CVE-2019-10097

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-10097
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-10097.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2019-10097
Downstream
Related
Published
2019-09-26T16:15:10.673Z
Modified
2026-04-16T00:02:17.145012147Z
Severity
  • 7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could trigger a stack buffer overflow or NULL pointer deference. This vulnerability could only be triggered by a trusted proxy and not by untrusted HTTP clients.

Database specific 
{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "last_affected": "8.0.0"
                }
            ],
            "cpe": "cpe:2.3:a:oracle:communications_element_manager:8.0.0:*:*:*:*:*:*:*",
            "source": "CPE_FIELD"
        },
        {
            "extracted_events": [
                {
                    "last_affected": "8.1.0"
                }
            ],
            "cpe": "cpe:2.3:a:oracle:communications_element_manager:8.1.0:*:*:*:*:*:*:*",
            "source": "CPE_FIELD"
        },
        {
            "extracted_events": [
                {
                    "last_affected": "8.1.1"
                }
            ],
            "cpe": "cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:*",
            "source": "CPE_FIELD"
        },
        {
            "extracted_events": [
                {
                    "last_affected": "8.2.0"
                }
            ],
            "cpe": "cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:*",
            "source": "CPE_FIELD"
        },
        {
            "extracted_events": [
                {
                    "last_affected": "8.1.1"
                }
            ],
            "cpe": "cpe:2.3:a:oracle:communications_session_report_manager:8.1.1:*:*:*:*:*:*:*",
            "source": "CPE_FIELD"
        },
        {
            "extracted_events": [
                {
                    "last_affected": "8.2.0"
                }
            ],
            "cpe": "cpe:2.3:a:oracle:communications_session_report_manager:8.2.0:*:*:*:*:*:*:*",
            "source": "CPE_FIELD"
        },
        {
            "extracted_events": [
                {
                    "last_affected": "8.2.1"
                }
            ],
            "cpe": "cpe:2.3:a:oracle:communications_session_report_manager:8.2.1:*:*:*:*:*:*:*",
            "source": "CPE_FIELD"
        },
        {
            "extracted_events": [
                {
                    "last_affected": "8.1.1"
                }
            ],
            "cpe": "cpe:2.3:a:oracle:communications_session_route_manager:8.1.1:*:*:*:*:*:*:*",
            "source": "CPE_FIELD"
        },
        {
            "extracted_events": [
                {
                    "last_affected": "8.2.0"
                }
            ],
            "cpe": "cpe:2.3:a:oracle:communications_session_route_manager:8.2.0:*:*:*:*:*:*:*",
            "source": "CPE_FIELD"
        },
        {
            "extracted_events": [
                {
                    "last_affected": "8.2.1"
                }
            ],
            "cpe": "cpe:2.3:a:oracle:communications_session_route_manager:8.2.1:*:*:*:*:*:*:*",
            "source": "CPE_FIELD"
        },
        {
            "extracted_events": [
                {
                    "last_affected": "12.3.3"
                }
            ],
            "cpe": "cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:*",
            "source": "CPE_FIELD"
        },
        {
            "extracted_events": [
                {
                    "last_affected": "12.4.0"
                }
            ],
            "cpe": "cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:*:*:*:*:*:*:*",
            "source": "CPE_FIELD"
        },
        {
            "extracted_events": [
                {
                    "last_affected": "12.2.1.4.0"
                }
            ],
            "cpe": "cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*",
            "source": "CPE_FIELD"
        },
        {
            "extracted_events": [
                {
                    "introduced": "17.1"
                },
                {
                    "last_affected": "17.3"
                }
            ],
            "cpe": "cpe:2.3:a:oracle:instantis_enterprisetrack:*:*:*:*:*:*:*:*",
            "source": "CPE_FIELD"
        },
        {
            "extracted_events": [
                {
                    "last_affected": "7.1"
                }
            ],
            "cpe": "cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:*",
            "source": "CPE_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/apache/httpd

Affected ranges

Type
GIT
Repo
https://github.com/apache/httpd
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
4a283f70d99e6535b0be857261d297946a7c58bc
Last affected
e0b198f98b01973f75cb734b3864c429945dbdb0
Last affected
69374fc08f3cda06a7acfc1cb6fe4fc0ce277f63
Last affected
6431bbb0da47dd984110dc32728a84e5cc990313
Last affected
3090a40b568b675c6b09a4f008b421a747e2731c
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.33"
        },
        {
            "last_affected": "2.4.34"
        },
        {
            "last_affected": "2.4.35"
        },
        {
            "last_affected": "2.4.37"
        },
        {
            "last_affected": "2.4.38"
        }
    ],
    "cpe": [
        "cpe:2.3:a:apache:http_server:2.4.33:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.34:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.35:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.37:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:http_server:2.4.38:*:*:*:*:*:*:*"
    ],
    "source": "CPE_FIELD"
}

Affected versions

2.*
2.4.33
2.4.34
2.4.35
2.4.37
2.4.38

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-10097.json"