Allele Security Alert
ASA-2019-00172
Identifier(s)
ASA-2019-00172, CVE-2019-0217
Title
mod_auth_digest access control bypass
Vendor(s)
Apache Software Foundation
Product(s)
Apache HTTP Server (httpd)
Affected version(s)
Apache HTTP Server versions 2.4.0 to 2.4.38
Fixed version(s)
Apache HTTP Server version 2.4.39
Proof of concept
Unknown
Description
In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.
Technical details
Unknown
Credits
Simon Kappel
Reference(s)
httpd 2.4 vulnerabilities – The Apache HTTP Server Project
https://httpd.apache.org/security/vulnerabilities_24.html
CVE-2019-0217: mod_auth_digest access control bypass
https://seclists.org/oss-sec/2019/q2/4
CVE-2019-0217
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0217
CVE-2019-0217
https://nvd.nist.gov/vuln/detail/CVE-2019-0217
If there is any error in this alert or you wish a comprehensive analysis, let us know.
Last modified: October 2, 2019