CVE-2019-10082: Use After Free
A read-after-free vulnerability was discovered in Apache httpd, in modhttp2. A specially crafted http/2 client session could cause the server to read memory that was previously freed during connection shutdown, potentially leading to a crash.
Other sources
A vulnerability was found in httpd, where using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection shutdown.
— Red Hat
In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection shutdown.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/jbcs-httpd24-aprto a version that resolves this vulnerability.Fixed in 0:1.6.3-86.jbcs.el6 - Upgrade
Upgrade
redhat/jbcs-httpd24-brotlito a version that resolves this vulnerability.Fixed in 0:1.0.6-21.jbcs.el6 - Upgrade
Upgrade
redhat/jbcs-httpd24-httpdto a version that resolves this vulnerability.Fixed in 0:2.4.37-52.jbcs.el6 - Upgrade
Upgrade
redhat/jbcs-httpd24-opensslto a version that resolves this vulnerability.Fixed in 1:1.1.1c-16.jbcs.el6 - Upgrade
Upgrade
redhat/jbcs-httpd24-aprto a version that resolves this vulnerability.Fixed in 0:1.6.3-86.jbcs.el7 - Upgrade
Upgrade
redhat/jbcs-httpd24-brotlito a version that resolves this vulnerability.Fixed in 0:1.0.6-21.jbcs.el7 - Upgrade
Upgrade
redhat/jbcs-httpd24-httpdto a version that resolves this vulnerability.Fixed in 0:2.4.37-52.jbcs.el7 - Upgrade
Upgrade
redhat/jbcs-httpd24-opensslto a version that resolves this vulnerability.Fixed in 1:1.1.1c-16.jbcs.el7 - Upgrade
Upgrade
debian/apache2to a version that resolves this vulnerability.Fixed in 2.4.62-1~deb11u1Fixed in 2.4.66-1~deb11u1Fixed in 2.4.66-1~deb12u1Fixed in 2.4.62-1~deb12u2Fixed in 2.4.66-1~deb13u2Fixed in 2.4.66-8 - Upgrade
Upgrade
redhat/httpdto a version that resolves this vulnerability.Fixed in 2.4.41 - Configuration
Disable the h2 and h2c protocols by removing them from the Protocols list in the Apache httpd configuration.
Apache httpd mod_http2 Protocols = Disable h2 and h2c
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-10082?
CVE-2019-10082 is a read-after-free vulnerability in Apache httpd, in mod_http2, which could result in a crash.
What is the severity of CVE-2019-10082?
The severity of CVE-2019-10082 is medium with a CVSS score of 6.5.
Which software versions are affected by CVE-2019-10082?
The Apache HTTP Server versions 2.4.18-2.4.39 are affected by CVE-2019-10082.
How can I fix CVE-2019-10082?
To fix CVE-2019-10082, you should update your Apache HTTP Server to version 2.4.41 or higher.
Where can I find more information about CVE-2019-10082?
You can find more information about CVE-2019-10082 on the Red Hat Bugzilla page.