CVE-2019-17567
httpd: mod_proxy_wstunnel tunneling of non Upgraded connection
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · June 4, 2021
Updated · September 21, 2026
Description
A flaw was found in Apache httpd. The mod_proxy_wstunnel module tunnels non-upgraded connections.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
Only configurations which use mod_proxy_wstunnel are affected by this flaw. It is also safe to comment-out the "LoadModule proxy_wstunnel_module ... " line in /etc/httpd/conf.modules.d/00-proxy.conf for configurations which do not rely on a websockets reverse proxy.
CVSS / CWE
CVSS 3.1 · 4.8CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
CWE-287 · Improper Authentication