CVE-2019-10081
Summary
| CVE | CVE-2019-10081 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2019-08-15 22:15:00 UTC |
| Updated | 2023-11-07 03:02:00 UTC |
| Description | HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client. |
Risk And Classification
Problem Types: CWE-787
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Apache | Http Server | All | All | All | All |
| Operating System | Debian | Debian Linux | 10.0 | All | All | All |
| Operating System | Debian | Debian Linux | 9.0 | All | All | All |
| Operating System | Debian | Debian Linux | 10.0 | All | All | All |
| Operating System | Debian | Debian Linux | 9.0 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | MLIST | lists.apache.org | |
| Pony Mail! | MLIST | lists.apache.org | |
| Pony Mail! | MLIST | lists.apache.org | |
| Pony Mail! | lists.apache.org | ||
| Debian -- Security Information -- DSA-4509-1 apache2 | DEBIAN | www.debian.org | Third Party Advisory |
| myF5 | support.f5.com | ||
| September 2019 Apache HTTP Server Vulnerabilities in NetApp Products | NetApp Product Security | CONFIRM | security.netapp.com | |
| Oracle Critical Patch Update Advisory - July 2020 | MISC | www.oracle.com | |
| Pony Mail! | MLIST | lists.apache.org | |
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | MLIST | lists.apache.org | |
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | lists.apache.org | ||
| USN-4113-1: Apache HTTP Server vulnerabilities | Ubuntu security notices | Ubuntu | UBUNTU | usn.ubuntu.com | |
| Pony Mail! | lists.apache.org | ||
| support.f5.com/csp/article/K84341091 | CONFIRM | support.f5.com | |
| Apache HTTP Server 2.4 vulnerabilities - The Apache HTTP Server Project | MISC | httpd.apache.org | Exploit, Vendor Advisory |
| Pony Mail! | MLIST | lists.apache.org | |
| Pony Mail! | MLIST | lists.apache.org | |
| Apache: Multiple vulnerabilities (GLSA 201909-04) — Gentoo security | GENTOO | security.gentoo.org | |
| Pony Mail! | MLIST | lists.apache.org | |
| Oracle Critical Patch Update - October 2019 | MISC | www.oracle.com | |
| Pony Mail! | lists.apache.org | ||
| Oracle Critical Patch Update Advisory - April 2020 | N/A | www.oracle.com | |
| Pony Mail! | MLIST | lists.apache.org | |
| Pony Mail! | lists.apache.org | ||
| Bugtraq: [SECURITY] [DSA 4509-1] apache2 security update | BUGTRAQ | seclists.org | Third Party Advisory |
| [security-announce] openSUSE-SU-2019:2051-1: important: Security update | SUSE | lists.opensuse.org | |
| Pony Mail! | MLIST | lists.apache.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.