Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

apache http server 2.4.34 vulnerabilities and exploits

(subscribe to this query)
5.3
CVSSv3
CVE-2018-17189
In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections.
Apache Http Server 2.4.20Apache Http Server 2.4.23Apache Http Server 2.4.25Apache Http Server 2.4.26Apache Http Server 2.4.18Apache Http Server 2.4.17Apache Http Server 2.4.27Apache Http Server 2.4.29Apache Http Server 2.4.28Apache Http Server 2.4.33Apache Http Server 2.4.37Apache Http Server 2.4.30Apache Http Server 2.4.34Apache Http Server 2.4.35Netapp Santricity Cloud Connector -Netapp Storage Automation Store -Fedoraproject Fedora 28Fedoraproject Fedora 29Debian Debian Linux 9.0Oracle Retail Xstore Point Of Service 7.1Oracle Retail Xstore Point Of Service 7.0Oracle Hospitality Guest Access 4.2.0
7.2
CVSSv3
CVE-2019-10097
In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could trigger a stack buffer overflow or NULL pointer deference. This vulnerability could only b...
Apache Http Server 2.4.33Apache Http Server 2.4.37Apache Http Server 2.4.38Apache Http Server 2.4.34Apache Http Server 2.4.35Oracle Retail Xstore Point Of Service 7.1Oracle Enterprise Manager Ops Center 12.3.3Oracle Enterprise Manager Ops Center 12.4.0Oracle Instantis EnterprisetrackOracle Communications Element Manager 8.2.0Oracle Communications Element Manager 8.1.1Oracle Communications Element Manager 8.1.0Oracle Communications Element Manager 8.0.0Oracle Http Server 12.2.1.4.0Oracle Communications Session Report Manager 8.1.1Oracle Communications Session Report Manager 8.2.0Oracle Communications Session Report Manager 8.2.1Oracle Communications Session Route Manager 8.1.1Oracle Communications Session Route Manager 8.2.0Oracle Communications Session Route Manager 8.2.1
7.5
CVSSv3
CVE-2018-8011
By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used to DoS the server. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.33).
Apache Http Server 2.4.33Netapp Cloud Backup -
7.5
CVSSv3
CVE-2019-0215
In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions.
Apache Http Server 2.4.37Apache Http Server 2.4.38Fedoraproject Fedora 29Fedoraproject Fedora 30
5.3
CVSSv3
CVE-2019-0196
A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly.
Apache Http ServerCanonical Ubuntu Linux 16.04Canonical Ubuntu Linux 14.04Canonical Ubuntu Linux 18.04Canonical Ubuntu Linux 18.10Debian Debian Linux 9.0
7.8
CVSSv3
CVE-2019-0211
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent ...
Apache Http ServerFedoraproject Fedora 29Fedoraproject Fedora 30Canonical Ubuntu Linux 16.04Canonical Ubuntu Linux 14.04Canonical Ubuntu Linux 18.04Canonical Ubuntu Linux 18.10Debian Debian Linux 9.0Opensuse Leap 42.3Opensuse Leap 15.0
5.3
CVSSv3
CVE-2019-0220
A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes ('/'), directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects...
Apache Http ServerOpensuse Leap 42.3Opensuse Leap 15.0Debian Debian Linux 8.0Debian Debian Linux 9.0Fedoraproject Fedora 28Fedoraproject Fedora 29Fedoraproject Fedora 30Canonical Ubuntu Linux 16.04Canonical Ubuntu Linux 14.04Canonical Ubuntu Linux 18.04Canonical Ubuntu Linux 18.10
7.5
CVSSv3
CVE-2019-0217
In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.
Apache Http ServerDebian Debian Linux 8.0Debian Debian Linux 9.0Fedoraproject Fedora 28Fedoraproject Fedora 29Fedoraproject Fedora 30Canonical Ubuntu Linux 16.04Canonical Ubuntu Linux 14.04Canonical Ubuntu Linux 12.04Canonical Ubuntu Linux 18.04Canonical Ubuntu Linux 18.10Redhat Enterprise Linux Desktop 7.0Redhat Enterprise Linux Workstation 7.0Redhat Enterprise Linux Server 7.0Redhat Enterprise Linux -Opensuse Leap 42.3Opensuse Leap 15.0Netapp Clustered Data Ontap -Netapp Oncommand Unified Manager -Oracle Retail Xstore Point Of Service 7.1Oracle Retail Xstore Point Of Service 7.0Oracle Http Server 12.2.1.3.0
4.2
CVSSv3
CVE-2019-0197
A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration ...
Apache Http ServerCanonical Ubuntu Linux 18.04Canonical Ubuntu Linux 19.04Canonical Ubuntu Linux 16.04Fedoraproject Fedora 30Opensuse Leap 42.3Opensuse Leap 15.0Redhat Jboss Core Services 1.0Oracle Retail Xstore Point Of Service 7.1Oracle Retail Xstore Point Of Service 7.0Oracle Http Server 12.2.1.3.0Oracle Enterprise Manager Ops Center 12.3.3Oracle Instantis Enterprisetrack 17.1Oracle Instantis Enterprisetrack 17.2Oracle Instantis Enterprisetrack 17.3Oracle Enterprise Manager Ops Center 12.4.0Oracle Communications Session Report Manager 8.1.1Oracle Communications Session Report Manager 8.2.0Oracle Communications Session Route Manager 8.1.1Oracle Communications Session Route Manager 8.2.0Oracle Communications Session Route Manager 8.0.0Oracle Communications Session Route Manager 8.1.0
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-21111CVE-2024-32884IDORCVE-2023-1000CVE-2024-33260CVE-2024-3682reflected XSSrace conditionCVE-2024-3400
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook