{"affected":[{"affectedData":[{"product":"Apache HTTP Server","vendor":"Apache Software Foundation","versions":[{"status":"affected","version":"2.4.34 to 2.4.38"}]}],"source":"security@apache.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*","matchCriteriaId":"4AF58E59-C3D5-4899-808C-7D2F4DF93DFD","versionEndIncluding":"2.4.38","versionStartIncluding":"2.4.34","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*","matchCriteriaId":"7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6","vulnerable":true},{"criteria":"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*","matchCriteriaId":"23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D","vulnerable":true},{"criteria":"cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*","matchCriteriaId":"CD783B0C-9246-47D9-A937-6144FE8BFF0F","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*","matchCriteriaId":"97A4B8DF-58DA-4AB6-A1F9-331B36409BA3","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*","matchCriteriaId":"F1E78106-58E6-4D59-990F-75DA575BFAD9","vulnerable":true},{"criteria":"cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*","matchCriteriaId":"5F65DAB0-3DAD-49FF-BC73-3581CC3D5BF3","vulnerable":true}],"negate":false,"operator":"OR"}]},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:redhat:jboss_core_services:1.0:*:*:*:*:*:*:*","matchCriteriaId":"A2466282-51AB-478D-9FF4-FA524265ED2E","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*","matchCriteriaId":"2F6AB192-9D7D-4A9A-8995-E53A9DE9EAFC","vulnerable":false},{"criteria":"cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*","matchCriteriaId":"142AD0DD-4CF3-4D74-9442-459CE3347E3A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"},{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:oracle:communications_session_report_manager:8.0.0:*:*:*:*:*:*:*","matchCriteriaId":"7DDF6809-53A7-4F7D-9FA8-B522BE8F7A21","vulnerable":true},{"criteria":"cpe:2.3:a:oracle:communications_session_report_manager:8.1.0:*:*:*:*:*:*:*","matchCriteriaId":"AA86A15F-FAB8-4DF5-95AC-DA3D1CF7A720","vulnerable":true},{"criteria":"cpe:2.3:a:oracle:communications_session_report_manager:8.1.1:*:*:*:*:*:*:*","matchCriteriaId":"DB43DFD4-D058-4001-BD19-488E059F4532","vulnerable":true},{"criteria":"cpe:2.3:a:oracle:communications_session_report_manager:8.2.0:*:*:*:*:*:*:*","matchCriteriaId":"086E2E5C-44EB-4C07-B298-C04189533996","vulnerable":true},{"criteria":"cpe:2.3:a:oracle:communications_session_route_manager:8.0.0:*:*:*:*:*:*:*","matchCriteriaId":"4B042935-BC42-4CA8-9379-7F0F894F9653","vulnerable":true},{"criteria":"cpe:2.3:a:oracle:communications_session_route_manager:8.1.0:*:*:*:*:*:*:*","matchCriteriaId":"3B374F86-4EC8-4797-A8C3-5C1FF1DFC9F8","vulnerable":true},{"criteria":"cpe:2.3:a:oracle:communications_session_route_manager:8.1.1:*:*:*:*:*:*:*","matchCriteriaId":"5682DAEB-3810-4541-833A-568C868BCE0B","vulnerable":true},{"criteria":"cpe:2.3:a:oracle:communications_session_route_manager:8.2.0:*:*:*:*:*:*:*","matchCriteriaId":"01BC9AED-F81D-4344-AD97-EEF19B6EA8C7","vulnerable":true},{"criteria":"cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:*","matchCriteriaId":"AB654DFA-FEF9-4D00-ADB0-F3F2B6ACF13E","vulnerable":true},{"criteria":"cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:*:*:*:*:*:*:*","matchCriteriaId":"37209C6F-EF99-4D21-9608-B3A06D283D24","vulnerable":true},{"criteria":"cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:*","matchCriteriaId":"DFC79B17-E9D2-44D5-93ED-2F959E7A3D43","vulnerable":true},{"criteria":"cpe:2.3:a:oracle:instantis_enterprisetrack:17.1:*:*:*:*:*:*:*","matchCriteriaId":"82EA4BA7-C38B-4AF3-8914-9E3D089EBDD4","vulnerable":true},{"criteria":"cpe:2.3:a:oracle:instantis_enterprisetrack:17.2:*:*:*:*:*:*:*","matchCriteriaId":"B9C9BC66-FA5F-4774-9BDA-7AB88E2839C4","vulnerable":true},{"criteria":"cpe:2.3:a:oracle:instantis_enterprisetrack:17.3:*:*:*:*:*:*:*","matchCriteriaId":"7F69B9A5-F21B-4904-9F27-95C0F7A628E3","vulnerable":true},{"criteria":"cpe:2.3:a:oracle:retail_xstore_point_of_service:7.0:*:*:*:*:*:*:*","matchCriteriaId":"2F87FC90-16D0-4051-8280-B0DD4441F10B","vulnerable":true},{"criteria":"cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:*","matchCriteriaId":"A0ED83E3-E6BF-4EAA-AF8F-33485A88A218","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set \"H2Upgrade on\" are unaffected by this issue."},{"lang":"es","value":"Una vulnerabilidad fue encontrada en Apache HTTP Server 2.4.34 hasta 2.4.38 y clasificada como problemática. Cuando se habilitó HTTP / 2 para un http: host o H2Upgrade se habilitó para h2 en un https: host, una solicitud de actualización de http / 1.1 a http / 2 que no fue la primera solicitud en una conexión podría provocar una mala configuración y un fallo. El servidor que nunca habilitó el protocolo h2 o que solo lo habilitó para https: y no configuró \"H2Upgrade en \" no se ve afectado por este problema."}],"id":"CVE-2019-0197","lastModified":"2026-06-17T02:07:56.473","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"MEDIUM","accessVector":"NETWORK","authentication":"SINGLE","availabilityImpact":"PARTIAL","baseScore":4.9,"confidentialityImpact":"NONE","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:M/Au:S/C:N/I:P/A:P","version":"2.0"},"exploitabilityScore":6.8,"impactScore":4.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.2,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":1.6,"impactScore":2.5,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2019-06-11T22:29:04.170","references":[{"source":"security@apache.org","tags":["Mailing List","Patch","Third Party Advisory"],"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.html"},{"source":"security@apache.org","tags":["Mailing List","Patch","Third Party Advisory"],"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.html"},{"source":"security@apache.org","tags":["Mailing List","Patch","Third Party Advisory"],"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00084.html"},{"source":"security@apache.org","tags":["Mailing List","Third Party Advisory"],"url":"http://www.openwall.com/lists/oss-security/2019/04/02/2"},{"source":"security@apache.org","tags":["Third Party Advisory","VDB Entry"],"url":"http://www.securityfocus.com/bid/107665"},{"source":"security@apache.org","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2019:3932"},{"source":"security@apache.org","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2019:3933"},{"source":"security@apache.org","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2019:3935"},{"source":"security@apache.org","tags":["Vendor Advisory"],"url":"https://httpd.apache.org/security/vulnerabilities_24.html"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/e0b8f6e858b1c8ec2ce8e291a2c543d438915037c7af661ab6d33808%40%3Cdev.httpd.apache.org%3E"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d%40%3Ccvs.httpd.apache.org%3E"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/rd2fb621142e7fa187cfe12d7137bf66e7234abcbbcd800074c84a538%40%3Ccvs.httpd.apache.org%3E"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/re473305a65b4db888e3556e4dae10c2a04ee89dcff2e26ecdbd860a9%40%3Ccvs.httpd.apache.org%3E"},{"source":"security@apache.org","url":"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E"},{"source":"security@apache.org","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WETXNQWNQLWHV6XNW6YTO5UGDTIWAQGT/"},{"source":"security@apache.org","tags":["Third Party Advisory"],"url":"https://security.netapp.com/advisory/ntap-20190617-0002/"},{"source":"security@apache.org","tags":["Third Party Advisory"],"url":"https://support.f5.com/csp/article/K44591505"},{"source":"security@apache.org","tags":["Third Party Advisory"],"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03950en_us"},{"source":"security@apache.org","tags":["Third Party Advisory"],"url":"https://usn.ubuntu.com/4113-1/"},{"source":"security@apache.org","tags":["Third Party Advisory"],"url":"https://www.oracle.com/security-alerts/cpuapr2020.html"},{"source":"security@apache.org","tags":["Patch","Third Party Advisory"],"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"},{"source":"security@apache.org","tags":["Patch","Third Party Advisory"],"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch","Third Party Advisory"],"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch","Third Party Advisory"],"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Patch","Third Party Advisory"],"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00084.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"url":"http://www.openwall.com/lists/oss-security/2019/04/02/2"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"url":"http://www.securityfocus.com/bid/107665"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2019:3932"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2019:3933"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://access.redhat.com/errata/RHSA-2019:3935"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://httpd.apache.org/security/vulnerabilities_24.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.apache.org/thread.html/e0b8f6e858b1c8ec2ce8e291a2c543d438915037c7af661ab6d33808%40%3Cdev.httpd.apache.org%3E"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d%40%3Ccvs.httpd.apache.org%3E"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.apache.org/thread.html/rd2fb621142e7fa187cfe12d7137bf66e7234abcbbcd800074c84a538%40%3Ccvs.httpd.apache.org%3E"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.apache.org/thread.html/re473305a65b4db888e3556e4dae10c2a04ee89dcff2e26ecdbd860a9%40%3Ccvs.httpd.apache.org%3E"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WETXNQWNQLWHV6XNW6YTO5UGDTIWAQGT/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://security.netapp.com/advisory/ntap-20190617-0002/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://support.f5.com/csp/article/K44591505"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03950en_us"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://usn.ubuntu.com/4113-1/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"url":"https://www.oracle.com/security-alerts/cpuapr2020.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"],"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"],"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"}],"sourceIdentifier":"security@apache.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-444"}],"source":"nvd@nist.gov","type":"Primary"}]}