Apache · HTTP Server
CVE-2019-0211
Apache HTTP Server Privilege Escalation Vulnerability
Cos'è
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.
CISA: Apache HTTP Server, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute code with the privileges of the parent process (usually root) by manipulating the scoreboard.
Cosa fare
Apply updates per vendor instructions.
Scadenza per le agenzie federali USA: 3 maggio 2022
- Aggiunta all'elenco CISA
- 3 novembre 2021
- Pubblicato
- 8 aprile 2019
- Gravità
- Alta 7,8 CVSS 3.1
- Probabilità di attacchi nei prossimi 30 giorni (EPSS)
- 65% tra il 0,8% più alto di tutte le vulnerabilità note
- Tipo di debolezza
- CWE-416
- Più dettagli
- NVD · CVE.org · CISA
Tutte le fonti (20)
- https://usn.ubuntu.com/3937-1/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WETXNQWNQLWH…
- https://www.debian.org/security/2019/dsa-4422
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZRMTEIGZKYF…
- https://access.redhat.com/errata/RHSA-2019:0746
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.html
- http://www.openwall.com/lists/oss-security/2019/04/02/3
- http://www.securityfocus.com/bid/107666
- https://seclists.org/bugtraq/2019/Apr/5
- https://www.synology.com/security/advisory/Synology_SA_19_14
- http://packetstormsecurity.com/files/152386/Apache-2.4.38-Root-Privilege-Escalation.html
- https://lists.apache.org/thread.html/b1613d44ec364c87bb7ee8c5939949f9b061c05c06e0e90098ebf7aa%40%3Cusers.http…
- https://seclists.org/bugtraq/2019/Apr/16
- https://www.exploit-db.com/exploits/46676/
- https://httpd.apache.org/security/vulnerabilities_24.html
- http://packetstormsecurity.com/files/152415/Slackware-Security-Advisory-httpd-Updates.html
- http://packetstormsecurity.com/files/152441/CARPE-DIEM-Apache-2.4.x-Local-Privilege-Escalation.html
- http://www.apache.org/dist/httpd/CHANGES_2.4.39
- https://lists.apache.org/thread.html/890507b85c30adf133216b299cc35cd8cd0346a885acfc671c04694e%40%3Cdev.commun…
- https://lists.apache.org/thread.html/b2bdb308dc015e771ba79c0586b2de6fb50caa98b109833f5d4daf28%40%3Cdev.commun…
Altre falle sfruttate di Apache
| Aggiunto | Vulnerabilità | Prodotto | Gravità | Probabilità di attacco |
|---|---|---|---|---|
| 1 mag 2025 | Improper Escaping of Output | HTTP Server | Critica 9,1 | >99,9% |
| 3 nov 2021 | Path Traversal | HTTP Server | Alta 7,5 | >99,9% |
| 3 nov 2021 | Path Traversal | HTTP Server | Critica 9,8 | >99,9% |
| 8 ott 2026 | Command Injection | Struts | Alta 8,1 | 97% |
| 4 ago 2026 | Missing Encryption of Sensitive Data | Tomcat | Alta 7,5 | 99% |
| 16 apr 2026 | Improper Input Validation | ActiveMQ | Alta 8,8 | 98% |
| 1 apr 2025 | Path Equivalence | Tomcat | Critica 10,0 | 99,9% |
| 4 feb 2025 | Forced Browsing | OFBiz | Critica 9,8 | >99,9% |
Fonti: Known Exploited Vulnerabilities (CISA, pubblico dominio), CVE records (cve.org) e EPSS (FIRST). La probabilità di attacco è la stima EPSS che qualcuno provi a sfruttare la falla nei prossimi 30 giorni.