Lucene search

DebianDEBIAN:DLA-1900-1:EE6D1

HistoryAug 28, 2019 - 10:39 p.m.

[SECURITY] [DLA 1900-1] apache2 security update

2019-08-2822:39:55

lists.debian.org

119

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

8.2

Confidence

High

EPSS

0.167

Percentile

96.1%

JSON

Package : apache2
Version : 2.4.10-10+deb8u15
CVE ID : CVE-2019-10092 CVE-2019-10098

Two security vulnerabilities were found in the Apache HTTP server.

CVE-2019-10092

Matei "Mal" Badanoiu reported a limited cross-site scripting
vulnerability in the mod_proxy error page.

CVE-2019-10098

Yukitsugu Sasaki reported a potential open redirect vulnerability in
the mod_rewrite module.

For Debian 8 "Jessie", these problems have been fixed in version
2.4.10-10+deb8u15.

We recommend that you upgrade your apache2 packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian9mipsapache2-utils< 2.4.25-3+deb9u9apache2-utils_2.4.25-3+deb9u9_mips.deb
Debian9armelapache2-ssl-dev< 2.4.25-3+deb9u9apache2-ssl-dev_2.4.25-3+deb9u9_armel.deb
Debian10mips64ellibapache2-mod-proxy-uwsgi< 2.4.38-3+deb10u1libapache2-mod-proxy-uwsgi_2.4.38-3+deb10u1_mips64el.deb
Debian8armellibapache2-mod-macro< 1:2.4.10-10+deb8u15libapache2-mod-macro_1:2.4.10-10+deb8u15_armel.deb
Debian10mips64elapache2-utils< 2.4.38-3+deb10u1apache2-utils_2.4.38-3+deb10u1_mips64el.deb
Debian10mipselapache2-suexec-custom-dbgsym< 2.4.38-3+deb10u3apache2-suexec-custom-dbgsym_2.4.38-3+deb10u3_mipsel.deb
Debian10s390xapache2< 2.4.38-3+deb10u1apache2_2.4.38-3+deb10u1_s390x.deb
Debian10mipsapache2-suexec-pristine< 2.4.38-3+deb10u1apache2-suexec-pristine_2.4.38-3+deb10u1_mips.deb
Debian10ppc64elapache2-bin-dbgsym< 2.4.38-3+deb10u1apache2-bin-dbgsym_2.4.38-3+deb10u1_ppc64el.deb
Debian10allapache2< 2.4.38-3+deb10u1apache2_2.4.38-3+deb10u1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	mips	apache2-utils	< 2.4.25-3+deb9u9	apache2-utils_2.4.25-3+deb9u9_mips.deb
Debian	9	armel	apache2-ssl-dev	< 2.4.25-3+deb9u9	apache2-ssl-dev_2.4.25-3+deb9u9_armel.deb
Debian	10	mips64el	libapache2-mod-proxy-uwsgi	< 2.4.38-3+deb10u1	libapache2-mod-proxy-uwsgi_2.4.38-3+deb10u1_mips64el.deb
Debian	8	armel	libapache2-mod-macro	< 1:2.4.10-10+deb8u15	libapache2-mod-macro_1:2.4.10-10+deb8u15_armel.deb
Debian	10	mips64el	apache2-utils	< 2.4.38-3+deb10u1	apache2-utils_2.4.38-3+deb10u1_mips64el.deb
Debian	10	mipsel	apache2-suexec-custom-dbgsym	< 2.4.38-3+deb10u3	apache2-suexec-custom-dbgsym_2.4.38-3+deb10u3_mipsel.deb
Debian	10	s390x	apache2	< 2.4.38-3+deb10u1	apache2_2.4.38-3+deb10u1_s390x.deb
Debian	10	mips	apache2-suexec-pristine	< 2.4.38-3+deb10u1	apache2-suexec-pristine_2.4.38-3+deb10u1_mips.deb
Debian	10	ppc64el	apache2-bin-dbgsym	< 2.4.38-3+deb10u1	apache2-bin-dbgsym_2.4.38-3+deb10u1_ppc64el.deb
Debian	10	all	apache2	< 2.4.38-3+deb10u1	apache2_2.4.38-3+deb10u1_all.deb