CVE-2019-17567 - mod_proxy_wstunnel tunneling of non Upgraded connections

Back Back to CVE browser

MEDIUM

mod_proxy_wstunnel tunneling of non Upgraded connections

Published Jun 10, 2021

5.3

MEDIUM

CVSS 3.1

EPSS 60.27%

Description

Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the whole connection regardless, thus allowing for subsequent requests on the same connection to pass through with no HTTP validation, authentication or authorization possibly configured.

Affected products

Vendor Apache Software Foundation Product Apache HTTP Server Default
n/a
- Version
  2.4.10
  Status
  affected
  Constraints
  -
- Version
  2.4.12
  Status
  affected
  Constraints
  -
- Version
  2.4.16
  Status
  affected
  Constraints
  -
- Version
  2.4.17
  Status
  affected
  Constraints
  -
- Version
  2.4.18
  Status
  affected
  Constraints
  -
- Version
  2.4.20
  Status
  affected
  Constraints
  -
- Version
  2.4.23
  Status
  affected
  Constraints
  -
- Version
  2.4.25
  Status
  affected
  Constraints
  -
- Version
  2.4.26
  Status
  affected
  Constraints
  -
- Version
  2.4.27
  Status
  affected
  Constraints
  -
- Version
  2.4.28
  Status
  affected
  Constraints
  -
- Version
  2.4.29
  Status
  affected
  Constraints
  -
- Version
  2.4.33
  Status
  affected
  Constraints
  -
- Version
  2.4.34
  Status
  affected
  Constraints
  -
- Version
  2.4.35
  Status
  affected
  Constraints
  -
- Version
  2.4.37
  Status
  affected
  Constraints
  -
- Version
  2.4.38
  Status
  affected
  Constraints
  -
- Version
  2.4.39
  Status
  affected
  Constraints
  -
- Version
  2.4.41
  Status
  affected
  Constraints
  -
- Version
  2.4.43
  Status
  affected
  Constraints
  -
- Version
  2.4.46
  Status
  affected
  Constraints
  -
- Version
  2.4.6
  Status
  affected
  Constraints
  -
- Version
  2.4.7
  Status
  affected
  Constraints
  -
- Version
  2.4.9
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Apache Software Foundation

Apache HTTP Server

n/a

Version	Status	Constraints
2.4.10	affected	-
2.4.12	affected	-
2.4.16	affected	-
2.4.17	affected	-
2.4.18	affected	-
2.4.20	affected	-
2.4.23	affected	-
2.4.25	affected	-
2.4.26	affected	-
2.4.27	affected	-
2.4.28	affected	-
2.4.29	affected	-
2.4.33	affected	-
2.4.34	affected	-
2.4.35	affected	-
2.4.37	affected	-
2.4.38	affected	-
2.4.39	affected	-
2.4.41	affected	-
2.4.43	affected	-
2.4.46	affected	-
2.4.6	affected	-
2.4.7	affected	-
2.4.9	affected	-

JBoss Core Services for RHEL 8

jbcs-httpd24-apr-0:1.6.3-107.el8jbcs

Fixed · RHSA-2021:4614
JBoss Core Services for RHEL 8

jbcs-httpd24-apr-util-0:1.6.1-84.el8jbcs

Fixed · RHSA-2021:4614
JBoss Core Services for RHEL 8

jbcs-httpd24-curl-0:7.78.0-2.el8jbcs

Fixed · RHSA-2021:4614
JBoss Core Services for RHEL 8

jbcs-httpd24-httpd-0:2.4.37-78.el8jbcs

Fixed · RHSA-2021:4614
JBoss Core Services for RHEL 8

jbcs-httpd24-mod_cluster-native-0:1.3.16-9.Final_redhat_2.el8jbcs

Fixed · RHSA-2021:4614
JBoss Core Services for RHEL 8

jbcs-httpd24-mod_http2-0:1.15.7-21.el8jbcs

Fixed · RHSA-2021:4614
JBoss Core Services for RHEL 8

jbcs-httpd24-mod_jk-0:1.2.48-20.redhat_1.el8jbcs

Fixed · RHSA-2021:4614
JBoss Core Services for RHEL 8

jbcs-httpd24-mod_md-1:2.0.8-40.el8jbcs

Fixed · RHSA-2021:4614
JBoss Core Services for RHEL 8

jbcs-httpd24-mod_security-0:2.9.2-67.GA.el8jbcs

Fixed · RHSA-2021:4614
JBoss Core Services for RHEL 8

jbcs-httpd24-nghttp2-0:1.39.2-39.el8jbcs

Fixed · RHSA-2021:4614
JBoss Core Services for RHEL 8

jbcs-httpd24-openssl-1:1.1.1g-8.el8jbcs

Fixed · RHSA-2021:4614
JBoss Core Services for RHEL 8

jbcs-httpd24-openssl-chil-0:1.0.0-7.el8jbcs

Fixed · RHSA-2021:4614
JBoss Core Services for RHEL 8

jbcs-httpd24-openssl-pkcs11-0:0.4.10-22.el8jbcs

Fixed · RHSA-2021:4614
JBoss Core Services on RHEL 7

jbcs-httpd24-apr-0:1.6.3-107.jbcs.el7

Fixed · RHSA-2021:4614
JBoss Core Services on RHEL 7

jbcs-httpd24-apr-util-0:1.6.1-84.jbcs.el7

Fixed · RHSA-2021:4614
JBoss Core Services on RHEL 7

jbcs-httpd24-curl-0:7.78.0-2.jbcs.el7

Fixed · RHSA-2021:4614
JBoss Core Services on RHEL 7

jbcs-httpd24-httpd-0:2.4.37-78.jbcs.el7

Fixed · RHSA-2021:4614
JBoss Core Services on RHEL 7

jbcs-httpd24-mod_cluster-native-0:1.3.16-9.Final_redhat_2.jbcs.el7

Fixed · RHSA-2021:4614
JBoss Core Services on RHEL 7

jbcs-httpd24-mod_http2-0:1.15.7-21.jbcs.el7

Fixed · RHSA-2021:4614
JBoss Core Services on RHEL 7

jbcs-httpd24-mod_jk-0:1.2.48-20.redhat_1.jbcs.el7

Fixed · RHSA-2021:4614
JBoss Core Services on RHEL 7

jbcs-httpd24-mod_md-1:2.0.8-40.jbcs.el7

Fixed · RHSA-2021:4614
JBoss Core Services on RHEL 7

jbcs-httpd24-mod_security-0:2.9.2-67.GA.jbcs.el7

Fixed · RHSA-2021:4614
JBoss Core Services on RHEL 7

jbcs-httpd24-nghttp2-0:1.39.2-39.jbcs.el7

Fixed · RHSA-2021:4614
JBoss Core Services on RHEL 7

jbcs-httpd24-openssl-1:1.1.1g-8.jbcs.el7

Fixed · RHSA-2021:4614
JBoss Core Services on RHEL 7

jbcs-httpd24-openssl-chil-0:1.0.0-7.jbcs.el7

Fixed · RHSA-2021:4614
JBoss Core Services on RHEL 7

jbcs-httpd24-openssl-pkcs11-0:0.4.10-22.jbcs.el7

Fixed · RHSA-2021:4614
Red Hat JBoss Core Services

httpd

Fixed · RHSA-2021:4613
Red Hat Enterprise Linux 6

httpd

Not affected
Red Hat Enterprise Linux 7

httpd

Out of support scope
Red Hat Enterprise Linux 8

httpd:2.4/httpd

Will not fix
Red Hat Enterprise Linux 9

httpd

Not affected
Red Hat JBoss Enterprise Application Platform 6

httpd22

Out of support scope
Red Hat JBoss Enterprise Web Server 2

httpd22

Out of support scope
Red Hat Software Collections

httpd24-httpd

Will not fix

Product	Package	State	Advisory
JBoss Core Services for RHEL 8	jbcs-httpd24-apr-0:1.6.3-107.el8jbcs	Fixed	RHSA-2021:4614
JBoss Core Services for RHEL 8	jbcs-httpd24-apr-util-0:1.6.1-84.el8jbcs	Fixed	RHSA-2021:4614
JBoss Core Services for RHEL 8	jbcs-httpd24-curl-0:7.78.0-2.el8jbcs	Fixed	RHSA-2021:4614
JBoss Core Services for RHEL 8	jbcs-httpd24-httpd-0:2.4.37-78.el8jbcs	Fixed	RHSA-2021:4614
JBoss Core Services for RHEL 8	jbcs-httpd24-mod_cluster-native-0:1.3.16-9.Final_redhat_2.el8jbcs	Fixed	RHSA-2021:4614
JBoss Core Services for RHEL 8	jbcs-httpd24-mod_http2-0:1.15.7-21.el8jbcs	Fixed	RHSA-2021:4614
JBoss Core Services for RHEL 8	jbcs-httpd24-mod_jk-0:1.2.48-20.redhat_1.el8jbcs	Fixed	RHSA-2021:4614
JBoss Core Services for RHEL 8	jbcs-httpd24-mod_md-1:2.0.8-40.el8jbcs	Fixed	RHSA-2021:4614
JBoss Core Services for RHEL 8	jbcs-httpd24-mod_security-0:2.9.2-67.GA.el8jbcs	Fixed	RHSA-2021:4614
JBoss Core Services for RHEL 8	jbcs-httpd24-nghttp2-0:1.39.2-39.el8jbcs	Fixed	RHSA-2021:4614
JBoss Core Services for RHEL 8	jbcs-httpd24-openssl-1:1.1.1g-8.el8jbcs	Fixed	RHSA-2021:4614
JBoss Core Services for RHEL 8	jbcs-httpd24-openssl-chil-0:1.0.0-7.el8jbcs	Fixed	RHSA-2021:4614
JBoss Core Services for RHEL 8	jbcs-httpd24-openssl-pkcs11-0:0.4.10-22.el8jbcs	Fixed	RHSA-2021:4614
JBoss Core Services on RHEL 7	jbcs-httpd24-apr-0:1.6.3-107.jbcs.el7	Fixed	RHSA-2021:4614
JBoss Core Services on RHEL 7	jbcs-httpd24-apr-util-0:1.6.1-84.jbcs.el7	Fixed	RHSA-2021:4614
JBoss Core Services on RHEL 7	jbcs-httpd24-curl-0:7.78.0-2.jbcs.el7	Fixed	RHSA-2021:4614
JBoss Core Services on RHEL 7	jbcs-httpd24-httpd-0:2.4.37-78.jbcs.el7	Fixed	RHSA-2021:4614
JBoss Core Services on RHEL 7	jbcs-httpd24-mod_cluster-native-0:1.3.16-9.Final_redhat_2.jbcs.el7	Fixed	RHSA-2021:4614
JBoss Core Services on RHEL 7	jbcs-httpd24-mod_http2-0:1.15.7-21.jbcs.el7	Fixed	RHSA-2021:4614
JBoss Core Services on RHEL 7	jbcs-httpd24-mod_jk-0:1.2.48-20.redhat_1.jbcs.el7	Fixed	RHSA-2021:4614
JBoss Core Services on RHEL 7	jbcs-httpd24-mod_md-1:2.0.8-40.jbcs.el7	Fixed	RHSA-2021:4614
JBoss Core Services on RHEL 7	jbcs-httpd24-mod_security-0:2.9.2-67.GA.jbcs.el7	Fixed	RHSA-2021:4614
JBoss Core Services on RHEL 7	jbcs-httpd24-nghttp2-0:1.39.2-39.jbcs.el7	Fixed	RHSA-2021:4614
JBoss Core Services on RHEL 7	jbcs-httpd24-openssl-1:1.1.1g-8.jbcs.el7	Fixed	RHSA-2021:4614
JBoss Core Services on RHEL 7	jbcs-httpd24-openssl-chil-0:1.0.0-7.jbcs.el7	Fixed	RHSA-2021:4614
JBoss Core Services on RHEL 7	jbcs-httpd24-openssl-pkcs11-0:0.4.10-22.jbcs.el7	Fixed	RHSA-2021:4614
Red Hat JBoss Core Services	httpd	Fixed	RHSA-2021:4613
Red Hat Enterprise Linux 6	httpd	Not affected	n/a
Red Hat Enterprise Linux 7	httpd	Out of support scope	n/a
Red Hat Enterprise Linux 8	httpd:2.4/httpd	Will not fix	n/a
Red Hat Enterprise Linux 9	httpd	Not affected	n/a
Red Hat JBoss Enterprise Application Platform 6	httpd22	Out of support scope	n/a
Red Hat JBoss Enterprise Web Server 2	httpd22	Out of support scope	n/a
Red Hat Software Collections	httpd24-httpd	Will not fix	n/a

Remediation

Red Hat mitigation

Only configurations which use mod_proxy_wstunnel are affected by this flaw. It is also safe to comment-out the "LoadModule proxy_wstunnel_module ... " line in /etc/httpd/conf.modules.d/00-proxy.conf for configurations which do not rely on a websockets reverse proxy.

Weaknesses (2)

CWE-287

Improper Authentication

CWE-444

References (16)

http://httpd.apache.org/security/vulnerabilities_24.html
Release NotesVendor Advisory
http://www.openwall.com/lists/oss-security/2021/06/10/2
mailing-listMailing ListMitigationThird Party Advisory
https://access.redhat.com/security/cve/CVE-2019-17567
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1966740
Issue Tracking
https://httpd.apache.org/security/vulnerabilities_24.html
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd%40%3Cdev.httpd.apache.org%3E
mailing-list
https://lists.apache.org/thread.html/r90f693a5c9fb75550ef1412436d5e682a5f845beb427fa6f23419a3c%40%3Cannounce.httpd.apache.org%3E
mailing-list
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E
Mailing ListVendor Advisory
https://lists.debian.org/debian-lts-announce/2024/05/msg00013.html
mailing-list
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/
vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/
vendor-advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-17567
https://security.gentoo.org/glsa/202107-38
vendor-advisoryThird Party Advisory
https://security.netapp.com/advisory/ntap-20210702-0001/
Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2019-17567
https://www.oracle.com/security-alerts/cpuoct2021.html
Third Party Advisory

Link	Providers	Tags
http://httpd.apache.org/security/vulnerabilities_24.html		Release NotesVendor Advisory
http://www.openwall.com/lists/oss-security/2021/06/10/2		mailing-listMailing ListMitigationThird Party Advisory
https://access.redhat.com/security/cve/CVE-2019-17567		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1966740		Issue Tracking
https://httpd.apache.org/security/vulnerabilities_24.html
https://lists.apache.org/thread.html/r7f2b70b621651548f4b6f027552f1dd91705d7111bb5d15cda0a68dd%40%3Cdev.httpd.apache.org%3E		mailing-list
https://lists.apache.org/thread.html/r90f693a5c9fb75550ef1412436d5e682a5f845beb427fa6f23419a3c%40%3Cannounce.httpd.apache.org%3E		mailing-list
https://lists.apache.org/thread.html/re026d3da9d7824bd93b9f871c0fdda978d960c7e62d8c43cba8d0bf3%40%3Ccvs.httpd.apache.org%3E		Mailing ListVendor Advisory
https://lists.debian.org/debian-lts-announce/2024/05/msg00013.html		mailing-list
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPBR6WUYBJNACHKE65SPL7TJOHX7RHWD/		vendor-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNCYSR3BXT36FFF4XTCPL3HDQK4VP45R/		vendor-advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-17567
https://security.gentoo.org/glsa/202107-38		vendor-advisoryThird Party Advisory
https://security.netapp.com/advisory/ntap-20210702-0001/		Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2019-17567
https://www.oracle.com/security-alerts/cpuoct2021.html		Third Party Advisory