安全公告/【CVE-2019-0197】

基本信息

漏洞名称:
受影响操作系统:桌面操作系统
危险等级:中危
影响源码包:apache2
CVSS评分:4.2
发现日期:2023-07-20
修复版本:2.4.38-3

漏洞描述

A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set "H2Upgrade on" are unaffected by this issue.

修复方式

sudo apt update && sudo apt dist-upgrade

漏洞判定

执行命令apt policy PackageName获取软件包版本号，版本小于修复版本，则受此漏洞影响，版本大于等于修复版本，则此漏洞已修复

补丁

参考

https://security-tracker.debian.org/tracker/CVE-2019-0197
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0197
https://nvd.nist.gov/vuln/detail/CVE-2019-0197