CVE-2019-10082
published 2019-09-26CVE-2019-10082: In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection…
PriorityP354critical9.1CVSS 3.1
AVNACLPRNUINSUCHINAH
EPSS
16.55%
96.7th percentile
In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection shutdown.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | 2.4.18 – 2.4.39 | — |
| debian | apache2 | < apache2 2.4.41-1 (bookworm) | apache2 2.4.41-1 (bookworm) |
| oracle | communications_element_manager | — | — |
| oracle | communications_element_manager | — | — |
| oracle | communications_element_manager | — | — |
| oracle | communications_element_manager | — | — |
| oracle | enterprise_manager_ops_center | — | — |
| oracle | enterprise_manager_ops_center | — | — |
| oracle | enterprise_manager_ops_center | — | — |
| oracle | http_server | — | — |
| oracle | http_server | — | — |
| oracle | instantis_enterprisetrack | 17.1 – 17.3 | — |
| oracle | retail_xstore_point_of_service | — | — |
| paloalto | pan-os | — | — |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:P
osv9.1CRITICAL
vendor_debian9.1CRITICAL
vendor_oracle9.1CRITICAL
vendor_redhat9.1CRITICAL
vendor_ubuntu4.2MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Palo Alto
PAN-SA-2024-0004 Informational Bulletin: OSS CVEs fixed in PAN-OS
vendor_paloalto·2024-04-10·CVSS 9.8
CVE-2015-5739 [CRITICAL] PAN-SA-2024-0004 Informational Bulletin: OSS CVEs fixed in PAN-OS
PAN-SA-2024-0004 Informational Bulletin: OSS CVEs fixed in PAN-OS
The Palo Alto Networks Product Security Assurance team has evaluated the following open source software (OSS) CVEs as they relate to PAN-OS. While it was not determined that these CVEs have any significant impact on PAN-OS, they have been fixed out of an abundance of caution. CVE Summary CVE-2015-5739 This CVE is fixed in PAN-OS 11.0.4, and all later PAN-OS versions. CVE-2016-10228 This CVE is fixed in PAN-OS 11.1.3, and all later PAN-OS versions. CVE-2017-8923 This CVE is fixed in PAN-OS 10.2.8, 11.0.3, and all later PAN-OS versions. CVE-2017-9120 This CVE is fixed in PAN-OS 10.2.8, 11.0.3, and all later PAN-OS versions. CVE-2018-25009 This CVE is fixed in PAN-OS 10.2.8, 11.0.4, 11.1.3, and all later PAN-OS versions. CVE-2
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: SSL Module (Apache HTTP Server) — CVE-2019-10082
vendor_oracle·2022-07-15·CVSS 9.1
CVE-2019-10082 [CRITICAL] Oracle Oracle Fusion Middleware Risk Matrix: SSL Module (Apache HTTP Server) — CVE-2019-10082
Oracle Oracle Fusion Middleware Risk Matrix: SSL Module (Apache HTTP Server) vulnerability
CVE: CVE-2019-10082
CVSS: 9.1
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2022 (JUL 2022)
Oracle
Oracle Oracle Communications Applications Risk Matrix: Core (Apache HTTP Server) — CVE-2019-10082
vendor_oracle·2020-04-15·CVSS 9.1
CVE-2019-10082 [CRITICAL] Oracle Oracle Communications Applications Risk Matrix: Core (Apache HTTP Server) — CVE-2019-10082
Oracle Oracle Communications Applications Risk Matrix: Core (Apache HTTP Server) vulnerability
CVE: CVE-2019-10082
CVSS: 9.1
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2020 (APR 2020)
Ubuntu
Apache HTTP Server regression
vendor_ubuntu·2019-09-17·CVSS 4.2
[MEDIUM] Apache HTTP Server regression
Title: Apache HTTP Server regression
Summary: USN-4113-1 introduced a regression in Apache.
USN-4113-1 fixed vulnerabilities in the Apache HTTP server.
Unfortunately, that update introduced a regression when proxying
balancer manager connections in some configurations. This update
fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Stefan Eissing discovered that the HTTP/2 implementation in Apache
did not properly handle upgrade requests from HTTP/1.1 to HTTP/2 in
some situations. A remote attacker could use this to cause a denial
of service (daemon crash). This issue only affected Ubuntu 18.04 LTS
and Ubuntu 19.04. (CVE-2019-0197)
Craig Young discovered that a memory overwrite error existed in
Apache when performing HTTP/2 very early pushes in some situ
Ubuntu
Apache HTTP Server vulnerabilities
vendor_ubuntu·2019-08-29·CVSS 4.2
CVE-2019-0197 [MEDIUM] Apache HTTP Server vulnerabilities
Title: Apache HTTP Server vulnerabilities
Summary: Several security issues were fixed in Apache.
Stefan Eissing discovered that the HTTP/2 implementation in Apache
did not properly handle upgrade requests from HTTP/1.1 to HTTP/2 in
some situations. A remote attacker could use this to cause a denial
of service (daemon crash). This issue only affected Ubuntu 18.04 LTS
and Ubuntu 19.04. (CVE-2019-0197)
Craig Young discovered that a memory overwrite error existed in
Apache when performing HTTP/2 very early pushes in some situations. A
remote attacker could use this to cause a denial of service (daemon
crash). This issue only affected Ubuntu 18.04 LTS and Ubuntu 19.04.
(CVE-2019-10081)
Craig Young discovered that a read-after-free error existed in the
HTTP/2 implementation in Apache during
Red Hat
httpd: read-after-free in h2 connection shutdown
vendor_redhat·2019-08-14·CVSS 9.1
CVE-2019-10082 [CRITICAL] httpd: read-after-free in h2 connection shutdown
httpd: read-after-free in h2 connection shutdown
In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection shutdown.
A read-after-free vulnerability was discovered in Apache httpd, in mod_http2. A specially crafted http/2 client session could cause the server to read memory that was previously freed during connection shutdown, potentially leading to a crash.
Mitigation: This flaw is only exploitable if Apache httpd is configured to respond to HTTP/2 requests, which is done by including "h2" or "h2c" in the "Protocols" list in a configuration file. The following command can be used to search for possible vulnerable configurations:
grep -R '^\s*Protocols\>.*\' /etc/httpd/
See https://httpd
Debian
CVE-2019-10082: apache2 - In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 sess...
vendor_debian·2019·CVSS 9.1
CVE-2019-10082 [CRITICAL] CVE-2019-10082: apache2 - In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 sess...
In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection shutdown.
Scope: local
bookworm: resolved (fixed in 2.4.41-1)
bullseye: resolved (fixed in 2.4.41-1)
forky: resolved (fixed in 2.4.41-1)
sid: resolved (fixed in 2.4.41-1)
trixie: resolved (fixed in 2.4.41-1)
GHSA
GHSA-28c2-r3qq-82vj: In Apache HTTP Server 2
ghsa_unreviewed·2022-05-24
CVE-2019-10082 [MEDIUM] CWE-416 GHSA-28c2-r3qq-82vj: In Apache HTTP Server 2
In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection shutdown.
OSV
CVE-2019-10082: In Apache HTTP Server 2
osv·2019-09-26·CVSS 9.1
CVE-2019-10082 [CRITICAL] CVE-2019-10082: In Apache HTTP Server 2
In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection shutdown.
OSV
apache2 regression
osv·2019-09-17·CVSS 4.2
[MEDIUM] apache2 regression
apache2 regression
USN-4113-1 fixed vulnerabilities in the Apache HTTP server.
Unfortunately, that update introduced a regression when proxying
balancer manager connections in some configurations. This update
fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Stefan Eissing discovered that the HTTP/2 implementation in Apache
did not properly handle upgrade requests from HTTP/1.1 to HTTP/2 in
some situations. A remote attacker could use this to cause a denial
of service (daemon crash). This issue only affected Ubuntu 18.04 LTS
and Ubuntu 19.04. (CVE-2019-0197)
Craig Young discovered that a memory overwrite error existed in
Apache when performing HTTP/2 very early pushes in some situations. A
remote attacker could use this to cause a denial of service (dae
OSV
apache2 vulnerabilities
osv·2019-08-29·CVSS 4.2
CVE-2019-0197 [MEDIUM] apache2 vulnerabilities
apache2 vulnerabilities
Stefan Eissing discovered that the HTTP/2 implementation in Apache
did not properly handle upgrade requests from HTTP/1.1 to HTTP/2 in
some situations. A remote attacker could use this to cause a denial
of service (daemon crash). This issue only affected Ubuntu 18.04 LTS
and Ubuntu 19.04. (CVE-2019-0197)
Craig Young discovered that a memory overwrite error existed in
Apache when performing HTTP/2 very early pushes in some situations. A
remote attacker could use this to cause a denial of service (daemon
crash). This issue only affected Ubuntu 18.04 LTS and Ubuntu 19.04.
(CVE-2019-10081)
Craig Young discovered that a read-after-free error existed in the
HTTP/2 implementation in Apache during connection shutdown. A remote
attacker could use this to possibly cause a
No detection rules found.
No public exploits indexed.
HackerOne
mod_http2, read-after-free in h2 connection shutdown (CVE-2019-10082)
hackerone·2019-10-15·CVSS 9.1
CVE-2019-10082 [CRITICAL] mod_http2, read-after-free in h2 connection shutdown (CVE-2019-10082)
mod_http2, read-after-free in h2 connection shutdown (CVE-2019-10082)
Using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection shutdown. This is made possible by a race condition in which nghttp2 maintains a reference to a stream after mod_http2 has destroyed it.
This vulnerability has been fixed in 2.4.41 and affects versions as far back as 2.4.18.
Using [http2fuzz](https://github.com/c0nrad/http2fuzz) against an ASAN build of httpd with `MaxMemFree 1` will quickly reproduce crashes like this:
```
==22097==ERROR: AddressSanitizer: heap-use-after-free on address 0x6250042609b8 at pc 0x0000008d63f3 bp 0x7fd8c39f9420 sp 0x7fd8c39f9410
READ of size 4 at 0x6250042609b8 thread T1044
#0 0x8d63f2 in h2_stream_send_frame /home/cyo
Bugzilla
CVE-2019-10082 nghttp2: httpd: read-after-free in h2 connection shutdown [fedora-all]
bugzilla·2019-08-21·CVSS 9.1
CVE-2019-10082 [CRITICAL] CVE-2019-10082 nghttp2: httpd: read-after-free in h2 connection shutdown [fedora-all]
CVE-2019-10082 nghttp2: httpd: read-after-free in h2 connection shutdown [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported
Bugzilla
CVE-2019-10082 httpd: read-after-free in h2 connection shutdown
bugzilla·2019-08-21·CVSS 9.1
CVE-2019-10082 [CRITICAL] CVE-2019-10082 httpd: read-after-free in h2 connection shutdown
CVE-2019-10082 httpd: read-after-free in h2 connection shutdown
A vulnerability was found in httpd, where using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection shutdown.
Discussion:
Created httpd tracking bugs for this issue:
Affects: fedora-all [bug 1743975]
Created mod_http2 tracking bugs for this issue:
Affects: fedora-all [bug 1743976]
Created nghttp2 tracking bugs for this issue:
Affects: epel-all [bug 1743977]
Affects: fedora-all [bug 1743979]
Created nginx tracking bugs for this issue:
Affects: fedora-all [bug 1743981]
Created nodejs tracking bugs for this issue:
Affects: epel-all [bug 1743978]
Affects: fedora-all [bug 1743980]
---
External References:
https://httpd.apache.org/security/vulnerabili
Bugzilla
CVE-2019-10082 httpd: read-after-free in h2 connection shutdown [fedora-all]
bugzilla·2019-08-21·CVSS 9.1
CVE-2019-10082 [CRITICAL] CVE-2019-10082 httpd: read-after-free in h2 connection shutdown [fedora-all]
CVE-2019-10082 httpd: read-after-free in h2 connection shutdown [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions
Bugzilla
CVE-2019-10082 nghttp2: httpd: read-after-free in h2 connection shutdown [epel-all]
bugzilla·2019-08-21·CVSS 9.1
CVE-2019-10082 [CRITICAL] CVE-2019-10082 nghttp2: httpd: read-after-free in h2 connection shutdown [epel-all]
CVE-2019-10082 nghttp2: httpd: read-after-free in h2 connection shutdown [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported vers
Bugzilla
CVE-2019-10082 nginx: httpd: read-after-free in h2 connection shutdown [fedora-all]
bugzilla·2019-08-21·CVSS 9.1
CVE-2019-10082 [CRITICAL] CVE-2019-10082 nginx: httpd: read-after-free in h2 connection shutdown [fedora-all]
CVE-2019-10082 nginx: httpd: read-after-free in h2 connection shutdown [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported ve
Bugzilla
CVE-2019-10082 nodejs: httpd: read-after-free in h2 connection shutdown [epel-all]
bugzilla·2019-08-21·CVSS 9.1
CVE-2019-10082 [CRITICAL] CVE-2019-10082 nodejs: httpd: read-after-free in h2 connection shutdown [epel-all]
CVE-2019-10082 nodejs: httpd: read-after-free in h2 connection shutdown [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versi
Bugzilla
CVE-2019-10082 nodejs: httpd: read-after-free in h2 connection shutdown [fedora-all]
bugzilla·2019-08-21·CVSS 9.1
CVE-2019-10082 [CRITICAL] CVE-2019-10082 nodejs: httpd: read-after-free in h2 connection shutdown [fedora-all]
CVE-2019-10082 nodejs: httpd: read-after-free in h2 connection shutdown [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported v
Bugzilla
CVE-2019-10082 mod_http2: httpd: read-after-free in h2 connection shutdown [fedora-all]
bugzilla·2019-08-21·CVSS 9.1
CVE-2019-10082 [CRITICAL] CVE-2019-10082 mod_http2: httpd: read-after-free in h2 connection shutdown [fedora-all]
CVE-2019-10082 mod_http2: httpd: read-after-free in h2 connection shutdown [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supporte
https://httpd.apache.org/security/vulnerabilities_24.htmlhttps://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd2fb621142e7fa187cfe12d7137bf66e7234abcbbcd800074c84a538%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttps://www.oracle.com/security-alerts/cpuapr2020.htmlhttps://www.oracle.com/security-alerts/cpujul2020.htmlhttps://www.oracle.com/security-alerts/cpujul2022.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.htmlhttps://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlhttps://httpd.apache.org/security/vulnerabilities_24.htmlhttps://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rd2fb621142e7fa187cfe12d7137bf66e7234abcbbcd800074c84a538%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3Ehttps://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Ehttps://www.oracle.com/security-alerts/cpuapr2020.htmlhttps://www.oracle.com/security-alerts/cpujul2020.htmlhttps://www.oracle.com/security-alerts/cpujul2022.htmlhttps://www.oracle.com/security-alerts/cpuoct2021.htmlhttps://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
2019-09-26
Published