SUSE Linux Enterprise 12 Critical Advisory: Apache2 Access Control Bypass
suse
April 4, 2019
An update that fixes 5 vulnerabilities is now available
Summary
This update for apache2 fixes the following issues: * CVE-2019-0220: The Apache HTTP server did not use a consistent strategy for URL normalization throughout all of its components. In particular, consecutive slashes were not always collapsed. Attackers could potentially abuse these inconsistencies to by-pass access control mechanisms and thus gain unauthorized access to protected parts of the service. [bsc#1131241] * CVE-2019-0217: A race condition in Apache's "mod_auth_digest" when running in a threaded server could have allowed users with valid credentials to authenticate using another username, bypassing configured access control restrictions. [bsc#1131239] * CVE-2019-0211: A flaw in the Apache HTTP Server allowed less-privileged
References
#1131233 #1131237 #1131239 #1131241 #1131245
Cross- CVE-2019-0196 CVE-2019-0197 CVE-2019-0211
CVE-2019-0217 CVE-2019-0220
Affected Products:
SUSE OpenStack Cloud 7
SUSE Linux Enterprise Software Development Kit 12-SP4
SUSE Linux Enterprise Software Development Kit 12-SP3
SUSE Linux Enterprise Server for SAP 12-SP2
SUSE Linux Enterprise Server 12-SP4
SUSE Linux Enterprise Server 12-SP3
SUSE Linux Enterprise Server 12-SP2-LTSS
SUSE Linux Enterprise Server 12-SP2-BCL
SUSE Enterprise Storage 4
https://www.suse.com/security/cve/CVE-2019-0196.html
https://www.suse.com/security/cve/CVE-2019-0197.html
https://www.suse.com/security/cve/CVE-2019-0211.html
https://www.suse.com/security/cve/CVE-2019-0217.html
https://www.suse.com/security/cve/CVE-2019-0220.html
PREVIOUS
NEXT
Severity
important
Lowest
Low
Medium
High
Critical
Announcement ID: SUSE-SU-2019:0878-1
Rating: important
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Related News
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!