Vulnerability in Apache HTTP Server
CVE-2019-0190
A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request that would cause mod_ssl to enter a loop leading to a denial of service. This bug can be only triggered with Apache HTTP Server version 2.4.37 when using OpenSSL version 1.1.1 or later, due to an interaction in changes to handling of renegotiation attempts.
EPSS: 0.591 (99.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Apache Http_server — versions 2.4.37
- Apache Software Foundation Http Server — versions Apache HTTP Server 2.4.37
- Openssl
- Oracle Enterprise_manager_ops_center — versions 12.3.3
- Oracle Hospitality_guest_access — versions 4.2.0, 4.2.1
- Oracle Instantis_enterprisetrack — versions 17.1, 17.2, 17.3
- Oracle Retail_xstore_point_of_service — versions 7.0, 7.1
Public proof-of-concept exploits
References
- security@apache.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- security@apache.org (vendor-advisory, Third Party Advisory, x_refsource_GENTOO)
- security@apache.org (mailing-list, x_refsource_MLIST)
- security@apache.org (mailing-list, x_refsource_MLIST)
- security@apache.org (mailing-list, x_refsource_MLIST)
- security@apache.org (mailing-list, x_refsource_MLIST)
- security@apache.org (Third Party Advisory, x_refsource_MISC)
- security@apache.org (Third Party Advisory, x_refsource_MISC)
- security@apache.org (x_refsource_CONFIRM, Vendor Advisory)
- security@apache.org (mailing-list, x_refsource_MLIST)
Frequently asked questions
- What is CVE-2019-0190?
- CVE-2019-0190 is a high-severity vulnerability in Apache HTTP Server. CVSS score: 7.5/10. Published 2019-01-30.
- How severe is CVE-2019-0190?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2019-0190 known to be exploited?
- 8 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.