Vulnerability Description
HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Http Server | >= 2.4.20, <= 2.4.39 |
| Debian | Debian Linux | 9.0 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00004.html
- https://httpd.apache.org/security/vulnerabilities_24.htmlExploitVendor Advisory
- https://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f60
- https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda
- https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46
- https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37
- https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f8
- https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa
- https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0
- https://lists.apache.org/thread.html/rd2fb621142e7fa187cfe12d7137bf66e7234abcbbc
- https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cac
- https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90b
- https://seclists.org/bugtraq/2019/Aug/47Third Party Advisory
- https://security.gentoo.org/glsa/201909-04
- https://security.netapp.com/advisory/ntap-20190905-0003/
FAQ
What is CVE-2019-10081?
CVE-2019-10081 is a vulnerability with a CVSS score of 7.5 (HIGH). HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copie...
How severe is CVE-2019-10081?
CVE-2019-10081 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-10081?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Http Server, Debian Debian Linux.