Patchwire CVEs, their patch status, and feeds to follow them

CVE-2019-0220

Fixed in a distro release EPSS 18%

A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive slashes ('/'), directives such as LocationMatch and RewriteRule must account for duplicates in regular expressions while other aspects of the servers processing will implicitly collapse them.

Published 2019-06-11 · CVE record · OSV

Products: Apache Software Foundation Apache HTTP Server

Distro releases

ReleasePackageFixed in
Alpine:v3.10apache22.4.39-r0
Alpine:v3.11apache22.4.39-r0
Alpine:v3.12apache22.4.39-r0
Alpine:v3.13apache22.4.39-r0
Alpine:v3.14apache22.4.39-r0
Alpine:v3.15apache22.4.39-r0
Alpine:v3.16apache22.4.39-r0
Alpine:v3.17apache22.4.39-r0
Alpine:v3.18apache22.4.39-r0
Alpine:v3.19apache22.4.39-r0
Alpine:v3.20apache22.4.39-r0
Alpine:v3.21apache22.4.39-r0
Alpine:v3.22apache22.4.39-r0
Alpine:v3.23apache22.4.39-r0
Alpine:v3.24apache22.4.39-r0
Alpine:v3.6apache22.4.39-r0
Alpine:v3.7apache22.4.39-r0
Alpine:v3.8apache22.4.39-r0
Alpine:v3.9apache22.4.39-r0
Debian:12apache22.4.38-3
Debian:13apache22.4.38-3
Debian:14apache22.4.38-3
Debian:8apache22.4.10-10+deb8u14
Debian:9apache22.4.25-3+deb9u7
Red Hat:enterprise_linux:7httpd0:2.4.6-90.el7
Red Hat:enterprise_linux:7httpd-debuginfo0:2.4.6-90.el7
Red Hat:enterprise_linux:7httpd-devel0:2.4.6-90.el7
Red Hat:enterprise_linux:7httpd-manual0:2.4.6-90.el7
Red Hat:enterprise_linux:7httpd-tools0:2.4.6-90.el7
Red Hat:enterprise_linux:7mod_ldap0:2.4.6-90.el7
Red Hat:enterprise_linux:7mod_proxy_html1:2.4.6-90.el7
Red Hat:enterprise_linux:7mod_session0:2.4.6-90.el7
Red Hat:enterprise_linux:7mod_ssl1:2.4.6-90.el7
Red Hat:enterprise_linux:8httpd0:2.4.37-16.module+el8.1.0+4134+e6bad0ed
Red Hat:enterprise_linux:8httpd-debuginfo0:2.4.37-16.module+el8.1.0+4134+e6bad0ed
Red Hat:enterprise_linux:8httpd-debugsource0:2.4.37-16.module+el8.1.0+4134+e6bad0ed
Red Hat:enterprise_linux:8httpd-devel0:2.4.37-16.module+el8.1.0+4134+e6bad0ed
Red Hat:enterprise_linux:8httpd-filesystem0:2.4.37-16.module+el8.1.0+4134+e6bad0ed
Red Hat:enterprise_linux:8httpd-manual0:2.4.37-16.module+el8.1.0+4134+e6bad0ed
Red Hat:enterprise_linux:8httpd-tools0:2.4.37-16.module+el8.1.0+4134+e6bad0ed
Red Hat:enterprise_linux:8httpd-tools-debuginfo0:2.4.37-16.module+el8.1.0+4134+e6bad0ed
Red Hat:enterprise_linux:8mod_http20:1.11.3-3.module+el8.1.0+4134+e6bad0ed
Red Hat:enterprise_linux:8mod_http2-debuginfo0:1.11.3-3.module+el8.1.0+4134+e6bad0ed
Red Hat:enterprise_linux:8mod_http2-debugsource0:1.11.3-3.module+el8.1.0+4134+e6bad0ed
Red Hat:enterprise_linux:8mod_ldap0:2.4.37-16.module+el8.1.0+4134+e6bad0ed
Red Hat:enterprise_linux:8mod_ldap-debuginfo0:2.4.37-16.module+el8.1.0+4134+e6bad0ed
Red Hat:enterprise_linux:8mod_md0:2.4.37-16.module+el8.1.0+4134+e6bad0ed
Red Hat:enterprise_linux:8mod_md-debuginfo0:2.4.37-16.module+el8.1.0+4134+e6bad0ed
Red Hat:enterprise_linux:8mod_proxy_html1:2.4.37-16.module+el8.1.0+4134+e6bad0ed
Red Hat:enterprise_linux:8mod_proxy_html-debuginfo1:2.4.37-16.module+el8.1.0+4134+e6bad0ed
Red Hat:enterprise_linux:8mod_session0:2.4.37-16.module+el8.1.0+4134+e6bad0ed
Red Hat:enterprise_linux:8mod_session-debuginfo0:2.4.37-16.module+el8.1.0+4134+e6bad0ed
Red Hat:enterprise_linux:8mod_ssl1:2.4.37-16.module+el8.1.0+4134+e6bad0ed
Red Hat:enterprise_linux:8mod_ssl-debuginfo1:2.4.37-16.module+el8.1.0+4134+e6bad0ed
Red Hat:jboss_core_services:1jbcs-httpd24-apr0:1.6.3-73.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-apr0:1.6.3-73.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-apr-debuginfo0:1.6.3-73.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-apr-debuginfo0:1.6.3-73.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-apr-devel0:1.6.3-73.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-apr-devel0:1.6.3-73.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util0:1.6.1-54.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util0:1.6.1-54.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util-debuginfo0:1.6.1-54.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util-debuginfo0:1.6.1-54.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util-devel0:1.6.1-54.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util-devel0:1.6.1-54.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util-ldap0:1.6.1-54.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util-ldap0:1.6.1-54.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util-mysql0:1.6.1-54.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util-mysql0:1.6.1-54.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util-nss0:1.6.1-54.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util-nss0:1.6.1-54.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util-odbc0:1.6.1-54.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util-odbc0:1.6.1-54.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util-openssl0:1.6.1-54.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util-openssl0:1.6.1-54.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util-pgsql0:1.6.1-54.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util-pgsql0:1.6.1-54.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util-sqlite0:1.6.1-54.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-apr-util-sqlite0:1.6.1-54.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-brotli0:1.0.6-9.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-brotli0:1.0.6-9.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-brotli-debuginfo0:1.0.6-9.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-brotli-debuginfo0:1.0.6-9.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-brotli-devel0:1.0.6-9.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-brotli-devel0:1.0.6-9.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-curl0:7.64.1-21.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-curl0:7.64.1-21.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-curl-debuginfo0:7.64.1-21.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-curl-debuginfo0:7.64.1-21.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-httpd0:2.4.37-41.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-httpd0:2.4.37-41.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-httpd-debuginfo0:2.4.37-41.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-httpd-debuginfo0:2.4.37-41.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-httpd-devel0:2.4.37-41.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-httpd-devel0:2.4.37-41.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-httpd-manual0:2.4.37-41.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-httpd-manual0:2.4.37-41.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-httpd-selinux0:2.4.37-41.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-httpd-selinux0:2.4.37-41.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-httpd-tools0:2.4.37-41.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-httpd-tools0:2.4.37-41.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-jansson0:2.11-24.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-jansson0:2.11-24.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-jansson-debuginfo0:2.11-24.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-jansson-debuginfo0:2.11-24.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-jansson-devel0:2.11-24.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-jansson-devel0:2.11-24.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-libcurl0:7.64.1-21.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-libcurl0:7.64.1-21.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-libcurl-devel0:7.64.1-21.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-libcurl-devel0:7.64.1-21.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-mod_cluster-native0:1.3.12-13.Final_redhat_2.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-mod_cluster-native0:1.3.12-13.Final_redhat_2.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-mod_cluster-native-debuginfo0:1.3.12-13.Final_redhat_2.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-mod_cluster-native-debuginfo0:1.3.12-13.Final_redhat_2.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-mod_http20:1.11.3-8.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-mod_http20:1.11.3-8.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-mod_http2-debuginfo0:1.11.3-8.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-mod_http2-debuginfo0:1.11.3-8.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-mod_jk0:1.2.46-26.redhat_1.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-mod_jk0:1.2.46-26.redhat_1.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-mod_jk-ap240:1.2.46-26.redhat_1.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-mod_jk-ap240:1.2.46-26.redhat_1.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-mod_jk-debuginfo0:1.2.46-26.redhat_1.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-mod_jk-debuginfo0:1.2.46-26.redhat_1.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-mod_jk-manual0:1.2.46-26.redhat_1.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-mod_jk-manual0:1.2.46-26.redhat_1.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-mod_ldap0:2.4.37-41.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-mod_ldap0:2.4.37-41.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-mod_md1:2.0.8-10.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-mod_md1:2.0.8-10.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-mod_md-debuginfo1:2.0.8-10.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-mod_md-debuginfo1:2.0.8-10.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-mod_proxy_html1:2.4.37-41.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-mod_proxy_html1:2.4.37-41.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-mod_security0:2.9.2-20.GA.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-mod_security0:2.9.2-20.GA.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-mod_security-debuginfo0:2.9.2-20.GA.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-mod_security-debuginfo0:2.9.2-20.GA.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-mod_session0:2.4.37-41.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-mod_session0:2.4.37-41.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-mod_ssl1:2.4.37-41.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-mod_ssl1:2.4.37-41.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-nghttp20:1.39.2-10.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-nghttp20:1.39.2-10.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-nghttp2-debuginfo0:1.39.2-10.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-nghttp2-debuginfo0:1.39.2-10.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-nghttp2-devel0:1.39.2-10.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-nghttp2-devel0:1.39.2-10.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-openssl1:1.1.1c-4.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-openssl1:1.1.1c-4.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-openssl-debuginfo1:1.1.1c-4.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-openssl-debuginfo1:1.1.1c-4.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-openssl-devel1:1.1.1c-4.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-openssl-devel1:1.1.1c-4.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-openssl-libs1:1.1.1c-4.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-openssl-libs1:1.1.1c-4.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-openssl-perl1:1.1.1c-4.jbcs.el7
Red Hat:jboss_core_services:1jbcs-httpd24-openssl-perl1:1.1.1c-4.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-openssl-static1:1.1.1c-4.jbcs.el6
Red Hat:jboss_core_services:1jbcs-httpd24-openssl-static1:1.1.1c-4.jbcs.el7
Red Hat:rhel_software_collections:3httpd240:1.1-19.el6
Red Hat:rhel_software_collections:3httpd240:1.1-19.el7
Red Hat:rhel_software_collections:3httpd24-build0:1.1-19.el6
Red Hat:rhel_software_collections:3httpd24-httpd0:2.4.34-15.el6
Red Hat:rhel_software_collections:3httpd24-httpd0:2.4.34-15.el7
Red Hat:rhel_software_collections:3httpd24-httpd-debuginfo0:2.4.34-15.el6
Red Hat:rhel_software_collections:3httpd24-httpd-debuginfo0:2.4.34-15.el7
Red Hat:rhel_software_collections:3httpd24-httpd-devel0:2.4.34-15.el6
Red Hat:rhel_software_collections:3httpd24-httpd-devel0:2.4.34-15.el7
Red Hat:rhel_software_collections:3httpd24-httpd-manual0:2.4.34-15.el7
Red Hat:rhel_software_collections:3httpd24-httpd-manual0:2.4.34-15.el6
Red Hat:rhel_software_collections:3httpd24-httpd-tools0:2.4.34-15.el7
Red Hat:rhel_software_collections:3httpd24-httpd-tools0:2.4.34-15.el6
Red Hat:rhel_software_collections:3httpd24-libnghttp20:1.7.1-8.el7
Red Hat:rhel_software_collections:3httpd24-libnghttp20:1.7.1-8.el6
Red Hat:rhel_software_collections:3httpd24-libnghttp2-devel0:1.7.1-8.el7
Red Hat:rhel_software_collections:3httpd24-libnghttp2-devel0:1.7.1-8.el6
Red Hat:rhel_software_collections:3httpd24-mod_ldap0:2.4.34-15.el7
Red Hat:rhel_software_collections:3httpd24-mod_ldap0:2.4.34-15.el6
Red Hat:rhel_software_collections:3httpd24-mod_md0:2.4.34-15.el7
Red Hat:rhel_software_collections:3httpd24-mod_proxy_html1:2.4.34-15.el6
Red Hat:rhel_software_collections:3httpd24-mod_proxy_html1:2.4.34-15.el7
Red Hat:rhel_software_collections:3httpd24-mod_session0:2.4.34-15.el6
Red Hat:rhel_software_collections:3httpd24-mod_session0:2.4.34-15.el7
Red Hat:rhel_software_collections:3httpd24-mod_ssl1:2.4.34-15.el7
Red Hat:rhel_software_collections:3httpd24-mod_ssl1:2.4.34-15.el6
Red Hat:rhel_software_collections:3httpd24-nghttp20:1.7.1-8.el7
Red Hat:rhel_software_collections:3httpd24-nghttp20:1.7.1-8.el6
Red Hat:rhel_software_collections:3httpd24-nghttp2-debuginfo0:1.7.1-8.el7
Red Hat:rhel_software_collections:3httpd24-nghttp2-debuginfo0:1.7.1-8.el6
Red Hat:rhel_software_collections:3httpd24-runtime0:1.1-19.el6
Red Hat:rhel_software_collections:3httpd24-runtime0:1.1-19.el7
Red Hat:rhel_software_collections:3httpd24-scldevel0:1.1-19.el7
Red Hat:rhel_software_collections:3httpd24-scldevel0:1.1-19.el6
SUSE:Enterprise Storage 4apache22.4.23-29.40.1
SUSE:Linux Enterprise Module for Server Applications 15apache22.4.33-3.15.1
SUSE:Linux Enterprise Server 12 SP1-LTSSapache22.4.16-20.24.1
SUSE:Linux Enterprise Server 12 SP2-BCLapache22.4.23-29.40.1
SUSE:Linux Enterprise Server 12 SP2-LTSSapache22.4.23-29.40.1
SUSE:Linux Enterprise Server 12 SP3apache22.4.23-29.40.1
SUSE:Linux Enterprise Server 12 SP4apache22.4.23-29.40.1
SUSE:Linux Enterprise Server 12-LTSSapache22.4.10-14.36.1
SUSE:Linux Enterprise Server for SAP Applications 12 SP1apache22.4.16-20.24.1
SUSE:Linux Enterprise Server for SAP Applications 12 SP2apache22.4.23-29.40.1
SUSE:Linux Enterprise Server for SAP Applications 12 SP3apache22.4.23-29.40.1
SUSE:Linux Enterprise Server for SAP Applications 12 SP4apache22.4.23-29.40.1
SUSE:Linux Enterprise Software Development Kit 12 SP3apache22.4.23-29.40.1
SUSE:Linux Enterprise Software Development Kit 12 SP4apache22.4.23-29.40.1
SUSE:OpenStack Cloud 7apache22.4.23-29.40.1
Ubuntu:14.04:LTSapache22.4.7-1ubuntu4.22
Ubuntu:16.04:LTSapache22.4.18-2ubuntu3.10
Ubuntu:18.04:LTSapache22.4.29-1ubuntu4.6
openSUSE:Leap 15.0apache22.4.33-lp150.2.17.1