Non notée
CVE-2019-17567 Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded…
Description
Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the whole connection regardless, thus allowing for subsequent requests on the same connection to pass through with no HTTP validation, authentication or authorization possibly configured.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache HTTP Server 2.4 | 2.4.6 → 2.4.46 | Pas de correctif indiqué |
Références
- httpd.apache.org httpd.apache.org
- lists.apache.org lists.apache.org
- [httpd-announce] 20210609 CVE-2019-17567: mod_proxy_wstunnel tunneling of non Upgraded connections lists.apache.org
- [httpd-dev] 20210610 Re: svn commit: r1890598 - in /httpd/site/trunk/content/security/json: CVE-2019-17567.json CVE-2020-13938.json CVE-2020-13950.json CVE-2020-35452.json CVE-2021-26690.json CVE-2021-26691.json CVE-2021-30641.json CVE-2021-31618.json lists.apache.org
- [oss-security] 20210609 CVE-2019-17567: Apache httpd: mod_proxy_wstunnel tunneling of non Upgraded connections www.openwall.com
- GLSA-202107-38 security.gentoo.org
- FEDORA-2021-dce7e7738e lists.fedoraproject.org
- FEDORA-2021-e3f6dd670d lists.fedoraproject.org
- www.oracle.com www.oracle.com
- security.netapp.com security.netapp.com
- [debian-lts-announce] 20240525 [SECURITY] [DLA 3818-1] apache2 security update lists.debian.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache HTTP Server
Les 139 CVE de Apache HTTP Server →
CVE-2026-63686
A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all…
Non notée
CVE-2026-93546
Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write…
Non notée
CVE-2026-79768
Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when…
Non notée
CVE-2026-73637
Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows…
Non notée