5
CVSSv2

CVE-2019-0190

Published: 30/01/2019 Updated: 13/05/2019
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9
VMScore: 445
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Summary

A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request that would cause mod_ssl to enter a loop leading to a denial of service. This bug can be only triggered with Apache HTTP Server version 2.4.37 when using OpenSSL version 1.1.1 or later, due to an interaction in changes to handling of renegotiation attempts.

Vulnerability Trend

Affected Products

Vendor Advisories

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem When the candidate has been publicized, the details for this candidate will be provided ...
Arch Linux Security Advisory ASA-201901-14 ========================================== Severity: High Date : 2019-01-24 CVE-ID : CVE-2018-17189 CVE-2018-17199 CVE-2019-0190 Package : apache Type : multiple issues Remote : Yes Link : securityarchlinuxorg/AVG-857 Summary ======= The package apache before version 2438-1 is vul ...
A bug exists in the way mod_ssl handled client renegotiations A remote attacker could send a carefully crafted request that would cause mod_ssl to enter a loop leading to a denial of service This bug can be only triggered with Apache HTTP Server version 2437 when using OpenSSL version 111 or later, due to an interaction in changes to handling ...
A bug exists in the way mod_ssl handled client renegotiations A remote attacker could send a carefully crafted request that would cause mod_ssl to enter a loop leading to a denial of service This bug can be only triggered with Apache HTTP Server version 2437 when using OpenSSL version 111 or later, due to an interaction in changes to handling ...
Oracle Solaris Third Party Bulletin - April 2019 Description The Oracle Solaris Third Party Bulletin announces patches for one or more security vulnerabilities fixed in third party software that is included in Oracle Solaris distributions Starting January 20, 2015, Third Party Bulletins are released on the same day when Oracle Critical ...
Apache HTTP Server has security vulnerabilities that allows a remote attacker to exploit the application Respective security vulnerabilities are discussed in detail in the subsequent sections ...

Mailing Lists

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] httpd (SSA:2019-022-01) New httpd packages are available for Slackware 140, 141, 142, and -current to fix security issues Here are the details from the Slackware 142 ChangeLog: +--------------------------+ patches/packages/httpd-2438-i586-1_slack142txz: Upgraded Th ...