CVE-2019-10081

NameCVE-2019-10081
DescriptionHTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
ReferencesDSA-4509-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
apache2 (PTS)buster2.4.38-3+deb10u8fixed
buster (security)2.4.38-3+deb10u7fixed
bullseye2.4.54-1~deb11u1fixed
bullseye (security)2.4.52-1~deb11u2fixed
bookworm, sid2.4.54-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
apache2sourcejessie(not affected)
apache2sourcestretch2.4.25-3+deb9u8DSA-4509-1
apache2sourcebuster2.4.38-3+deb10u1DSA-4509-1
apache2source(unstable)2.4.41-1

Notes

[jessie] - apache2 <not-affected> (HTTP/2 support only available since version 2.4.17 and later)
Affects upstream versions 2.4.20 to 2.4.39
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-10081

Search for package or bug name: Reporting problems