CVE-2019-0215: High severity Apache HTTP Server vulnerability

Published Apr 2, 2019

Updated

In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in modssl when using per-location client certificate verification with TLSv1.3 allowed a client supporting Post-Handshake Authentication to bypass configured access control restrictions.

Other sources

In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in modssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions.

— MITRE

Affected Software

4 affected components

Apache HTTP Server=2.4.37

Apache HTTP Server=2.4.38

Fedoraproject Fedora=29

Fedoraproject Fedora=30

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache HTTP Server (2.4) mod_ssl to a version that resolves this vulnerability.
Fixed in 2.4.37
Upgrade
Upgrade Apache HTTP Server (2.4) mod_ssl to a version that resolves this vulnerability.
Fixed in 2.4.38

Event History

Apr 2, 2019

Data Sourced

via Red Hat·10:17 AM

DescriptionSeverityAffected Software

Apr 8, 2019

CVE Published

via MITRE·07:25 PM

Data Sourced

via MITRE·07:25 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2019-0215?

CVE-2019-0215 has been rated as high severity due to the potential for unauthorized access.

How do I fix CVE-2019-0215?

To fix CVE-2019-0215, upgrade Apache HTTP Server to version 2.4.39 or later.

Which versions are affected by CVE-2019-0215?

CVE-2019-0215 affects Apache HTTP Server versions 2.4.37 and 2.4.38.

What does CVE-2019-0215 exploit?

CVE-2019-0215 exploits a bug in mod_ssl related to per-location client certificate verification with TLSv1.3.

Can CVE-2019-0215 allow unauthorized access?

Yes, CVE-2019-0215 allows clients to bypass configured access control restrictions.