CVE-2019-0190

A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request that would cause mod_ssl to enter a loop leading to a denial of service. This bug can be only triggered with Apache HTTP Server version 2.4.37 when using OpenSSL version 1.1.1 or later, due to an interaction in changes to handling of renegotiation attempts.

Database specific

{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "12.3.3"
                },
                {
                    "last_affected": "12.3.3"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "oracle:enterprise_manager_ops_center"
        },
        {
            "cpes": [
                "cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "4.2.0"
                },
                {
                    "last_affected": "4.2.0"
                },
                {
                    "introduced": "4.2.1"
                },
                {
                    "last_affected": "4.2.1"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "oracle:hospitality_guest_access"
        },
        {
            "cpes": [
                "cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "17.1"
                },
                {
                    "last_affected": "17.1"
                },
                {
                    "introduced": "17.2"
                },
                {
                    "last_affected": "17.2"
                },
                {
                    "introduced": "17.3"
                },
                {
                    "last_affected": "17.3"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "oracle:instantis_enterprisetrack"
        },
        {
            "cpes": [
                "cpe:2.3:a:oracle:retail_xstore_point_of_service:7.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "7.0"
                },
                {
                    "last_affected": "7.0"
                },
                {
                    "introduced": "7.1"
                },
                {
                    "last_affected": "7.1"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "oracle:retail_xstore_point_of_service"
        }
    ]
}

References

Affected packages

Git / github.com/apache/httpd

Affected ranges

Type

GIT

Repo

https://github.com/apache/httpd

Events

Introduced

6431bbb0da47dd984110dc32728a84e5cc990313

Last Affected

6431bbb0da47dd984110dc32728a84e5cc990313

Database specific

Show details

{
    "cpe": "cpe:2.3:a:apache:http_server:2.4.37:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.4.37"
        },
        {
            "last_affected": "2.4.37"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

2.*

2.4.37

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-0190.json"