HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-mod_md | May 4, 2022 | Aug 15, 2019 | |
| Alpine Linux | alpine-linux-upgrade-apache2 | Aug 22, 2024 | Aug 15, 2019 | |
| Amazon_linux | — | amazon-linux-upgrade-httpd24 | Oct 26, 2019 | Aug 15, 2019 |
| Apache Httpd | View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗ | apache-httpd-upgrade-latest | Aug 16, 2019 | Aug 15, 2019 |
| Centos_linux | — | centos-upgrade-httpdcentos-upgrade-httpd-debuginfocentos-upgrade-httpd-debugsourcecentos-upgrade-httpd-develcentos-upgrade-httpd-filesystemcentos-upgrade-httpd-manualcentos-upgrade-httpd-toolscentos-upgrade-httpd-tools-debuginfocentos-upgrade-mod_http2centos-upgrade-mod_http2-debuginfocentos-upgrade-mod_http2-debugsourcecentos-upgrade-mod_ldapcentos-upgrade-mod_ldap-debuginfocentos-upgrade-mod_mdcentos-upgrade-mod_md-debuginfocentos-upgrade-mod_md-debugsourcecentos-upgrade-mod_proxy_htmlcentos-upgrade-mod_proxy_html-debuginfocentos-upgrade-mod_sessioncentos-upgrade-mod_session-debuginfocentos-upgrade-mod_sslcentos-upgrade-mod_ssl-debuginfo | Nov 5, 2020 | Aug 15, 2019 |
| Debian | debian-upgrade-apache2 | Aug 28, 2019 | Aug 15, 2019 | |
| Freebsd | freebsd-upgrade-package-apache24 | Aug 18, 2019 | Aug 17, 2019 | |
| Gentoo Linux | gentoo-linux-upgrade-www-servers-apache | Sep 9, 2019 | Aug 15, 2019 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-httpdhuawei-euleros-2_0_sp8-upgrade-httpd-develhuawei-euleros-2_0_sp8-upgrade-httpd-filesystemhuawei-euleros-2_0_sp8-upgrade-httpd-manualhuawei-euleros-2_0_sp8-upgrade-httpd-toolshuawei-euleros-2_0_sp8-upgrade-mod_sessionhuawei-euleros-2_0_sp8-upgrade-mod_ssl | Feb 26, 2020 | Aug 15, 2019 | |
| Ibm Http_server | — | ibm-http_server-apply-fix-pack-9_0_5_1 | Nov 5, 2019 | Aug 15, 2019 |
| Oracle Solaris | oracle-solaris-11-4-upgrade-web-server-apache-24-2-4-41-11-4-14-0-1-1-0oracle-solaris-11-4-upgrade-web-server-apache-24-module-apache-dbd-2-4-41-11-4-14-0-1-1-0oracle-solaris-11-4-upgrade-web-server-apache-24-module-apache-gss-2-4-41-11-4-14-0-1-1-0oracle-solaris-11-4-upgrade-web-server-apache-24-module-apache-ldap-2-4-41-11-4-14-0-1-1-0oracle-solaris-11-4-upgrade-web-server-apache-24-module-apache-lua-2-4-41-11-4-14-0-1-1-0oracle-solaris-11-4-upgrade-web-server-apache-24-module-apache-ssl-2-4-41-11-4-14-0-1-1-0oracle-solaris-11-4-upgrade-web-server-apache-24-module-apache-ssl-fips-140-2-4-41-11-4-14-0-1-1-0 | Oct 16, 2019 | Aug 15, 2019 | |
| Oracle_linux | — | oracle-linux-upgrade-httpdoracle-linux-upgrade-httpd-develoracle-linux-upgrade-httpd-filesystemoracle-linux-upgrade-httpd-manualoracle-linux-upgrade-httpd-toolsoracle-linux-upgrade-mod-http2oracle-linux-upgrade-mod-ldaporacle-linux-upgrade-mod-mdoracle-linux-upgrade-mod-proxy-htmloracle-linux-upgrade-mod-sessionoracle-linux-upgrade-mod-ssl | Nov 12, 2020 | Aug 14, 2019 |
| Redhat_linux | redhat-upgrade-httpdredhat-upgrade-httpd-debuginforedhat-upgrade-httpd-debugsourceredhat-upgrade-httpd-develredhat-upgrade-httpd-filesystemredhat-upgrade-httpd-manualredhat-upgrade-httpd-toolsredhat-upgrade-httpd-tools-debuginforedhat-upgrade-mod_http2redhat-upgrade-mod_http2-debuginforedhat-upgrade-mod_http2-debugsourceredhat-upgrade-mod_ldapredhat-upgrade-mod_ldap-debuginforedhat-upgrade-mod_mdredhat-upgrade-mod_md-debuginforedhat-upgrade-mod_md-debugsourceredhat-upgrade-mod_proxy_htmlredhat-upgrade-mod_proxy_html-debuginforedhat-upgrade-mod_sessionredhat-upgrade-mod_session-debuginforedhat-upgrade-mod_sslredhat-upgrade-mod_ssl-debuginfo | Nov 5, 2020 | Aug 15, 2019 | |
| Rocky_linux | rocky-upgrade-mod_mdrocky-upgrade-mod_md-debuginforocky-upgrade-mod_md-debugsource | Mar 12, 2024 | Aug 15, 2019 | |
| Suse | — | suse-upgrade-apache2suse-upgrade-apache2-develsuse-upgrade-apache2-docsuse-upgrade-apache2-eventsuse-upgrade-apache2-example-pagessuse-upgrade-apache2-preforksuse-upgrade-apache2-utilssuse-upgrade-apache2-worker | Sep 3, 2019 | Aug 15, 2019 |
| Ubuntu | ubuntu-upgrade-apache2ubuntu-upgrade-apache2-bin | Aug 30, 2019 | Aug 15, 2019 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Aug 15, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub