{"id":"CVE-2019-0215","aliases":["ALPINE-CVE-2019-0215","BELL-CVE-2019-0215","DEBIAN-CVE-2019-0215","DLA-3351-1","EUVD-2019-1003","GHSA-xpmg-8256-c52g","RHSA-2019:0980"],"status":"published","title":"In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location...","description":"In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.10366,"percentile":0.9578,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2019-04-08T19:25:45Z","modified":"2026-10-24T10:30:35Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"apache2","fixed_in":["2.4.39-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"apache2","fixed_in":["2.4.39-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"apache2","fixed_in":["2.4.39-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"apache2","fixed_in":["2.4.39-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"apache2","fixed_in":["2.4.39-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"apache2","fixed_in":["2.4.39-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"apache2","fixed_in":["2.4.39-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"apache2","fixed_in":["2.4.39-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"apache2","fixed_in":["2.4.39-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"apache2","fixed_in":["2.4.39-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"apache2","fixed_in":["2.4.39-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"apache2","fixed_in":["2.4.39-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"apache2","fixed_in":["2.4.39-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"apache2","fixed_in":["2.4.39-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"apache2","fixed_in":["2.4.39-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"apache2","fixed_in":["2.4.39-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"apache2","fixed_in":["2.4.39-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"apache2","fixed_in":["2.4.39-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"apache2","fixed_in":["2.4.39-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"apache2","fixed_in":["2.4.38-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"apache2","fixed_in":["2.4.38-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"apache2","fixed_in":["2.4.38-3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.39-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.38-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.38-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.38-3"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.38-3+deb10u9"}]}],"versions":["2.4.38-3","2.4.38-3+deb10u1","2.4.38-3+deb10u2","2.4.38-3+deb10u3","2.4.38-3+deb10u4","2.4.38-3+deb10u5","2.4.38-3+deb10u6","2.4.38-3+deb10u7","2.4.38-3+deb10u8"],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-11.module+el8.0.0+2969+90015743"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"httpd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-11.module+el8.0.0+2969+90015743"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"httpd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-11.module+el8.0.0+2969+90015743"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"httpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-11.module+el8.0.0+2969+90015743"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"httpd-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-11.module+el8.0.0+2969+90015743"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"httpd-manual","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-11.module+el8.0.0+2969+90015743"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"httpd-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-11.module+el8.0.0+2969+90015743"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"httpd-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-11.module+el8.0.0+2969+90015743"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.3-2.module+el8.0.0+2969+90015743"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_http2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.3-2.module+el8.0.0+2969+90015743"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_http2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.3-2.module+el8.0.0+2969+90015743"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-11.module+el8.0.0+2969+90015743"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-11.module+el8.0.0+2969+90015743"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_md","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-11.module+el8.0.0+2969+90015743"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_md-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-11.module+el8.0.0+2969+90015743"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_proxy_html","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-11.module+el8.0.0+2969+90015743"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_proxy_html-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-11.module+el8.0.0+2969+90015743"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_session","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-11.module+el8.0.0+2969+90015743"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_session-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.37-11.module+el8.0.0+2969+90015743"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_ssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-11.module+el8.0.0+2969+90015743"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_ssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.37-11.module+el8.0.0+2969+90015743"}]}],"bundled":2}],"products":[{"vendor":"apache","product":"apache http server"},{"vendor":"apache","product":"http_server"},{"vendor":"apache software foundation","product":"apache http server"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2019/04/02/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Mitigation","Third Party Advisory","advisory"]},{"url":"https://lists.apache.org/thread.html/2d6bd429a0ba9af1580da896575cfca6e42bb05e7536562d4b095fcf%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/107667","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WETXNQWNQLWHV6XNW6YTO5UGDTIWAQGT/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EZRMTEIGZKYFNGIDOTXN3GNEJTLVCYU7/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","article"]},{"url":"https://support.f5.com/csp/article/K59440504","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20190423-0001/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:0980","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ALIR5S3O7NRHEGFMIDMUSYQIZOE4TJJN/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html","tags":["x_refsource_MISC","x_transferred","advisory"]},{"url":"https://lists.apache.org/thread.html/117bc3f09847ebf020b1bb70301ebcc105ddc446856150b63f37f8eb%40%3Cdev.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/bc1a6d4137798565ab02e60079b6788442147f4efeb4200c665bed5b%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/5b1e7d66c5adf286f14f6cc0f857b6fca107444f68aed9e70eedab47%40%3Cdev.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","tags":["x_refsource_MISC","x_transferred","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rd2fb621142e7fa187cfe12d7137bf66e7234abcbbcd800074c84a538%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/re473305a65b4db888e3556e4dae10c2a04ee89dcff2e26ecdbd860a9%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-0215","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/117bc3f09847ebf020b1bb70301ebcc105ddc446856150b63f37f8eb@%3Cdev.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/2d6bd429a0ba9af1580da896575cfca6e42bb05e7536562d4b095fcf@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/5b1e7d66c5adf286f14f6cc0f857b6fca107444f68aed9e70eedab47@%3Cdev.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/bc1a6d4137798565ab02e60079b6788442147f4efeb4200c665bed5b@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rd2fb621142e7fa187cfe12d7137bf66e7234abcbbcd800074c84a538@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/re473305a65b4db888e3556e4dae10c2a04ee89dcff2e26ecdbd860a9@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ALIR5S3O7NRHEGFMIDMUSYQIZOE4TJJN/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EZRMTEIGZKYFNGIDOTXN3GNEJTLVCYU7/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WETXNQWNQLWHV6XNW6YTO5UGDTIWAQGT/"},{"url":"https://github.com/advisories/GHSA-xpmg-8256-c52g"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-0215","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-0215","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-0215","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1694980","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1695025","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0980.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-0211","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-0211","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-0211","tags":["advisory"]},{"url":"http://www.apache.org/dist/httpd/CHANGES_2.4","tags":["article"]},{"url":"https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2019-0211","tags":["article"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-0215","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-0215","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-0215","description":"In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions.","status":"published","published":"2019-04-08T19:25:45Z","modified":"2024-08-04T17:44:15.365Z","updated_at":"2026-11-02T14:32:24.110857Z"}],"euvd":[{"id":"EUVD-2019-1003","description":"In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions.","status":"published","published":"2019-04-08T19:25:45Z","modified":"2024-08-04T17:44:15Z","updated_at":"2026-11-03T03:07:02.049822Z"}],"ghsa":[{"id":"GHSA-xpmg-8256-c52g","title":"In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location...","description":"In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions.","status":"published","published":"2022-05-13T01:09:38Z","modified":"2023-02-01T05:03:25Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T14:50:03.389119Z"}],"nvd":[{"id":"CVE-2019-0215","description":"In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions.","status":"published","published":"2019-04-08T20:29:10.003Z","modified":"2026-06-17T02:07:59.66Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6,"vector":"AV:N/AC:M/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:05:11.426883Z"}],"osv":[{"id":"ALPINE-CVE-2019-0215","description":"In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions.","status":"published","published":"2019-04-08T20:29:10.003Z","modified":"2026-09-21T06:17:52.441076386Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:47.663013Z"},{"id":"BELL-CVE-2019-0215","title":"CVE-2019-0215 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:15.42118Z","modified":"2026-01-26T09:49:32.51223Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2019-0215","description":"In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions.","status":"published","published":"2019-04-08T20:29:10.003Z","modified":"2026-10-24T10:30:35.1464451Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:10.051046Z"},{"id":"DEBIAN-CVE-2019-0215","description":"In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions.","status":"published","published":"2019-04-08T20:29:10.003Z","modified":"2026-09-21T07:00:08.064710532Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.170944Z"},{"id":"RHSA-2019:0980","title":"Red Hat Security Advisory: httpd:2.4 security update","status":"published","published":"2024-09-16T02:21:43Z","modified":"2026-09-21T10:02:07Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"DLA-3351-1","title":"apache2 - security update","status":"published","published":"2023-03-03T00:00:00Z","modified":"2026-03-09T01:23:13.027947Z","updated_at":"2026-11-02T15:46:11.734021Z"}]}}