubuntu 18.04 LTS
and Ubuntu 19.04. (CVE-2019-0197)
Craig Young discovered that a memory overwrite error existed in
Apache when performing HTTP/2 very early pushes in some situations. A
remote attacker could use this to cause a denial of service (daemon
crash). This issue only affected Ubuntu 18.04 LTS and Ubuntu 19.04.
(CVE-2019-10081)
Craig Young discovered that a read-after-free error existed in the
HTTP/2 implementation in Apache during
Red Hat
httpd: memory corruption on early pushes
vendor_redhat·2019-08-14·CVSS 7.5
CVE-2019-10081 [HIGH] CWE-400 httpd: memory corruption on early pushes
httpd: memory corruption on early pushes
HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client.
A vulnerability was found in Apache httpd, in mod_http2. Under certain circumstances, HTTP/2 early pushes could lead to memory corruption, causing a server to crash.
Mitigation: This flaw is only exploitable if Apache httpd is configured to respond to HTTP/2 requests, which is done by including "h2" or "h2c" in the "Protocols" list in a configuration file. The following command can be used to search for possible vulnerable configurations:
grep -R '^\s*Protocols\>.*\
Debian
CVE-2019-10081: apache2 - HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H...
vendor_debian·2019·CVSS 7.5
CVE-2019-10081 [HIGH] CVE-2019-10081: apache2 - HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H...
HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client.
Scope: local
bookworm: resolved (fixed in 2.4.41-1)
bullseye: resolved (fixed in 2.4.41-1)
forky: resolved (fixed in 2.4.41-1)
sid: resolved (fixed in 2.4.41-1)
trixie: resolved (fixed in 2.4.41-1)
GHSA
GHSA-c2vp-q2q2-hm8m: HTTP/2 (2
ghsa_unreviewed·2022-05-24
CVE-2019-10081 [HIGH] CWE-787 GHSA-c2vp-q2q2-hm8m: HTTP/2 (2
HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client.
OSV
apache2 regression
osv·2019-09-17·CVSS 4.2
[MEDIUM] apache2 regression
apache2 regression
USN-4113-1 fixed vulnerabilities in the Apache HTTP server.
Unfortunately, that update introduced a regression when proxying
balancer manager connections in some configurations. This update
fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Stefan Eissing discovered that the HTTP/2 implementation in Apache
did not properly handle upgrade requests from HTTP/1.1 to HTTP/2 in
some situations. A remote attacker could use this to cause a denial
of service (daemon crash). This issue only affected Ubuntu 18.04 LTS
and Ubuntu 19.04. (CVE-2019-0197)
Craig Young discovered that a memory overwrite error existed in
Apache when performing HTTP/2 very early pushes in some situations. A
remote attacker could use this to cause a denial of service (dae
OSV
apache2 vulnerabilities
osv·2019-08-29·CVSS 4.2
CVE-2019-0197 [MEDIUM] apache2 vulnerabilities
apache2 vulnerabilities
Stefan Eissing discovered that the HTTP/2 implementation in Apache
did not properly handle upgrade requests from HTTP/1.1 to HTTP/2 in
some situations. A remote attacker could use this to cause a denial
of service (daemon crash). This issue only affected Ubuntu 18.04 LTS
and Ubuntu 19.04. (CVE-2019-0197)
Craig Young discovered that a memory overwrite error existed in
Apache when performing HTTP/2 very early pushes in some situations. A
remote attacker could use this to cause a denial of service (daemon
crash). This issue only affected Ubuntu 18.04 LTS and Ubuntu 19.04.
(CVE-2019-10081)
Craig Young discovered that a read-after-free error existed in the
HTTP/2 implementation in Apache during connection shutdown. A remote
attacker could use this to possibly cause a
OSV
CVE-2019-10081: HTTP/2 (2
osv·2019-08-15·CVSS 7.5
CVE-2019-10081 [HIGH] CVE-2019-10081: HTTP/2 (2
HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client.
No detection rules found.
No public exploits indexed.
HackerOne
mod_http2, memory corruption on early pushes (CVE-2019-10081)
hackerone·2019-10-15·CVSS 7.5
CVE-2019-10081 [HIGH] mod_http2, memory corruption on early pushes (CVE-2019-10081)
mod_http2, memory corruption on early pushes (CVE-2019-10081)
HTTP/2 very early pushes, for example configured with `H2PushResource`, could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client. Scenarios where an attacker may be able to influence response header values could potentially lead to controlled code execution. (Code execution has not been demonstrated and is unlikely with the config included here.) This issue affects versions 2.4.20 through 2.4.39.
This CVE is noted on the [Apache HTTPD advisory list](https://httpd.apache.org/security/vulnerabilities_24.html) as of August 14, 2019.
Reproduction is possible under ASAN builds of HTTPD with `MaxMemFre
Bugzilla
CVE-2019-10081 httpd: memory corruption on early pushes [fedora-all]
bugzilla·2019-08-21·CVSS 7.5
CVE-2019-10081 [HIGH] CVE-2019-10081 httpd: memory corruption on early pushes [fedora-all]
CVE-2019-10081 httpd: memory corruption on early pushes [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedor
Bugzilla
CVE-2019-10081 nodejs: httpd: memory corruption on early pushes [epel-all]
bugzilla·2019-08-21·CVSS 7.5
CVE-2019-10081 [HIGH] CVE-2019-10081 nodejs: httpd: memory corruption on early pushes [epel-all]
CVE-2019-10081 nodejs: httpd: memory corruption on early pushes [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of F
Bugzilla
CVE-2019-10081 nghttp2: httpd: memory corruption on early pushes [epel-all]
bugzilla·2019-08-21·CVSS 7.5
CVE-2019-10081 [HIGH] CVE-2019-10081 nghttp2: httpd: memory corruption on early pushes [epel-all]
CVE-2019-10081 nghttp2: httpd: memory corruption on early pushes [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of
Bugzilla
CVE-2019-10081 httpd: memory corruption on early pushes
bugzilla·2019-08-21·CVSS 7.5
CVE-2019-10081 [HIGH] CVE-2019-10081 httpd: memory corruption on early pushes
CVE-2019-10081 httpd: memory corruption on early pushes
A vulnerability was found in httpd, where HTTP/2 very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client.
Discussion:
Created httpd tracking bugs for this issue:
Affects: fedora-all [bug 1743967]
Created mod_http2 tracking bugs for this issue:
Affects: fedora-all [bug 1743968]
Created nghttp2 tracking bugs for this issue:
Affects: epel-all [bug 1743969]
Affects: fedora-all [bug 1743971]
Created nginx tracking bugs for this issue:
Affects: fedora-all [bug 1743973]
Created nodejs tracking bugs for this issue:
Affects: epel-all
Bugzilla
CVE-2019-10081 nghttp2: httpd: memory corruption on early pushes [fedora-all]
bugzilla·2019-08-21·CVSS 7.5
CVE-2019-10081 [HIGH] CVE-2019-10081 nghttp2: httpd: memory corruption on early pushes [fedora-all]
CVE-2019-10081 nghttp2: httpd: memory corruption on early pushes [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions
Bugzilla
CVE-2019-10081 nodejs: httpd: memory corruption on early pushes [fedora-all]
bugzilla·2019-08-21·CVSS 7.5
CVE-2019-10081 [HIGH] CVE-2019-10081 nodejs: httpd: memory corruption on early pushes [fedora-all]
CVE-2019-10081 nodejs: httpd: memory corruption on early pushes [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions
Bugzilla
CVE-2019-10081 nginx: httpd: memory corruption on early pushes [fedora-all]
bugzilla·2019-08-21·CVSS 7.5
CVE-2019-10081 [HIGH] CVE-2019-10081 nginx: httpd: memory corruption on early pushes [fedora-all]
CVE-2019-10081 nginx: httpd: memory corruption on early pushes [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions o
Bugzilla
CVE-2019-10081 mod_http2: httpd: memory corruption on early pushes [fedora-all]
bugzilla·2019-08-21·CVSS 7.5
CVE-2019-10081 [HIGH] CVE-2019-10081 mod_http2: httpd: memory corruption on early pushes [fedora-all]
CVE-2019-10081 mod_http2: httpd: memory corruption on early pushes [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versio
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00004.htmlhttps://httpd.apache.org/security/vulnerabilities_24.htmlhttps://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd2fb621142e7fa187cfe12d7137bf66e7234abcbbcd800074c84a538%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttps://seclists.org/bugtraq/2019/Aug/47https://security.gentoo.org/glsa/201909-04https://security.netapp.com/advisory/ntap-20190905-0003/https://support.f5.com/csp/article/K84341091?utm_source=f5support&%3Butm_medium=RSShttps://usn.ubuntu.com/4113-1/https://www.debian.org/security/2019/dsa-4509https://www.oracle.com/security-alerts/cpuapr2020.htmlhttps://www.oracle.com/security-alerts/cpujul2020.htmlhttps://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00004.htmlhttps://httpd.apache.org/security/vulnerabilities_24.htmlhttps://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd2fb621142e7fa187cfe12d7137bf66e7234abcbbcd800074c84a538%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttps://seclists.org/bugtraq/2019/Aug/47https://security.gentoo.org/glsa/201909-04https://security.netapp.com/advisory/ntap-20190905-0003/https://support.f5.com/csp/article/K84341091?utm_source=f5support&%3Butm_medium=RSShttps://usn.ubuntu.com/4113-1/https://www.debian.org/security/2019/dsa-4509https://www.oracle.com/security-alerts/cpuapr2020.htmlhttps://www.oracle.com/security-alerts/cpujul2020.htmlhttps://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
2019-08-15
Published