Skip to content
Fencer Vulns
medium 5.3

CVE-2019-17567 json

mod_proxy_wstunnel tunneling of non Upgraded connections

published 2021-06-10 5 y ago modified 2026-06-17 4 mo ago also EUVD-2019-7905

cvss
5.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
59.7%
EPSS 59.7% chance of exploitation in 30 days, percentile 99.1%
public exploits
0
none known

Summary

Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the whole connection regardless, thus allowing for subsequent requests on the same connection to pass through with no HTTP validation, authentication or authorization possibly configured.

Patch / fix

  • apache2 Debian 14, Debian 13, Debian 12 2.4.48-2

debian advisories DEBIAN-CVE-2019-17567

  • jbcs-httpd24-apr jboss core services 1 1.6.3-107.jbcs.el7
  • jbcs-httpd24-apr jboss core services 1 1.6.3-107.el8jbcs
  • jbcs-httpd24-curl jboss core services 1 7.78.0-2.jbcs.el7
  • jbcs-httpd24-curl jboss core services 1 7.78.0-2.el8jbcs
  • jbcs-httpd24-httpd jboss core services 1 2.4.37-78.jbcs.el7
  • jbcs-httpd24-httpd jboss core services 1 2.4.37-78.el8jbcs
  • jbcs-httpd24-mod_jk jboss core services 1 1.2.48-20.redhat_1.jbcs.el7
  • jbcs-httpd24-mod_jk jboss core services 1 1.2.48-20.redhat_1.el8jbcs

red hat advisories RHSA-2021:4614

  • httpd CBL-Mariner 2.0 2.4.52-1

azure linux advisories AZL-6473

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

  • apache Arch Linux 2.4.47-1

arch linux advisories AVG-2053

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-17567 updated cvss 4.8

httpd: mod_proxy_wstunnel tunneling of non Upgraded connection

  • Red Hat Enterprise Linux 7 httpd, mod_ssl, mod_ldap, httpd-tools, mod_session, httpd-manual, +1 more
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 httpd, mod_md, mod_ssl, mod_ldap, mod_http2, httpd-tools, +4 more
    affected: workaround, no fix planned “Will not fix”
  • Red Hat JBoss Enterprise Application Platform 6 httpd22 httpd22 Red Hat JBoss Enterprise Web Server 2 httpd22 httpd22
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Software Collections httpd24-httpd, httpd24-mod_md, httpd24-mod_ssl, httpd24-mod_ldap, httpd24-httpd-tools, httpd24-mod_session, +2 more
    affected: workaround, no fix planned “Will not fix”
  • Red Hat JBoss Core Services
    fixed: vendor fix RHSA-2021:4613
  • Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-apr 1.6.3-107.jbcs.el7, jbcs-httpd24-curl 7.78.0-2.jbcs.el7, jbcs-httpd24-httpd 2.4.37-78.jbcs.el7, jbcs-httpd24-mod_md 2.0.8-40.jbcs.el7, jbcs-httpd24-libcurl 7.78.0-2.jbcs.el7, jbcs-httpd24-openssl 1.1.1g-8.jbcs.el7, +26 more Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-apr 1.6.3-107.el8jbcs, jbcs-httpd24-curl 7.78.0-2.el8jbcs, jbcs-httpd24-httpd 2.4.37-78.el8jbcs, jbcs-httpd24-mod_md 2.0.8-40.el8jbcs, jbcs-httpd24-libcurl 7.78.0-2.el8jbcs, jbcs-httpd24-openssl 1.1.1g-8.el8jbcs, +26 more
    fixed: vendor fix RHSA-2021:4614
  • Red Hat Enterprise Linux 6 httpd, mod_ssl, httpd-tools, httpd-manual Red Hat Enterprise Linux 9 httpd, mod_lua, mod_ssl, mod_ldap, httpd-core, httpd-tools, +4 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

59.73% chance of exploitation in the next 30 days, higher than 99.1% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected products

  • Apache Software Foundation Apache HTTP Server

Classification

Weakness
  • CWE-444 Inconsistent Interpretation of HTTP Requests
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.