ASA-2019-00168 – Apache HTTP Server: mod_http2, read-after-free on a string compare

Posted on by Allele Security Intelligence in Alerts

Allele Security Alert

ASA-2019-00168

Identifier(s)

ASA-2019-00168, CVE-2019-0196

Title

mod_http2, read-after-free on a string compare

Vendor(s)

Apache Software Foundation

Product(s)

Apache HTTP Server (httpd)

Affected version(s)

Apache HTTP Server versions 2.4.17 to 2.4.38

Fixed version(s)

Apache HTTP Server version 2.4.39

Proof of concept

Unknown

Description

Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly.

Technical details

Unknown

Credits

Craig Young

Reference(s)

httpd 2.4 vulnerabilities – The Apache HTTP Server Project
https://httpd.apache.org/security/vulnerabilities_24.html

CVE-2019-0196: mod_http2, read-after-free on a string compare
https://seclists.org/oss-sec/2019/q2/0

CVE-2019-0196
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0196

CVE-2019-0196
https://nvd.nist.gov/vuln/detail/CVE-2019-0196

If there is any error in this alert or you wish a comprehensive analysis, let us know.

Last modified: October 2, 2019

We are not responsible for any data loss, device corruption or any other type of issue due to the use of any information mentioned in our security alerts.