CVE-2019-0217

HIGH7.5EPSS 43.0%

apache2 - security update

Published: 4/8/2019Modified: 4/28/2026

Description

In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.

Affected packages (3)

Alpine/apache2from 0, < 2.4.39-r0
Debian/apache2from 0, < 2.4.38-3
Debian/apache2from 0, < 2.4.10-10+deb8u14

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References (2)

ADVISORYhttps://security.alpinelinux.org/vuln/CVE-2019-0217
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2019-0217