p PatchFirst

CVE-2019-10097

CVE-2019-10097

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could trigger a stack buffer overflow or NULL pointer deference. This vulnerability could only be triggered by a trusted proxy and not by untrusted HTTP clients.

CVSS 7.2 · High · EPSS 52.9% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • apache http server

    Versions
    • 2.4.32 to 2.4.39: Affected

    No fix published

  • apache2 Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.4.41-1

    Update to 2.4.41-1

  • apache2 Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.4.41-1

    Update to 2.4.41-1

  • apache2 Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.4.41-1

    Update to 2.4.41-1

Original sources

Check your server →