UBUNTU-CVE-2019-10081

See a problem?
Source
https://ubuntu.com/security/notices/UBUNTU-CVE-2019-10081
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-10081.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2019-10081
Related
Published
2019-08-15T00:00:00Z
Modified
2019-08-15T00:00:00Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client.

References

Affected packages

Ubuntu:18.04:LTS / apache2

Package

Name
apache2
Purl
pkg:deb/ubuntu/apache2@2.4.29-1ubuntu4.10?arch=src?distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.4.29-1ubuntu4.10

Affected versions

2.*

2.4.27-2ubuntu3
2.4.29-1ubuntu1
2.4.29-1ubuntu2
2.4.29-1ubuntu3
2.4.29-1ubuntu4
2.4.29-1ubuntu4.1
2.4.29-1ubuntu4.2
2.4.29-1ubuntu4.3
2.4.29-1ubuntu4.4
2.4.29-1ubuntu4.5
2.4.29-1ubuntu4.6
2.4.29-1ubuntu4.7
2.4.29-1ubuntu4.8

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "apache2-ssl-dev": "2.4.29-1ubuntu4.10",
            "apache2-dbg": "2.4.29-1ubuntu4.10",
            "apache2-dev": "2.4.29-1ubuntu4.10",
            "apache2-bin": "2.4.29-1ubuntu4.10",
            "apache2-data": "2.4.29-1ubuntu4.10",
            "apache2-suexec-pristine": "2.4.29-1ubuntu4.10",
            "apache2-doc": "2.4.29-1ubuntu4.10",
            "apache2": "2.4.29-1ubuntu4.10",
            "apache2-utils": "2.4.29-1ubuntu4.10",
            "apache2-suexec-custom": "2.4.29-1ubuntu4.10"
        }
    ]
}