A vulnerability was found in httpd, where HTTP/2 very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client.
Created httpd tracking bugs for this issue: Affects: fedora-all [bug 1743967] Created mod_http2 tracking bugs for this issue: Affects: fedora-all [bug 1743968] Created nghttp2 tracking bugs for this issue: Affects: epel-all [bug 1743969] Affects: fedora-all [bug 1743971] Created nginx tracking bugs for this issue: Affects: fedora-all [bug 1743973] Created nodejs tracking bugs for this issue: Affects: epel-all [bug 1743970] Affects: fedora-all [bug 1743972]
External References: https://httpd.apache.org/security/vulnerabilities_24.html
Could you please explain why you created tracking bugs for nghttp2?
This vulnerability is out of security support scope for the following products: * Red Hat JBoss Enterprise Web Server 3 Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.
Mitigation: This flaw is only exploitable if Apache httpd is configured to respond to HTTP/2 requests, which is done by including "h2" or "h2c" in the "Protocols" list in a configuration file. The following command can be used to search for possible vulnerable configurations: grep -R '^\s*Protocols\>.*\<h2\>' /etc/httpd/ See https://httpd.apache.org/docs/2.4/mod/mod_http2.html
This vulnerability is out of security support scope for the following products: * Red Hat JBoss Enterprise Web Server 2 Please refer to https://access.redhat.com/support/policy/updates/jboss_notes for more details.
This issue has been addressed in the following products: JBoss Core Services Apache HTTP Server 2.4.37 SP2 Via RHSA-2020:1336 https://access.redhat.com/errata/RHSA-2020:1336
This issue has been addressed in the following products: JBoss Core Services on RHEL 6 JBoss Core Services on RHEL 7 Via RHSA-2020:1337 https://access.redhat.com/errata/RHSA-2020:1337
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-10081
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2020:4751 https://access.redhat.com/errata/RHSA-2020:4751