openSUSE 15.0: 2019:1209-1 Significant Apache2 Denial of Service Threats

This update for apache2 fixes the following issues:

* CVE-2019-0211: A flaw in the Apache HTTP Server allowed less-privileged

child processes or threads to execute arbitrary code with the privileges

of the parent process. Attackers with control over CGI scripts or

extension modules run by the server could have abused this issue to

potentially gain super user privileges. [bsc#1131233]

* CVE-2019-0220: The Apache HTTP server did not use a consistent strategy

for URL normalization throughout all of its components. In particular,

consecutive slashes were not always collapsed. Attackers could

potentially abuse these inconsistencies to by-pass access control

mechanisms and thus gain unauthorized access to protected parts of the

service. [bsc#1131241]

* CVE-2019-0217: A race condition in Apache's "mod_auth_digest" when

running in a threaded server could have allowed users with valid

credentials to authenticate using...