USN-3937-1

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/notices/USN-3937-1

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-3937-1.json

JSON Data

https://api.osv.dev/v1/vulns/USN-3937-1

Related

Published

2019-04-04T15:08:53.439137Z

Modified

2019-04-04T15:08:53.439137Z

Summary

apache2 vulnerabilities

Details

Charles Fol discovered that the Apache HTTP Server incorrectly handled the scoreboard shared memory area. A remote attacker able to upload and run scripts could possibly use this issue to execute arbitrary code with root privileges. (CVE-2019-0211)

It was discovered that the Apache HTTP Server HTTP/2 module incorrectly handled certain requests. A remote attacker could possibly use this issue to cause the server to consume resources, leading to a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-17189)

It was discovered that the Apache HTTP Server incorrectly handled session expiry times. When used with modsessioncookie, this may result in the session expiry time to be ignored, contrary to expectations. (CVE-2018-17199)

Craig Young discovered that the Apache HTTP Server HTTP/2 module incorrectly handled certain requests. A remote attacker could possibly use this issue to cause the server to process requests incorrectly. This issue only affected Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2019-0196)

Simon Kappel discovered that the Apache HTTP Server modauthdigest module incorrectly handled threads. A remote attacker with valid credentials could possibly use this issue to authenticate using another username, bypassing access control restrictions. (CVE-2019-0217)

Bernhard Lorenz discovered that the Apache HTTP Server was inconsistent when processing requests containing multiple consecutive slashes. This could lead to directives such as LocationMatch and RewriteRule to perform contrary to expectations. (CVE-2019-0220)

References

Affected packages

Ubuntu:14.04:LTS / apache2

Package

Name: apache2
Purl: pkg:deb/ubuntu/apache2?arch=src?distro=trusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.7-1ubuntu4.22

Affected versions

2.*

2.4.6-2ubuntu2

2.4.6-2ubuntu3

2.4.6-2ubuntu4

2.4.7-1ubuntu1

2.4.7-1ubuntu2

2.4.7-1ubuntu3

2.4.7-1ubuntu4

2.4.7-1ubuntu4.1

2.4.7-1ubuntu4.4

2.4.7-1ubuntu4.5

2.4.7-1ubuntu4.6

2.4.7-1ubuntu4.7

2.4.7-1ubuntu4.8

2.4.7-1ubuntu4.9

2.4.7-1ubuntu4.10

2.4.7-1ubuntu4.11

2.4.7-1ubuntu4.13

2.4.7-1ubuntu4.15

2.4.7-1ubuntu4.16

2.4.7-1ubuntu4.17

2.4.7-1ubuntu4.18

2.4.7-1ubuntu4.19

2.4.7-1ubuntu4.20

2.4.7-1ubuntu4.21

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "2.4.7-1ubuntu4.22",
            "binary_name": "apache2"
        },
        {
            "binary_version": "2.4.7-1ubuntu4.22",
            "binary_name": "apache2-bin"
        },
        {
            "binary_version": "2.4.7-1ubuntu4.22",
            "binary_name": "apache2-bin-dbgsym"
        },
        {
            "binary_version": "2.4.7-1ubuntu4.22",
            "binary_name": "apache2-data"
        },
        {
            "binary_version": "2.4.7-1ubuntu4.22",
            "binary_name": "apache2-dbg"
        },
        {
            "binary_version": "2.4.7-1ubuntu4.22",
            "binary_name": "apache2-dev"
        },
        {
            "binary_version": "2.4.7-1ubuntu4.22",
            "binary_name": "apache2-doc"
        },
        {
            "binary_version": "2.4.7-1ubuntu4.22",
            "binary_name": "apache2-mpm-event"
        },
        {
            "binary_version": "2.4.7-1ubuntu4.22",
            "binary_name": "apache2-mpm-itk"
        },
        {
            "binary_version": "2.4.7-1ubuntu4.22",
            "binary_name": "apache2-mpm-prefork"
        },
        {
            "binary_version": "2.4.7-1ubuntu4.22",
            "binary_name": "apache2-mpm-worker"
        },
        {
            "binary_version": "2.4.7-1ubuntu4.22",
            "binary_name": "apache2-suexec"
        },
        {
            "binary_version": "2.4.7-1ubuntu4.22",
            "binary_name": "apache2-suexec-custom"
        },
        {
            "binary_version": "2.4.7-1ubuntu4.22",
            "binary_name": "apache2-suexec-custom-dbgsym"
        },
        {
            "binary_version": "2.4.7-1ubuntu4.22",
            "binary_name": "apache2-suexec-pristine"
        },
        {
            "binary_version": "2.4.7-1ubuntu4.22",
            "binary_name": "apache2-suexec-pristine-dbgsym"
        },
        {
            "binary_version": "2.4.7-1ubuntu4.22",
            "binary_name": "apache2-utils"
        },
        {
            "binary_version": "2.4.7-1ubuntu4.22",
            "binary_name": "apache2-utils-dbgsym"
        },
        {
            "binary_version": "2.4.7-1ubuntu4.22",
            "binary_name": "apache2.2-bin"
        },
        {
            "binary_version": "1:2.4.7-1ubuntu4.22",
            "binary_name": "libapache2-mod-macro"
        },
        {
            "binary_version": "1:2.4.7-1ubuntu4.22",
            "binary_name": "libapache2-mod-proxy-html"
        }
    ]
}

Ubuntu:16.04:LTS / apache2

Package

Name: apache2
Purl: pkg:deb/ubuntu/apache2?arch=src?distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.18-2ubuntu3.10

Affected versions

2.*

2.4.12-2ubuntu2

2.4.17-1ubuntu1

2.4.17-2ubuntu1

2.4.17-3ubuntu1

2.4.18-1ubuntu1

2.4.18-2ubuntu1

2.4.18-2ubuntu2

2.4.18-2ubuntu3

2.4.18-2ubuntu3.1

2.4.18-2ubuntu3.2

2.4.18-2ubuntu3.3

2.4.18-2ubuntu3.4

2.4.18-2ubuntu3.5

2.4.18-2ubuntu3.7

2.4.18-2ubuntu3.8

2.4.18-2ubuntu3.9

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "2.4.18-2ubuntu3.10",
            "binary_name": "apache2"
        },
        {
            "binary_version": "2.4.18-2ubuntu3.10",
            "binary_name": "apache2-bin"
        },
        {
            "binary_version": "2.4.18-2ubuntu3.10",
            "binary_name": "apache2-bin-dbgsym"
        },
        {
            "binary_version": "2.4.18-2ubuntu3.10",
            "binary_name": "apache2-data"
        },
        {
            "binary_version": "2.4.18-2ubuntu3.10",
            "binary_name": "apache2-dbg"
        },
        {
            "binary_version": "2.4.18-2ubuntu3.10",
            "binary_name": "apache2-dbgsym"
        },
        {
            "binary_version": "2.4.18-2ubuntu3.10",
            "binary_name": "apache2-dev"
        },
        {
            "binary_version": "2.4.18-2ubuntu3.10",
            "binary_name": "apache2-dev-dbgsym"
        },
        {
            "binary_version": "2.4.18-2ubuntu3.10",
            "binary_name": "apache2-doc"
        },
        {
            "binary_version": "2.4.18-2ubuntu3.10",
            "binary_name": "apache2-suexec-custom"
        },
        {
            "binary_version": "2.4.18-2ubuntu3.10",
            "binary_name": "apache2-suexec-custom-dbgsym"
        },
        {
            "binary_version": "2.4.18-2ubuntu3.10",
            "binary_name": "apache2-suexec-pristine"
        },
        {
            "binary_version": "2.4.18-2ubuntu3.10",
            "binary_name": "apache2-suexec-pristine-dbgsym"
        },
        {
            "binary_version": "2.4.18-2ubuntu3.10",
            "binary_name": "apache2-utils"
        },
        {
            "binary_version": "2.4.18-2ubuntu3.10",
            "binary_name": "apache2-utils-dbgsym"
        }
    ]
}

Ubuntu:18.04:LTS / apache2

Package

Name: apache2
Purl: pkg:deb/ubuntu/apache2?arch=src?distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.29-1ubuntu4.6

Affected versions

2.*

2.4.27-2ubuntu3

2.4.29-1ubuntu1

2.4.29-1ubuntu2

2.4.29-1ubuntu3

2.4.29-1ubuntu4

2.4.29-1ubuntu4.1

2.4.29-1ubuntu4.2

2.4.29-1ubuntu4.3

2.4.29-1ubuntu4.4

2.4.29-1ubuntu4.5

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "2.4.29-1ubuntu4.6",
            "binary_name": "apache2"
        },
        {
            "binary_version": "2.4.29-1ubuntu4.6",
            "binary_name": "apache2-bin"
        },
        {
            "binary_version": "2.4.29-1ubuntu4.6",
            "binary_name": "apache2-data"
        },
        {
            "binary_version": "2.4.29-1ubuntu4.6",
            "binary_name": "apache2-dbg"
        },
        {
            "binary_version": "2.4.29-1ubuntu4.6",
            "binary_name": "apache2-dev"
        },
        {
            "binary_version": "2.4.29-1ubuntu4.6",
            "binary_name": "apache2-doc"
        },
        {
            "binary_version": "2.4.29-1ubuntu4.6",
            "binary_name": "apache2-ssl-dev"
        },
        {
            "binary_version": "2.4.29-1ubuntu4.6",
            "binary_name": "apache2-suexec-custom"
        },
        {
            "binary_version": "2.4.29-1ubuntu4.6",
            "binary_name": "apache2-suexec-pristine"
        },
        {
            "binary_version": "2.4.29-1ubuntu4.6",
            "binary_name": "apache2-utils"
        }
    ]
}