RHSA-2019:2949: Important: httpd24-httpd and httpd24-nghttp2 security update
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.<br>Security Fix(es):<br><li> HTTP/2: large amount of data requests leads to denial of service (CVE-2019-9511)</li> <li> HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption (CVE-2019-9513)</li> <li> HTTP/2: request for large response leads to denial of service (CVE-2019-9517)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2019:2949?
The severity of RHSA-2019:2949 is classified as important due to the potential for denial of service attacks.
How do I fix RHSA-2019:2949?
To fix RHSA-2019:2949, update the affected httpd packages to version 2.4.34-8.el7.1 or later.
What vulnerabilities are addressed in RHSA-2019:2949?
RHSA-2019:2949 addresses vulnerabilities including CVE-2019-9511 related to denial of service in HTTP/2.
Which operating systems are affected by RHSA-2019:2949?
RHSA-2019:2949 affects multiple versions of Red Hat Enterprise Linux including EL6 and EL7.
Is there a workaround for RHSA-2019:2949?
There are no specific workarounds for RHSA-2019:2949, so updating the packages is the recommended course of action.