What’s Vulnerable › Vulnerabilities
CVE-2019-0211: Apache HTTP Server Privilege Escalation Vulnerability
- Severity: high (CVSS 7.8 v3.1)
- Exploited in the wild: yes — in CISA KEV since 2021-11-03
- EPSS: 65.0% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2019-04-08 · updated 2026-06-17
- Weakness: CWE-416
Description
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.
Affected products
- Apache HTTP Server: from 2.4.17 through 2.4.38
- Canonical Ubuntu Linux: 14.04, 16.04, 18.04, 18.10
- Debian Linux: 9.0
- Fedoraproject Fedora: 28, 29, 30
- NetApp OnCommand Unified Manager for 7-Mode (core package): all versions
- openSUSE Leap: 15.0, 42.3
- Oracle Communications Session Report Manager: 8.0.0, 8.1.0, 8.1.1, 8.2.0
- Oracle Communications Session Route Manager: 8.0.0, 8.1.0, 8.1.1, 8.2.0
- Oracle Corporation Enterprise Manager Ops Center: 12.3.3, 12.4.0
- Oracle Corporation Oracle HTTP Server: 12.2.1.3.0
- Oracle Instantis Enterprisetrack: 17.1, 17.2, 17.3
- Oracle Corporation Retail Xstore Point of Service: 7.0, 7.1
- Red Hat Enterprise Linux: 8.0
- RedHat Enterprise Linux Eus: 8.1, 8.2, 8.4, 8.6, 8.8
- RedHat Enterprise Linux For Arm 64: 8.0_aarch64
- RedHat Enterprise Linux For Arm 64 Eus: 8.1_aarch64, 8.2_aarch64, 8.4_aarch64, 8.6_aarch64, 8.8_aarch64
- RedHat Enterprise Linux For Ibm Z Systems: 8.0_s390x
- RedHat Enterprise Linux For Ibm Z Systems Eus: 8.1_s390x, 8.2_s390x, 8.4_s390x, 8.6_s390x, 8.8_s390x
- RedHat Enterprise Linux For Power Little Endian: 8.0_ppc64le
- RedHat Enterprise Linux For Power Little Endian Eus: 8.1_ppc64le, 8.2_ppc64le, 8.4_ppc64le, 8.6_ppc64le, 8.8_ppc64le
- RedHat Enterprise Linux Server Aus: 8.2, 8.4, 8.6
- RedHat Enterprise Linux Server Tus: 8.2, 8.4, 8.6, 8.8
- RedHat Enterprise Linux Update Services For Sap Solutions: 8.0, 8.1, 8.4, 8.6, 8.8
- RedHat Jboss Core Services: 1.0
- Red Hat OpenShift Container Platform 4.18: 3.11
- RedHat Openshift Container Platform For Power: 3.11_ppc64le
- RedHat Software Collections: 1.0
References
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00051.html
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00061.html
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00084.html
- http://packetstormsecurity.com/files/152386/Apache-2.4.38-Root-Privilege-Escalation.html
- http://packetstormsecurity.com/files/152415/Slackware-Security-Advisory-httpd-Updates.html
- http://packetstormsecurity.com/files/152441/CARPE-DIEM-Apache-2.4.x-Local-Privilege-Escalation.html
- http://www.apache.org/dist/httpd/CHANGES_2.4.39
- http://www.openwall.com/lists/oss-security/2019/04/02/3
- http://www.openwall.com/lists/oss-security/2019/07/26/7
- http://www.securityfocus.com/bid/107666
- https://access.redhat.com/errata/RHBA-2019:0959
- https://access.redhat.com/errata/RHSA-2019:0746
Get alerted when CVE-2019-0211 or the next vulnerability affects your stack