CVE-2019-0211

Vulnerability overview

In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.

Severity and scoring

CVSS score

7.8 · HIGH

CVSS version

3.1

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-416

CVSS measures technical severity; it does not establish whether this vulnerability is being exploited in your environment.

Known exploitation and remediation

Listed in CISA’s Known Exploited Vulnerabilities catalog.

Affected product

Apache · HTTP Server

Added to catalog

2021-11-03

Required action

Apply updates per vendor instructions.

CISA remediation due date

2022-05-03

CISA deadlines apply to the organizations covered by its directives. Confirm your own remediation requirements.

Verify affected versions and patch availability in the vendor advisory before making changes.

Affected products and versions

• cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*

  From (inclusive): 2.4.17

  Through (inclusive): 2.4.38

• cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*

• cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*

• cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*

• cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*

• cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*

• cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:esm:*:*:*

• cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*

• cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

• cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*

• cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*

• cpe:2.3:a:netapp:oncommand_unified_manager:-:*:*:*:*:7-mode:*:*

• cpe:2.3:a:redhat:jboss_core_services:1.0:*:*:*:*:*:*:*

• cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*

• cpe:2.3:a:redhat:openshift_container_platform_for_power:3.11_ppc64le:*:*:*:*:*:*:*

• cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*

• cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

• cpe:2.3:o:redhat:enterprise_linux_eus:8.1:*:*:*:*:*:*:*

• cpe:2.3:o:redhat:enterprise_linux_eus:8.2:*:*:*:*:*:*:*

• cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*

• cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*

• cpe:2.3:o:redhat:enterprise_linux_eus:8.8:*:*:*:*:*:*:*

• cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0_aarch64:*:*:*:*:*:*:*

• cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.1_aarch64:*:*:*:*:*:*:*

• cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.2_aarch64:*:*:*:*:*:*:*

• cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.4_aarch64:*:*:*:*:*:*:*

• cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.6_aarch64:*:*:*:*:*:*:*

• cpe:2.3:o:redhat:enterprise_linux_for_arm_64_eus:8.8_aarch64:*:*:*:*:*:*:*

• cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:*

• cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.1_s390x:*:*:*:*:*:*:*

• cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.2_s390x:*:*:*:*:*:*:*

• cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.4_s390x:*:*:*:*:*:*:*

• cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.6_s390x:*:*:*:*:*:*:*

• cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.8_s390x:*:*:*:*:*:*:*

• cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:*

• cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.1_ppc64le:*:*:*:*:*:*:*

• cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.2_ppc64le:*:*:*:*:*:*:*

• cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.4_ppc64le:*:*:*:*:*:*:*

• cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.6_ppc64le:*:*:*:*:*:*:*

• cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.8_ppc64le:*:*:*:*:*:*:*

• cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:*

• cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*

• cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:*

• cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:*

• cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*

• cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:*

• cpe:2.3:o:redhat:enterprise_linux_server_tus:8.8:*:*:*:*:*:*:*

• cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.0:*:*:*:*:*:*:*

• cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.1:*:*:*:*:*:*:*

• cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:*

• cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*

• cpe:2.3:o:redhat:enterprise_linux_update_services_for_sap_solutions:8.8:*:*:*:*:*:*:*

• cpe:2.3:a:oracle:communications_session_report_manager:8.0.0:*:*:*:*:*:*:*

• cpe:2.3:a:oracle:communications_session_report_manager:8.1.0:*:*:*:*:*:*:*

• cpe:2.3:a:oracle:communications_session_report_manager:8.1.1:*:*:*:*:*:*:*

• cpe:2.3:a:oracle:communications_session_report_manager:8.2.0:*:*:*:*:*:*:*

• cpe:2.3:a:oracle:communications_session_route_manager:8.0.0:*:*:*:*:*:*:*

• cpe:2.3:a:oracle:communications_session_route_manager:8.1.0:*:*:*:*:*:*:*

• cpe:2.3:a:oracle:communications_session_route_manager:8.1.1:*:*:*:*:*:*:*

• cpe:2.3:a:oracle:communications_session_route_manager:8.2.0:*:*:*:*:*:*:*

• cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:*

• cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:*:*:*:*:*:*:*

• cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:*

• cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*

• cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*

• cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*

• cpe:2.3:a:oracle:retail_xstore_point_of_service:7.0:*:*:*:*:*:*:*

• cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:*

These are NVD CPE applicability entries. Some products depend on configuration conditions; consult the official record to confirm applicability.

Advisories and references

• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.html

  Broken Link · Mailing List · Release Notes · Third Party Advisory

• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.html

  Broken Link · Mailing List · Release Notes · Third Party Advisory

• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00084.html

  Broken Link · Third Party Advisory

• http://packetstormsecurity.com/files/152386/Apache-2.4.38-Root-Privilege-Escalation.html

  Third Party Advisory · VDB Entry

• http://packetstormsecurity.com/files/152415/Slackware-Security-Advisory-httpd-Updates.html

  Exploit · Third Party Advisory · VDB Entry

• http://packetstormsecurity.com/files/152441/CARPE-DIEM-Apache-2.4.x-Local-Privilege-Escalation.html

  Exploit · Third Party Advisory · VDB Entry

• http://www.apache.org/dist/httpd/CHANGES_2.4.39

  Broken Link · Vendor Advisory

• http://www.openwall.com/lists/oss-security/2019/04/02/3

  Mailing List · Third Party Advisory

• http://www.openwall.com/lists/oss-security/2019/07/26/7

  Mailing List

• http://www.securityfocus.com/bid/107666

  Broken Link · Third Party Advisory · VDB Entry

• https://access.redhat.com/errata/RHBA-2019:0959

  Third Party Advisory

• https://access.redhat.com/errata/RHSA-2019:0746

  Third Party Advisory

• https://access.redhat.com/errata/RHSA-2019:0980

  Third Party Advisory

• https://access.redhat.com/errata/RHSA-2019:1296

  Third Party Advisory

• https://access.redhat.com/errata/RHSA-2019:1297

  Third Party Advisory

• https://access.redhat.com/errata/RHSA-2019:1543

  Third Party Advisory

• https://httpd.apache.org/security/vulnerabilities_24.html

  Vendor Advisory

• https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E

  Mailing List

• https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E

  Mailing List

• https://lists.apache.org/thread.html/890507b85c30adf133216b299cc35cd8cd0346a885acfc671c04694e%40%3Cdev.community.apache.org%3E

  Mailing List

• https://lists.apache.org/thread.html/b1613d44ec364c87bb7ee8c5939949f9b061c05c06e0e90098ebf7aa%40%3Cusers.httpd.apache.org%3E

  Mailing List

• https://lists.apache.org/thread.html/b2bdb308dc015e771ba79c0586b2de6fb50caa98b109833f5d4daf28%40%3Cdev.community.apache.org%3E

  Mailing List

• https://lists.apache.org/thread.html/de881a130bc9cb2f3a9ff220784520556884fb8ea80e69400a45509e%40%3Cdev.community.apache.org%3E

  Mailing List

• https://lists.apache.org/thread.html/fd110f4ace2d8364c7d9190e1993cde92f79e4eb85576ed9285686ac%40%3Ccvs.httpd.apache.org%3E

  Mailing List

• https://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d%40%3Ccvs.httpd.apache.org%3E

  Mailing List

• https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E

  Mailing List

• https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E

  Mailing List

• https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E

  Mailing List

• https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E

  Mailing List · Patch

• https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E

  Mailing List

• https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E

  Mailing List

• https://lists.apache.org/thread.html/rd2fb621142e7fa187cfe12d7137bf66e7234abcbbcd800074c84a538%40%3Ccvs.httpd.apache.org%3E

  Mailing List

• https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E

  Mailing List

• https://lists.apache.org/thread.html/re473305a65b4db888e3556e4dae10c2a04ee89dcff2e26ecdbd860a9%40%3Ccvs.httpd.apache.org%3E

  Mailing List

• https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

  Mailing List

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ALIR5S3O7NRHEGFMIDMUSYQIZOE4TJJN/

  Release Notes

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZRMTEIGZKYFNGIDOTXN3GNEJTLVCYU7/

  Release Notes

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WETXNQWNQLWHV6XNW6YTO5UGDTIWAQGT/

  Release Notes

• https://seclists.org/bugtraq/2019/Apr/16

  Mailing List · Patch · Third Party Advisory

• https://seclists.org/bugtraq/2019/Apr/5

  Mailing List · Third Party Advisory

• https://security.gentoo.org/glsa/201904-20

  Third Party Advisory

• https://security.netapp.com/advisory/ntap-20190423-0001/

  Third Party Advisory

• https://support.f5.com/csp/article/K32957101

  Third Party Advisory

• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03950en_us

  Third Party Advisory

• https://usn.ubuntu.com/3937-1/

  Third Party Advisory

• https://www.debian.org/security/2019/dsa-4422

  Mailing List · Third Party Advisory

• https://www.exploit-db.com/exploits/46676/

  Exploit · Third Party Advisory · VDB Entry

• https://www.oracle.com/security-alerts/cpuapr2020.html

  Patch · Third Party Advisory

• https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

  Patch · Third Party Advisory

• https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

  Patch · Third Party Advisory

• https://www.synology.com/security/advisory/Synology_SA_19_14

  Third Party Advisory

• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.html

  Broken Link · Mailing List · Release Notes · Third Party Advisory

• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.html

  Broken Link · Mailing List · Release Notes · Third Party Advisory

• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00084.html

  Broken Link · Third Party Advisory

• http://packetstormsecurity.com/files/152386/Apache-2.4.38-Root-Privilege-Escalation.html

  Third Party Advisory · VDB Entry

• http://packetstormsecurity.com/files/152415/Slackware-Security-Advisory-httpd-Updates.html

  Exploit · Third Party Advisory · VDB Entry

• http://packetstormsecurity.com/files/152441/CARPE-DIEM-Apache-2.4.x-Local-Privilege-Escalation.html

  Exploit · Third Party Advisory · VDB Entry

• http://www.apache.org/dist/httpd/CHANGES_2.4.39

  Broken Link · Vendor Advisory

• http://www.openwall.com/lists/oss-security/2019/04/02/3

  Mailing List · Third Party Advisory

• http://www.openwall.com/lists/oss-security/2019/07/26/7

  Mailing List

• http://www.securityfocus.com/bid/107666

  Broken Link · Third Party Advisory · VDB Entry

• https://access.redhat.com/errata/RHBA-2019:0959

  Third Party Advisory

• https://access.redhat.com/errata/RHSA-2019:0746

  Third Party Advisory

• https://access.redhat.com/errata/RHSA-2019:0980

  Third Party Advisory

• https://access.redhat.com/errata/RHSA-2019:1296

  Third Party Advisory

• https://access.redhat.com/errata/RHSA-2019:1297

  Third Party Advisory

• https://access.redhat.com/errata/RHSA-2019:1543

  Third Party Advisory

• https://httpd.apache.org/security/vulnerabilities_24.html

  Vendor Advisory

• https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E

  Mailing List

• https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E

  Mailing List

• https://lists.apache.org/thread.html/890507b85c30adf133216b299cc35cd8cd0346a885acfc671c04694e%40%3Cdev.community.apache.org%3E

  Mailing List

• https://lists.apache.org/thread.html/b1613d44ec364c87bb7ee8c5939949f9b061c05c06e0e90098ebf7aa%40%3Cusers.httpd.apache.org%3E

  Mailing List

• https://lists.apache.org/thread.html/b2bdb308dc015e771ba79c0586b2de6fb50caa98b109833f5d4daf28%40%3Cdev.community.apache.org%3E

  Mailing List

• https://lists.apache.org/thread.html/de881a130bc9cb2f3a9ff220784520556884fb8ea80e69400a45509e%40%3Cdev.community.apache.org%3E

  Mailing List

• https://lists.apache.org/thread.html/fd110f4ace2d8364c7d9190e1993cde92f79e4eb85576ed9285686ac%40%3Ccvs.httpd.apache.org%3E

  Mailing List

• https://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d%40%3Ccvs.httpd.apache.org%3E

  Mailing List

• https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E

  Mailing List

• https://lists.apache.org/thread.html/r6d03e45b81eab03580cf7f8bb51cb3e9a1b10a2cc0c6a2d3cc92ed0c%40%3Cannounce.apache.org%3E

  Mailing List

• https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E

  Mailing List

• https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E

  Mailing List · Patch

• https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E

  Mailing List

• https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E

  Mailing List

• https://lists.apache.org/thread.html/rd2fb621142e7fa187cfe12d7137bf66e7234abcbbcd800074c84a538%40%3Ccvs.httpd.apache.org%3E

  Mailing List

• https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E

  Mailing List

• https://lists.apache.org/thread.html/re473305a65b4db888e3556e4dae10c2a04ee89dcff2e26ecdbd860a9%40%3Ccvs.httpd.apache.org%3E

  Mailing List

• https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

  Mailing List

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ALIR5S3O7NRHEGFMIDMUSYQIZOE4TJJN/

  Release Notes

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZRMTEIGZKYFNGIDOTXN3GNEJTLVCYU7/

  Release Notes

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WETXNQWNQLWHV6XNW6YTO5UGDTIWAQGT/

  Release Notes

• https://seclists.org/bugtraq/2019/Apr/16

  Mailing List · Patch · Third Party Advisory

• https://seclists.org/bugtraq/2019/Apr/5

  Mailing List · Third Party Advisory

• https://security.gentoo.org/glsa/201904-20

  Third Party Advisory

• https://security.netapp.com/advisory/ntap-20190423-0001/

  Third Party Advisory

• https://support.f5.com/csp/article/K32957101

  Third Party Advisory

• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03950en_us

  Third Party Advisory

• https://usn.ubuntu.com/3937-1/

  Third Party Advisory

• https://www.debian.org/security/2019/dsa-4422

  Mailing List · Third Party Advisory

• https://www.exploit-db.com/exploits/46676/

  Exploit · Third Party Advisory · VDB Entry

• https://www.oracle.com/security-alerts/cpuapr2020.html

  Patch · Third Party Advisory

• https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html

  Patch · Third Party Advisory

• https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

  Patch · Third Party Advisory

• https://www.synology.com/security/advisory/Synology_SA_19_14

  Third Party Advisory

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0211

  US Government Resource

Explore official sources

Read the official NVD record ↗

Explore the CISA catalog ↗

Back to CVE intelligence