[<prev] [next>] [day] [month] [year] [list]
Message-ID: <1554168684.FQZJUOYK@httpd.apache.org>
Date: Mon, 01 Apr 2019 20:31:24 -0500
From: Daniel Ruggeri <druggeri@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2019-0217: mod_auth_digest access control bypass
CVE-2019-0217: mod_auth_digest access control bypass
Severity: important
Vendor: The Apache Software Foundation
Versions Affected:
httpd 2.4.0 to 2.4.38
Description:
In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition
in mod_auth_digest when running in a threaded server could allow a
user with valid credentials to authenticate using another username,
bypassing configured access control restrictions.
Mitigation:
All httpd users deploying mod_auth_digest should upgrade to 2.4.39 or later.
Credit:
The issue was discovered by Simon Kappel.
References:
https://httpd.apache.org/security/vulnerabilities_24.html
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
