CVE-2019-17567

2021-06-0803:49:47

redhat.com

access.redhat.com

145

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.003 Low

EPSS

Percentile

68.1%

JSON

A flaw was found in Apache httpd. The mod_proxy_wstunnel module tunnels non-upgraded connections.

Mitigation

Only configurations which use mod_proxy_wstunnel are affected by this flaw. It is also safe to comment-out the "LoadModule proxy_wstunnel_module … " line in /etc/httpd/conf.modules.d/00-proxy.conf for configurations which do not rely on a websockets reverse proxy.