Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 433
Alerts This Week
Warning Icon 1 433

Debian 8: DLA-1748-1 Critical: Apache2 Access Control Flaws

debian lts
Calendar Grey April 3, 2019
Dist Debian Esm H88
The recent patch for Apache2 2.4.10-10+deb8u14 resolves various vulnerabilities for Debian LTS users.
Several vulnerabilities have been found in the Apache HTTP server
Topics%20covered

Topics Covered

security advisory critical debian access control race condition apache2

Summary

A race condition in mod_auth_digest when running in a threaded
server could allow a user with valid credentials to authenticate
using another username, bypassing configured access control
restrictions. The issue was discovered by Simon Kappel.

CVE-2019-0220

Bernhard Lorenz of Alpha Strike Labs GmbH reported that URL
normalizations were inconsistently handled. When the path component
of a request URL contains multiple consecutive slashes ('/'),
directives such as LocationMatch and RewriteRule must account for
duplicates in regular expressions while other aspects of the servers processing will implicitly collapse them.

For Debian 8 "Jessie", these problems have been fixed in version
2.4.10-10+deb8u14.

We recommend that you upgrade your apache2 packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


- --
Jonas Meurer


Severity
critical
Lowest
Low
Medium
High
Critical

Package: apache2
Version: 2.4.10-10+deb8u14
CVE ID: CVE-2019-0217 CVE-2019-0220

Topics%20covered

Topics Covered

security advisory critical debian access control race condition apache2

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.