PT-2018-3180 · Apache+3 · Apache Http Server+3

Craig Young

·

Publicado

2018-06-18

·

Atualizado

2021-06-06

·

CVE-2018-1333

CVSS v3.1

7.5

Alta

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.18 through 2.4.30, 2.4.33
Description The issue is related to the allocation of workers in response to specially crafted HTTP/2 requests, leading to worker exhaustion and a denial of service. This can be exploited by sending specially crafted HTTP/2 requests, allowing a remote attacker to cause a denial of service. The issue only affects servers that have configured and enabled HTTP/2 support.
Recommendations For versions 2.4.18 through 2.4.30, 2.4.33, update to Apache HTTP Server 2.4.34 to resolve the issue. As a temporary workaround, consider disabling HTTP/2 support to minimize the risk of exploitation.

Correção

DoS

Resource Exhaustion

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

ALT-PU-2018-2068
BDU:2019-04311
CVE-2018-1333
MGASA-2018-0460
OPENSUSE-SU-2018_2397-1
OPENSUSE-SU-2018_2433-1
RHSA-2018:3558
RHSA-2019:0367
SUSE-SU-2018:2336-1
SUSE-SU-2018:2424-1
SUSE-SU-2018_2336-1
SUSE-SU-2018_2424-1
USN-3783-1

Produtos afetados

Alt Linux
Apache Http Server
Suse
Ubuntu