CVE-2019-0217

2019-04-0821:29:00

Alpine Linux Development Team

security.alpinelinux.org

6 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

59.8%

JSON

In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.

OSVersionArchitecturePackageVersionFilename
Alpineedge-mainnoarchapache2< 2.4.39-r0UNKNOWN
Alpine3.10-mainnoarchapache2< 2.4.39-r0UNKNOWN
Alpine3.11-mainnoarchapache2< 2.4.39-r0UNKNOWN
Alpine3.12-mainnoarchapache2< 2.4.39-r0UNKNOWN
Alpine3.13-mainnoarchapache2< 2.4.39-r0UNKNOWN
Alpine3.14-mainnoarchapache2< 2.4.39-r0UNKNOWN
Alpine3.15-mainnoarchapache2< 2.4.39-r0UNKNOWN
Alpine3.16-mainnoarchapache2< 2.4.39-r0UNKNOWN
Alpine3.17-mainnoarchapache2< 2.4.39-r0UNKNOWN
Alpine3.18-mainnoarchapache2< 2.4.39-r0UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Alpine	edge-main	noarch	apache2	< 2.4.39-r0	UNKNOWN
Alpine	3.10-main	noarch	apache2	< 2.4.39-r0	UNKNOWN
Alpine	3.11-main	noarch	apache2	< 2.4.39-r0	UNKNOWN
Alpine	3.12-main	noarch	apache2	< 2.4.39-r0	UNKNOWN
Alpine	3.13-main	noarch	apache2	< 2.4.39-r0	UNKNOWN
Alpine	3.14-main	noarch	apache2	< 2.4.39-r0	UNKNOWN
Alpine	3.15-main	noarch	apache2	< 2.4.39-r0	UNKNOWN
Alpine	3.16-main	noarch	apache2	< 2.4.39-r0	UNKNOWN
Alpine	3.17-main	noarch	apache2	< 2.4.39-r0	UNKNOWN
Alpine	3.18-main	noarch	apache2	< 2.4.39-r0	UNKNOWN