CVE-2019-12412: libapreq2 null pointer dereference

[Joe Orton <jorton () apache org>]

CVE-2019-12412: libapreq2 null pointer dereference

Severity: important

Vendor: The Apache Software Foundation

Versions Affected:
libapreq2 2.07 to 2.13

Description:
In libapreq2 versions 2.07 through 2.13 inclusive, a flaw in the 
multipart parser can deference a null pointer leading to a process 
crash.  A remote attacker could send a request causing a process crash 
which could lead to a denial of service attack.

Mitigation:
disable the libapreq2 multipart parser

Credit:
Thanks to Max Kellerman and Salvatore Bonaccorso for finding and
reporting this issue.

References:
https://bugs.debian.org/939937