Debian Security Advisory
DLA-1748-1 apache2 -- LTS security update
- Date Reported:
- 03 Apr 2019
- Affected Packages:
- Security database references:
- In Mitre's CVE dictionary: CVE-2019-0217, CVE-2019-0220.
- More information:
Several vulnerabilities have been found in the Apache HTTP server.
A race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions. The issue was discovered by Simon Kappel.
Bernhard Lorenz of Alpha Strike Labs GmbH reported that URL normalizations were inconsistently handled. When the path component of a request URL contains multiple consecutive slashes ('/'), directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects of the servers processing will implicitly collapse them.
For Debian 8
Jessie, these problems have been fixed in version 2.4.10-10+deb8u14.
We recommend that you upgrade your apache2 packages.
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS