Read the docs
TI-2019-00190 Aliases CVE-2019-0217GHSA-q29r-xr2f-g7j5

Race condition in Apache HTTP Server

Priority MEDIUM 49CWE-362Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 17 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.

Why it matters now

EPSS 0.16355 96th percentileScored 2026-11-07
Fix Partial Red Hat: 6 advisoriesRed Hat: 17 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache HTTP Server2.4.0 to 2.4.38—No fix listedCNA
  • Apache HTTP Server VendorApache Affected 2.4.0 to 2.4.38 Fixed in — No fix listed CNA

CPE configurations NVD · 24

CPEVersionsRoleVendor
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*2.4.0 – 2.4.38VulnerableApache
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*28VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*29VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*30VulnerableFedoraproject
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*12.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*14.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*16.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*18.04VulnerableCanonical
  • cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* Versions 2.4.0 – 2.4.38 Vulnerable ·Apache
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:* Versions 28 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* Versions 29 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
  • cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:* Versions 12.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* Versions 14.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
Show 14 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*18.10VulnerableCanonical
cpe:2.3:o:redhat:enterprise_linux:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*15.0VulnerableopenSUSE
cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*42.3VulnerableopenSUSE
cpe:2.3:a:netapp:oncommand_unified_manager:-:*:*:*:*:7-mode:*:*not specified by NVDVulnerableNetApp
cpe:2.3:o:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:*12.3.3VulnerableOracle
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:*:*:*:*:*:*:*12.4.0VulnerableOracle
cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:7.0:*:*:*:*:*:*:*7.0VulnerableOracle
cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:*7.1VulnerableOracle
  • cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:* Versions 18.10 Vulnerable ·Canonical
  • cpe:2.3:o:redhat:enterprise_linux:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:* Versions 42.3 Vulnerable ·openSUSE
  • cpe:2.3:a:netapp:oncommand_unified_manager:-:*:*:*:*:7-mode:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:o:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:* Versions 12.3.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:*:*:*:*:*:*:* Versions 12.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:* Versions 7.1 Vulnerable ·Oracle

Remediation

Red Hat 6 advisories

  • RHSA-2019:4126 Released 2019-12-10 · Red Hat rating Moderate
    httpd24-httpd security, bug fix, and enhancement update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) httpd24-1.1-19.el6, httpd24-build-1.1-19.el6, httpd24-httpd-2.4.34-15.el6 +12
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) httpd24-1.1-19.el7, httpd24-httpd-2.4.34-15.el7, httpd24-httpd-devel-2.4.34-15.el7 +12
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) httpd24-1.1-19.el7, httpd24-httpd-2.4.34-15.el7, httpd24-httpd-devel-2.4.34-15.el7 +12
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) httpd24-1.1-19.el7, httpd24-httpd-2.4.34-15.el7, httpd24-httpd-devel-2.4.34-15.el7 +12
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) httpd24-1.1-19.el7, httpd24-httpd-2.4.34-15.el7, httpd24-httpd-devel-2.4.34-15.el7 +12
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) httpd24-1.1-19.el6, httpd24-build-1.1-19.el6, httpd24-httpd-2.4.34-15.el6 +12
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) httpd24-1.1-19.el7, httpd24-httpd-2.4.34-15.el7, httpd24-httpd-devel-2.4.34-15.el7 +12
  • RHSA-2019:3932 Released 2019-11-20 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 6
    • Red Hat JBoss Core Services on RHEL 6 Server jbcs-httpd24-apr-1.6.3-63.jbcs.el6, jbcs-httpd24-apr-devel-1.6.3-63.jbcs.el6, jbcs-httpd24-apr-util-1.6.1-48.jbcs.el6 +37
  • RHSA-2019:3933 Released 2019-11-20 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 7
    • Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-apr-1.6.3-63.jbcs.el7, jbcs-httpd24-apr-devel-1.6.3-63.jbcs.el7, jbcs-httpd24-apr-util-1.6.1-48.jbcs.el7 +37
Show 3 more Red Hat advisories
  • RHSA-2019:3935 Released 2019-11-20 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release
    • Red Hat JBoss Core Services
  • RHSA-2019:3436 Released 2019-11-05 · Red Hat rating Moderate
    httpd:2.4 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) httpd-2.4.37-16.module+el8.1.0+4134+e6bad0ed.aarch64::httpd:2.4, httpd-2.4.37-16.module+el8.1.0+4134+e6bad0ed.ppc64le::httpd:2.4, httpd-2.4.37-16.module+el8.1.0+4134+e6bad0ed.s390x::httpd:2.4 +37
  • RHSA-2019:2343 Released 2019-08-06 · Red Hat rating Moderate
    httpd security and bug fix update
    • Red Hat Enterprise Linux Client Optional (v. 7) httpd-2.4.6-90.el7, httpd-devel-2.4.6-90.el7, httpd-manual-2.4.6-90.el7 +5
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) httpd-2.4.6-90.el7, httpd-devel-2.4.6-90.el7, httpd-manual-2.4.6-90.el7 +5
    • Red Hat Enterprise Linux Server (v. 7) httpd-2.4.6-90.el7, httpd-devel-2.4.6-90.el7, httpd-manual-2.4.6-90.el7 +3
    • Red Hat Enterprise Linux Server Optional (v. 7) mod_ldap-2.4.6-90.el7, mod_proxy_html-1:2.4.6-90.el7
    • Red Hat Enterprise Linux Workstation (v. 7) httpd-2.4.6-90.el7, httpd-devel-2.4.6-90.el7, httpd-manual-2.4.6-90.el7 +3
    • Red Hat Enterprise Linux Workstation Optional (v. 7) mod_ldap-2.4.6-90.el7, mod_proxy_html-1:2.4.6-90.el7

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Apache HTTP Server — FEDORA-2019-a4ed7400f4

    3 records Highest priority Priority CRITICAL 1 CRITICAL, 2 MEDIUM

    Other records, highest priority first

    • TI-2019-00184 Use after free in Apache HTTP ServerPriority CRITICAL 93
    • TI-2019-00188 In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using…Priority MEDIUM 45
    Show all 3 records → Advisory →
  • Advisory ·

    Apache HTTP Server — FEDORA-2019-119b14075a

    3 records Highest priority Priority CRITICAL 1 CRITICAL, 2 MEDIUM

    Other records, highest priority first

    • TI-2019-00184 Use after free in Apache HTTP ServerPriority CRITICAL 93
    • TI-2019-00188 In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using…Priority MEDIUM 45
    Show all 3 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 5AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Web Server 2AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2019:3436
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2019:2343
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2019:2343
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2019:2343
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2019:2343
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2019:2343
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2019:2343
Red Hat JBoss Core ServicesFixed RHSA-2019:3935
Red Hat JBoss Core Services on RHEL 6 ServerFixed RHSA-2019:3932
Red Hat JBoss Core Services on RHEL 7 ServerFixed RHSA-2019:3933
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2019:4126
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2019:4126
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)Fixed RHSA-2019:4126
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)Fixed RHSA-2019:4126
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)Fixed RHSA-2019:4126
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2019:4126
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2019:4126
Not affected: 1 product
  • Red Hat Virtualization 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-0217
  2. 2026-10-03 Alias added: GHSA-q29r-xr2f-g7j5

References

Patch 1

Advisory 22

Other 15

  • TI-2021-18535 Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773) KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-18417 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-25716 Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path. KEVCVSS 3.1CRITICAL 9.1
  • TI-2021-17490 mod_proxy SSRF KEVCVSS 3.1CRITICAL 9.0
  • TI-2019-00184 Use after free in Apache HTTP Server KEVCVSS 3.1HIGH 7.8
  • TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
See all 349 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences