Actively exploited · Published Apr 8, 2019 · Assigned by apache
CVE-2019-0211
High 7.8 Exploited
In plain English
A high-severity use-after-free in Apache HTTP Server from Apache. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 65.0% (higher than 99.3% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)65.0%top 0.7% of all CVEs
Exploited in the wildYesCISA KEV since Nov 3, 2021
Attack tooling1Public PoC
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by May 3, 2022.
Official description
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | apache2 | 2.4.39-r0 | ALPINE-CVE-2019-0211 |
| Alpine:v3.21 | apache2 | 2.4.39-r0 | ALPINE-CVE-2019-0211 |
| Alpine:v3.22 | apache2 | 2.4.39-r0 | ALPINE-CVE-2019-0211 |
| Alpine:v3.23 | apache2 | 2.4.39-r0 | ALPINE-CVE-2019-0211 |
| Alpine:v3.24 | apache2 | 2.4.39-r0 | ALPINE-CVE-2019-0211 |
| Debian:12 | apache2 | 2.4.38-3 | DEBIAN-CVE-2019-0211 |
| Debian:13 | apache2 | 2.4.38-3 | DEBIAN-CVE-2019-0211 |
| Debian:14 | apache2 | 2.4.38-3 | DEBIAN-CVE-2019-0211 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache | Apache HTTP Server | 2.4.17 to 2.4.38 |
Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- [oss-security] 20190401 CVE-2019-0211: Apache HTTP Server privilege escalation from modules' scripts mailing-list, x_refsource_MLIST
- 107666 vdb-entry, x_refsource_BID
- 20190403 [SECURITY] [DSA 4422-1] apache2 security update mailing-list, x_refsource_BUGTRAQ
- https://www.synology.com/security/advisory/Synology_SA_19_14 x_refsource_CONFIRM
- http://packetstormsecurity.com/files/152386/Apache-2.4.38-Root-Privilege-Escalation.html x_refsource_MISC
- USN-3937-1 vendor-advisory, x_refsource_UBUNTU
- FEDORA-2019-cf7695b470 vendor-advisory, x_refsource_FEDORA
- DSA-4422 vendor-advisory, x_refsource_DEBIAN
- [httpd-users] 20190406 [users@httpd] CVE-2019-0211/0215/0217 mailing-list, x_refsource_MLIST
- FEDORA-2019-119b14075a vendor-advisory, x_refsource_FEDORA
- 20190407 [slackware-security] httpd (SSA:2019-096-01) mailing-list, x_refsource_BUGTRAQ
- 46676 exploit, x_refsource_EXPLOIT-DB
- https://httpd.apache.org/security/vulnerabilities_24.html x_refsource_MISC
- http://packetstormsecurity.com/files/152415/Slackware-Security-Advisory-httpd-Updates.html x_refsource_MISC
- http://packetstormsecurity.com/files/152441/CARPE-DIEM-Apache-2.4.x-Local-Privilege-Escalation.html x_refsource_MISC
- http://www.apache.org/dist/httpd/CHANGES_2.4.39 x_refsource_MISC
- [community-dev] 20190411 CVE-2019-0211 applicable to versions 2.2.x? mailing-list, x_refsource_MLIST
- [community-dev] 20190411 Re: CVE-2019-0211 applicable to versions 2.2.x? mailing-list, x_refsource_MLIST
- RHSA-2019:0746 vendor-advisory, x_refsource_REDHAT
- openSUSE-SU-2019:1190 vendor-advisory, x_refsource_SUSE
- [community-dev] 20190411 RE: CVE-2019-0211 applicable to versions 2.2.x? mailing-list, x_refsource_MLIST
- https://support.f5.com/csp/article/K32957101 x_refsource_CONFIRM
- openSUSE-SU-2019:1209 vendor-advisory, x_refsource_SUSE
- GLSA-201904-20 vendor-advisory, x_refsource_GENTOO
- https://security.netapp.com/advisory/ntap-20190423-0001/ x_refsource_CONFIRM
- openSUSE-SU-2019:1258 vendor-advisory, x_refsource_SUSE
- RHSA-2019:0980 vendor-advisory, x_refsource_REDHAT
- RHBA-2019:0959 vendor-advisory, x_refsource_REDHAT
- FEDORA-2019-a4ed7400f4 vendor-advisory, x_refsource_FEDORA
- RHSA-2019:1297 vendor-advisory, x_refsource_REDHAT
- RHSA-2019:1296 vendor-advisory, x_refsource_REDHAT
- [httpd-cvs] 20190611 svn commit: r1861068 - /httpd/site/trunk/content/security/vulnerabilities-httpd.xml mailing-list, x_refsource_MLIST
- RHSA-2019:1543 vendor-advisory, x_refsource_REDHAT
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html x_refsource_MISC
- [oss-security] 20190726 Re: Statistics for distros lists updated for 2019Q2 mailing-list, x_refsource_MLIST
- [httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list, x_refsource_MLIST
- [httpd-cvs] 20190815 svn commit: r1048742 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html mailing-list, x_refsource_MLIST
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03950en_us x_refsource_CONFIRM
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html x_refsource_MISC
- [announce] 20200131 Apache Software Foundation Security Report: 2019 mailing-list, x_refsource_MLIST