CVE-2019-10098: Medium severity Apache HTTP Server vulnerability
A vulnerability was discovered in Apache httpd, in modrewrite. Certain self-referential modrewrite rules could be fooled by encoded newlines, causing them to redirect to an unexpected location. An attacker could abuse this flaw in a phishing attack or as part of a client-side attack on browsers.
Other sources
A vulnerability was found in httpd where redirects configured with modrewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL.
— Red Hat
In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with modrewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/jbcs-httpd24-aprto a version that resolves this vulnerability.Fixed in 0:1.6.3-86.jbcs.el6 - Upgrade
Upgrade
redhat/jbcs-httpd24-brotlito a version that resolves this vulnerability.Fixed in 0:1.0.6-21.jbcs.el6 - Upgrade
Upgrade
redhat/jbcs-httpd24-httpdto a version that resolves this vulnerability.Fixed in 0:2.4.37-52.jbcs.el6 - Upgrade
Upgrade
redhat/jbcs-httpd24-opensslto a version that resolves this vulnerability.Fixed in 1:1.1.1c-16.jbcs.el6 - Upgrade
Upgrade
redhat/jbcs-httpd24-aprto a version that resolves this vulnerability.Fixed in 0:1.6.3-86.jbcs.el7 - Upgrade
Upgrade
redhat/jbcs-httpd24-brotlito a version that resolves this vulnerability.Fixed in 0:1.0.6-21.jbcs.el7 - Upgrade
Upgrade
redhat/jbcs-httpd24-httpdto a version that resolves this vulnerability.Fixed in 0:2.4.37-52.jbcs.el7 - Upgrade
Upgrade
redhat/jbcs-httpd24-opensslto a version that resolves this vulnerability.Fixed in 1:1.1.1c-16.jbcs.el7 - Upgrade
Upgrade
redhat/httpdto a version that resolves this vulnerability.Fixed in 0:2.4.6-95.el7 - Upgrade
Upgrade
redhat/httpd24-httpdto a version that resolves this vulnerability.Fixed in 0:2.4.34-18.el6 - Upgrade
Upgrade
redhat/httpd24-httpdto a version that resolves this vulnerability.Fixed in 0:2.4.34-18.el7 - Upgrade
Upgrade
debian/apache2to a version that resolves this vulnerability.Fixed in 2.4.62-1~deb11u1Fixed in 2.4.66-1~deb11u1Fixed in 2.4.66-1~deb12u1Fixed in 2.4.62-1~deb12u2Fixed in 2.4.66-1~deb13u2Fixed in 2.4.66-8 - Upgrade
Upgrade
redhat/httpdto a version that resolves this vulnerability.Fixed in 2.4.41 - Upgrade
Upgrade
ubuntu/apache2to a version that resolves this vulnerability.Fixed in 2.4.18-2ubuntu3.12 - Upgrade
Upgrade
ubuntu/apache2to a version that resolves this vulnerability.Fixed in 2.4.29-1ubuntu4.10 - Upgrade
Upgrade
ubuntu/apache2to a version that resolves this vulnerability.Fixed in 2.4.41-1ubuntu1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2019-10098?
CVE-2019-10098 is a vulnerability in Apache HTTP Server from version 2.4.0 to 2.4.39.
What is the severity of CVE-2019-10098?
The severity of CVE-2019-10098 is medium with a CVSS score of 6.1.
How does CVE-2019-10098 affect Apache HTTP Server?
CVE-2019-10098 affects Apache HTTP Server by allowing certain self-referential mod_rewrite rules to be fooled by encoded newlines, leading to redirection to an unexpected location.
How can CVE-2019-10098 be exploited?
CVE-2019-10098 can be exploited by attackers in phishing attacks or as part of client-side attacks on browsers.
Where can I find more information about CVE-2019-10098?
You can find more information about CVE-2019-10098 in the references provided: [1] [2] [3].