Apache 2

Tenable plugin 121355 fires on Apache HTTP Server versions below 2.4.38, but it is really a bundle of three different issues fixed by the 2019-02-28 upstream release. CVE-2018-17189 is an HTTP/2 slow-body thread exhaustion bug that only matters when mod_http2 is enabled; CVE-2018-17199 is a mod_session_cookie expiry-handling flaw affecting 2.4.37 and earlier; and CVE-2019-0190 is a mod_ssl renegotiation DoS that only affects exactly 2.4.37 when paired with OpenSSL 1.1.1 or later.

The vendor's HIGH label is too generous for most estates because the reachable population collapses fast once you account for optional modules, exact-version gating, and banner-based detection. This is not a one-shot pre-auth RCE across generic Apache exposure; it is mostly conditional DoS plus one niche session-integrity bug, so in real enterprise patch queues it belongs in the middle tier unless you confirm those modules are exposed on internet-facing systems.

Why this verdict

• Vendor HIGH is inflated by bundling. Tenable rolls three unrelated issues into one plugin and inherits the top score from CVE-2018-17199, even though the bundle is not uniformly reachable.
• Feature prerequisites cut the exposed population hard. CVE-2018-17189 needs mod_http2, CVE-2018-17199 needs mod_session_cookie, and CVE-2019-0190 needs exactly 2.4.37 plus OpenSSL 1.1.1+; each prerequisite narrows the real attack surface.
• This is mostly availability impact, not takeover. Two of the three CVEs are DoS-only, and the third is a session-expiry integrity flaw rather than code execution or broad auth bypass.
• Attacker position is remote, but not broad-compromise remote. A remote unauthenticated attacker can hit the service, but only after the deployment has already opted into the right module stack; that is meaningful downward pressure from a 10,000-host triage perspective.
• Detection quality is noisy. Nessus explicitly says it did not test the flaws and relied on the application's self-reported version, which means distro backports and custom packaging can create false positives or at least overstated urgency.

Why not higher?

There is no credible RCE story here, no KEV listing, and no strong public exploitation signal in the reviewed sources. The main amplifier for a HIGH or CRITICAL call would be broad pre-auth compromise across default deployments, and this bundle simply does not meet that bar.

Why not lower?

It is still remote and externally reachable where the affected modules are enabled, and one bundled issue carries real integrity impact if mod_session_cookie is part of the auth/session design. On older internet-facing Apache tiers without reverse-proxy offload, the DoS paths are operationally relevant enough that this should not be ignored entirely.

1. Disable unused Apache modules — Turn off mod_http2 and mod_session_cookie anywhere they are not explicitly required. This is the cleanest way to collapse exposure for two of the three bundled issues, and because the reassessed verdict is MEDIUM there is no mitigation SLA — use this as exposure reduction while you work inside the 365-day remediation window.
2. Terminate HTTP/2 and TLS upstream — Prefer CDN, reverse proxy, or load balancer termination so Apache never directly processes hostile HTTP/2 or renegotiation traffic. This is especially useful for older internet-facing estates where upgrading lags, and again there is no mitigation SLA for a MEDIUM verdict.
3. Enforce application-side session expiry — Do not rely on Apache mod_session_cookie alone for session lifetime decisions. Have the application or IdP validate session age server-side so the cookie-expiry bug cannot silently extend a session's trust lifetime.
4. Rate-limit slow request patterns — Use the front-end proxy, CDN, or WAF to cap slow body uploads, concurrent HTTP/2 streams, and abusive connection behavior. This will not fix the bug, but it materially reduces the practical DoS path on exposed web tiers.

Run this on the target Apache host as a local auditor or via your config-management/remote shell tooling. Invoke it as bash verify_apache_121355.sh with no arguments; root is not usually required, but elevated rights may help apachectl -M succeed on locked-down systems. The script outputs VULNERABLE, PATCHED, or UNKNOWN and intentionally returns UNKNOWN for distro-backported builds it cannot safely prove either way.

#!/usr/bin/env bash
# verify_apache_121355.sh
# Best-effort verifier for Tenable plugin 121355
# Checks Apache version plus module/library gates for:
# - CVE-2018-17189 (mod_http2 DoS)
# - CVE-2018-17199 (mod_session_cookie expiry bug)
# - CVE-2019-0190 (2.4.37 + mod_ssl + OpenSSL 1.1.1+ DoS)
#
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

set -u

say() { printf '%s\n' "$1"; }

find_ctl() {
  for c in apache2ctl apachectl httpd apache2; do
    if command -v "$c" >/dev/null 2>&1; then
      echo "$c"
      return 0
    fi
  done
  return 1
}

ver_to_int() {
  # 2.4.37 -> 002004037
  local IFS=.
  local parts=($1)
  printf '%03d%03d%03d' "${parts[0]:-0}" "${parts[1]:-0}" "${parts[2]:-0}"
}

pkg_backport_patched() {
  # Minimal known-good check for Debian stretch advisory DSA-4422-1.
  # If we cannot prove a backport, return 1 and let the higher-level logic decide.
  if command -v dpkg-query >/dev/null 2>&1; then
    local pkgver
    pkgver=$(dpkg-query -W -f='${Version}' apache2 2>/dev/null || true)
    if [[ -n "$pkgver" ]]; then
      if dpkg --compare-versions "$pkgver" ge '2.4.25-3+deb9u7'; then
        return 0
      fi
    fi
  fi
  return 1
}

CTL=$(find_ctl) || { say 'UNKNOWN - Apache control binary not found'; exit 2; }

VER_LINE=$($CTL -v 2>/dev/null | head -n1 || true)
RAW_VER=$(printf '%s' "$VER_LINE" | sed -n 's/.*Apache\/\([0-9][0-9.]*\).*/\1/p')

if [[ -z "$RAW_VER" ]]; then
  say 'UNKNOWN - Could not determine Apache version'
  exit 2
fi

# Normalize to major.minor.patch
IFS=. read -r VMAJ VMIN VPAT <<< "$RAW_VER"
VMAJ=${VMAJ:-0}
VMIN=${VMIN:-0}
VPAT=${VPAT:-0}
APACHE_VER="${VMAJ}.${VMIN}.${VPAT}"
APACHE_INT=$(ver_to_int "$APACHE_VER")
FIXED_INT=$(ver_to_int '2.4.38')
TARGET_2437_INT=$(ver_to_int '2.4.37')

if pkg_backport_patched; then
  say "PATCHED - Distro package backport detected for apache2 ($(dpkg-query -W -f='${Version}' apache2 2>/dev/null))"
  exit 0
fi

if [[ "$APACHE_INT" -ge "$FIXED_INT" ]]; then
  say "PATCHED - Apache version ${APACHE_VER} is >= 2.4.38"
  exit 0
fi

MODULES=$($CTL -M 2>/dev/null || true)
if [[ -z "$MODULES" ]]; then
  MODULES=$(httpd -M 2>/dev/null || true)
fi

has_http2=0
has_session_cookie=0
has_ssl=0

printf '%s\n' "$MODULES" | grep -Eq '(^|[[:space:]])(http2_module|h2_module)' && has_http2=1
printf '%s\n' "$MODULES" | grep -Eq '(^|[[:space:]])session_cookie_module' && has_session_cookie=1
printf '%s\n' "$MODULES" | grep -Eq '(^|[[:space:]])ssl_module' && has_ssl=1

OPENSSL_AFFECTED=0
if command -v openssl >/dev/null 2>&1; then
  OSSL_VER=$(openssl version 2>/dev/null | awk '{print $2}')
  if [[ -n "$OSSL_VER" ]]; then
    OSSL_BASE=${OSSL_VER%%[a-zA-Z]*}
    if [[ $(ver_to_int "$OSSL_BASE") -ge $(ver_to_int '1.1.1') ]]; then
      OPENSSL_AFFECTED=1
    fi
  fi
fi

# Exposure logic for this specific Tenable plugin bundle.
if [[ "$has_http2" -eq 1 || "$has_session_cookie" -eq 1 ]]; then
  say "VULNERABLE - Apache ${APACHE_VER} < 2.4.38 with relevant module(s) enabled (http2=${has_http2}, session_cookie=${has_session_cookie}, ssl=${has_ssl})"
  exit 1
fi

if [[ "$APACHE_INT" -eq "$TARGET_2437_INT" && "$has_ssl" -eq 1 && "$OPENSSL_AFFECTED" -eq 1 ]]; then
  say "VULNERABLE - Apache 2.4.37 with mod_ssl and OpenSSL >= 1.1.1 matches CVE-2019-0190 conditions"
  exit 1
fi

say "UNKNOWN - Apache ${APACHE_VER} is older than 2.4.38 but this script did not prove the vulnerable module/library path; check distro backports and module config manually"
exit 2

Sources

1. Tenable Nessus Plugin 121355
2. Apache HTTP Server 2.4 vulnerability history
3. NVD CVE-2018-17189
4. NVD CVE-2018-17199
5. Ubuntu CVE-2019-0190 notes
6. Apache HTTP/2 guide
7. Debian DSA-4422-1 backport advisory
8. CISA Known Exploited Vulnerabilities Catalog