CVE-2016-4979: High severity Apache HTTP Server vulnerability
The Apache HTTP Server 2.4.18 through 2.4.20, when modhttp2 and modssl are enabled, does not properly recognize the "SSLVerifyClient require" directive for HTTP/2 request authorization, which allows remote attackers to bypass intended access restrictions by leveraging the ability to send multiple requests over a single connection and aborting a renegotiation.
Other sources
The Apache HTTPD web server (from 2.4.18/r1715255 up to 2.4.23/r1750779) did not validate a X509 client certificate correctly when HTTP/2 is used to access a resource.
As a result - a resource thought to be secure and requiring a valid client certificate - would be accessible without authentication provided that the modhttp2 was loaded, h2 or h2c activated, that that the browser used the HTTP/2 protocol and it would do more than one request over a given connection. A third party can gain access to resources on the web server without the requisite credentials. This can then lead to unauthorised disclosure of information.
This issue has been fixed in version 2.4.23 (r1750779).
As a temporary workaround - HTTP/2 can be disabled by changing the configuration by removing h2 and h2c from the Protocols line(s) in the configuration file.
The resulting line should read:
Protocols http/1.1
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/httpdto a version that resolves this vulnerability.Fixed in 2.4.23 - Upgrade
Upgrade
Apache HTTP Serverto a version that resolves this vulnerability.Fixed in 2.4.23Patch r1750779 - Configuration
As a temporary workaround, disable HTTP/2 by removing 'h2' and 'h2c' from the Protocols line(s) in the Apache configuration file (the resulting line should read 'Protocols http/1.1').
Apache HTTP Server (mod_http2) Protocols (remove h2 and h2c) = Protocols http/1.1
Event History
Frequently Asked Questions
What is the severity of CVE-2016-4979?
CVE-2016-4979 is considered a moderate severity vulnerability that allows bypass of access restrictions.
How do I fix CVE-2016-4979?
To fix CVE-2016-4979, upgrade Apache HTTP Server to version 2.4.23 or later.
What systems are affected by CVE-2016-4979?
CVE-2016-4979 affects Apache HTTP Server versions 2.4.18 through 2.4.20 with mod_http2 and mod_ssl enabled.
What types of attacks can exploit CVE-2016-4979?
CVE-2016-4979 can be exploited by remote attackers to bypass client verification restrictions.
Is CVE-2016-4979 related to SSL/TLS security?
Yes, CVE-2016-4979 is related to SSL/TLS security as it involves the misuse of SSLVerifyClient in HTTP/2 requests.