CVEvulnerability

CVE-2019-0190

7.5 HIGH Published 2019-01-30 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-01-30
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:N/A:P

Description

A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request that would cause mod_ssl to enter a loop leading to a denial of service. This bug can be only triggered with Apache HTTP Server version 2.4.37 when using OpenSSL version 1.1.1 or later, due to an interaction in changes to handling of renegotiation attempts.

Affected configurations

• apache http server 2.4.37 • oracle enterprise manager ops center 12.3.3 • oracle hospitality guest access 4.2.0 • oracle hospitality guest access 4.2.1 • oracle instantis enterprisetrack 17.1 • oracle instantis enterprisetrack 17.2 • oracle instantis enterprisetrack 17.3 • oracle retail xstore point of service 7.0 • oracle retail xstore point of service 7.1

References