Bugzilla – Bug 1131245
VUL-0: CVE-2019-0197: apache2: mod_http2, possible crash on late upgrade
Last modified: 2021-01-12 12:15:50 UTC
Forward from of a bug report received via the OSS-security mailing list: CVE-2019-0197: mod_http2, possible crash on late upgrade Severity: Low Vendor: The Apache Software Foundation Versions Affected: httpd 2.4.34 to 2.4.38 Description: When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Servers that never enabled the h2 protocol or only enabled it for https: and did not set"H2Upgrade on" are unaffected by this issue. Mitigation: All httpd users deploying mod_http2 should upgrade to 2.4.39 or later. Credit: The issue was discovered by Stefan Eissing, greenbytes.de. References: https://httpd.apache.org/security/vulnerabilities_24.html
Submitted for 15/apache2 and 12sp2/apache2. I believe all fixed.
SUSE-SU-2019:0873-1: An update that fixes 5 vulnerabilities is now available. Category: security (important) Bug References: 1131233,1131237,1131239,1131241,1131245 CVE References: CVE-2019-0196,CVE-2019-0197,CVE-2019-0211,CVE-2019-0217,CVE-2019-0220 Sources used: SUSE Linux Enterprise Module for Server Applications 15 (src): apache2-2.4.33-3.15.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 (src): apache2-2.4.33-3.15.1 *** NOTE: This information is not intended to be used for external communication, because this may only be a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2019:0878-1: An update that fixes 5 vulnerabilities is now available. Category: security (important) Bug References: 1131233,1131237,1131239,1131241,1131245 CVE References: CVE-2019-0196,CVE-2019-0197,CVE-2019-0211,CVE-2019-0217,CVE-2019-0220 Sources used: SUSE OpenStack Cloud 7 (src): apache2-2.4.23-29.40.1 SUSE Linux Enterprise Software Development Kit 12-SP4 (src): apache2-2.4.23-29.40.1 SUSE Linux Enterprise Software Development Kit 12-SP3 (src): apache2-2.4.23-29.40.1 SUSE Linux Enterprise Server for SAP 12-SP2 (src): apache2-2.4.23-29.40.1 SUSE Linux Enterprise Server 12-SP4 (src): apache2-2.4.23-29.40.1 SUSE Linux Enterprise Server 12-SP3 (src): apache2-2.4.23-29.40.1 SUSE Linux Enterprise Server 12-SP2-LTSS (src): apache2-2.4.23-29.40.1 SUSE Linux Enterprise Server 12-SP2-BCL (src): apache2-2.4.23-29.40.1 SUSE Enterprise Storage 4 (src): apache2-2.4.23-29.40.1 *** NOTE: This information is not intended to be used for external communication, because this may only be a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2019:1190-1: An update that fixes 5 vulnerabilities is now available. Category: security (important) Bug References: 1131233,1131237,1131239,1131241,1131245 CVE References: CVE-2019-0196,CVE-2019-0197,CVE-2019-0211,CVE-2019-0217,CVE-2019-0220 Sources used: openSUSE Leap 42.3 (src): apache2-2.4.23-45.1
openSUSE-SU-2019:1209-1: An update that fixes 5 vulnerabilities is now available. Category: security (important) Bug References: 1131233,1131237,1131239,1131241,1131245 CVE References: CVE-2019-0196,CVE-2019-0197,CVE-2019-0211,CVE-2019-0217,CVE-2019-0220 Sources used: openSUSE Leap 15.0 (src): apache2-2.4.33-lp150.2.17.1
openSUSE-SU-2019:1258-1: An update that fixes 5 vulnerabilities is now available. Category: security (important) Bug References: 1131233,1131237,1131239,1131241,1131245 CVE References: CVE-2019-0196,CVE-2019-0197,CVE-2019-0211,CVE-2019-0217,CVE-2019-0220 Sources used: openSUSE Leap 42.3 (src): apache2-2.4.23-49.1
done