MGASA-2019-0109

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2019-0109.html
Import Source
https://advisories.mageia.org/MGASA-2019-0109.json
JSON Data
https://api.test.osv.dev/v1/vulns/MGASA-2019-0109
Related
Published
2019-03-14T21:39:55Z
Modified
2019-03-14T20:26:00Z
Summary
Updated apache packages fix security vulnerability
Details

By sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections in Apache HTTP Server versions 2.4.37 and prior (CVE-2018-17189).

In Apache HTTP Server 2.4 release 2.4.37 and prior, modsession checks the session expiry time before decoding the session. This causes session expiry time to be ignored for modsession_cookie sessions since the expiry time is loaded when the session is decoded (CVE-2018-17199).

The apache package has been updated to version 2.4.38, fixing these issues and several other bugs. See the upstream CHANGES files for details.

References
Credits

Affected packages

Mageia:6 / apache

Package

Name
apache
Purl
pkg:rpm/mageia/apache?distro=mageia-6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.4.38-1.mga6

Ecosystem specific 

{
    "section": "core"
}