openSUSE Leap 42.3: 2019:1190-1 Important Apache2 Access Control Flaws

This update for apache2 fixes the following issues:

* CVE-2019-0220: The Apache HTTP server did not use a consistent strategy

for URL normalization throughout all of its components. In particular,

consecutive slashes were not always collapsed. Attackers could

potentially abuse these inconsistencies to by-pass access control

mechanisms and thus gain unauthorized access to protected parts of the

service. [bsc#1131241]

* CVE-2019-0217: A race condition in Apache's "mod_auth_digest" when

running in a threaded server could have allowed users with valid

credentials to authenticate using another username, bypassing configured

access control restrictions. [bsc#1131239]

* CVE-2019-0211: A flaw in the Apache HTTP Server allowed less-privileged

child processes or threads to execute arbitrary code with the privileges

of the parent process. Attackers with control over CGI scripts or

extension modules run by the server could have...