CVE-2019-10081

HIGH7.5EPSS 36.1%

apache2 - security update

發布日:2019/8/15修改日:2026/3/9

也稱為:DSA-4509-1ALPINE-CVE-2019-10081DEBIAN-CVE-2019-10081

描述

HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client.

受影響套件(3)

Alpine/apache2from 0, < 2.4.41-r0
Debian/apache2from 0, < 2.4.41-1
Debian/apache2from 0, < 2.4.25-3+deb9u8

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH7.5	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

參考連結(2)

ADVISORYhttps://security.alpinelinux.org/vuln/CVE-2019-10081
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2019-10081