CVE-2019-0197: Medium severity Apache HTTP Server vulnerability
A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set "H2Upgrade on" are unaffected by this issue.
Other sources
When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. A server that never enabled the h2 protocol or that only enabled it for https: and did not configure the "H2Upgrade on" is unaffected by this.
— Red Hat
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-0197?
The severity of CVE-2019-0197 is rated as high due to its potential to cause server crashes.
How do I fix CVE-2019-0197?
To fix CVE-2019-0197, upgrade your Apache HTTP Server to version 2.4.39 or later.
Which versions of Apache HTTP Server are affected by CVE-2019-0197?
CVE-2019-0197 affects Apache HTTP Server versions 2.4.34 to 2.4.38.
What types of systems are vulnerable to CVE-2019-0197?
Systems running Apache HTTP Server with HTTP/2 protocol enabled are vulnerable to CVE-2019-0197.
Is there a workaround for CVE-2019-0197 if immediate patching is not possible?
Disabling the HTTP/2 protocol or H2Upgrade can serve as a temporary workaround for CVE-2019-0197.