Vulnerability Description
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Http Server | >= 2.4.17, <= 2.4.38 |
| Fedoraproject | Fedora | 28 |
| Canonical | Ubuntu Linux | 14.04 |
| Debian | Debian Linux | 9.0 |
| Opensuse | Leap | 15.0 |
| Netapp | Oncommand Unified Manager | - |
| Redhat | Jboss Core Services | 1.0 |
| Redhat | Openshift Container Platform | 3.11 |
| Redhat | Openshift Container Platform For Power | 3.11_ppc64le |
| Redhat | Software Collections | 1.0 |
| Redhat | Enterprise Linux | 8.0 |
| Redhat | Enterprise Linux Eus | 8.1 |
| Redhat | Enterprise Linux For Arm 64 | 8.0_aarch64 |
| Redhat | Enterprise Linux For Arm 64 Eus | 8.1_aarch64 |
| Redhat | Enterprise Linux For Ibm Z Systems | 8.0_s390x |
| Redhat | Enterprise Linux For Ibm Z Systems Eus | 8.1_s390x |
| Redhat | Enterprise Linux For Power Little Endian | 8.0_ppc64le |
| Redhat | Enterprise Linux For Power Little Endian Eus | 8.1_ppc64le |
| Redhat | Enterprise Linux Server Aus | 8.2 |
| Redhat | Enterprise Linux Server Tus | 8.2 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.htmlBroken LinkMailing ListRelease Notes
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.htmlBroken LinkMailing ListRelease Notes
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00084.htmlBroken LinkThird Party Advisory
- http://packetstormsecurity.com/files/152386/Apache-2.4.38-Root-Privilege-EscalatThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/152415/Slackware-Security-Advisory-httpd-UpExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/152441/CARPE-DIEM-Apache-2.4.x-Local-PrivilExploitThird Party AdvisoryVDB Entry
- http://www.apache.org/dist/httpd/CHANGES_2.4.39Broken LinkVendor Advisory
- http://www.openwall.com/lists/oss-security/2019/04/02/3Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2019/07/26/7Mailing List
- http://www.securityfocus.com/bid/107666Broken LinkThird Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHBA-2019:0959Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:0746Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:0980Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1296Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1297Third Party Advisory
FAQ
What is CVE-2019-0211?
CVE-2019-0211 is a vulnerability with a CVSS score of 7.8 (HIGH). In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process script...
How severe is CVE-2019-0211?
CVE-2019-0211 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-0211?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Http Server, Fedoraproject Fedora, Canonical Ubuntu Linux, Debian Debian Linux, Opensuse Leap.