Homepage
About Snyk

Out-of-bounds Write Affecting apache2 package, versions <2.4.41-r0

Severity

 Recommended
0.0
high
0
10

Snyk's Security Team recommends NVD's CVSS assessment

    Threat Intelligence

    EPSS
    0.73% (81st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-ALPINE318-APACHE2-5511439
  • published 15 Aug 2019
  • disclosed 15 Aug 2019
Report a new vulnerability Found a mistake?

Introduced: 15 Aug 2019

CVE-2019-10081 Open this link in a new tab
CWE-787 Open this link in a new tab

How to fix?

Upgrade Alpine:3.18 apache2 to version 2.4.41-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream apache2 package and not the apache2 package as distributed by Alpine. See How to fix? for Alpine:3.18 relevant fixed versions and status.

HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client.

References