WaratekVRT Sign in

CVE-2019-0197

Affected software7 products, listed below
Severity4.2 Medium CVSS 3.1 2 scores
WeaknessCWE-444
Published11 Jun 2019
Updated17 Jun 2026

Description

A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. Server that never enabled the h2 protocol or that only enabled it for https: and did not set "H2Upgrade on" are unaffected by this issue.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 7 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC none indexed
  • EPSS 8.3% chance in 30 days

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

4.2 MEDIUM v3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 4.2 MEDIUM CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L NVD Primary published
CVSS 2.0 4.9 none AV:N/AC:M/Au:S/C:N/I:P/A:P NVD Primary

Affected software and releases

Products and versions

11 products, 24 version entries
SourceVendorProductSchemeAffected versions
nvd apache http server generic ≥ 2.4.34 and ≤ 2.4.38
nvd canonical ubuntu linux generic 16.04 · 18.04 · 19.04
nvd fedoraproject fedora generic 30
nvd opensuse leap generic 15.0 · 42.3
nvd oracle communications session report manager generic 8.0.0 · 8.1.0 · 8.1.1 · 8.2.0
nvd oracle communications session route manager generic 8.0.0 · 8.1.0 · 8.1.1 · 8.2.0
nvd oracle enterprise manager ops center generic 12.3.3 · 12.4.0
nvd oracle http server generic 12.2.1.3.0
nvd oracle instantis enterprisetrack generic 17.1 · 17.2 · 17.3
nvd oracle retail xstore point of service generic 7.0 · 7.1
nvd redhat jboss core services generic 1.0

References

URLTags
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.html Mailing List, Patch, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.html Mailing List, Patch, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00084.html Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2019/04/02/2 Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/107665 Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2019:3932 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3933 Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3935 Third Party Advisory
https://httpd.apache.org/security/vulnerabilities_24.html Vendor Advisory
https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E

Timeline
Published2019-06-11By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.