PT-2018-3177 · Apache+5 · Apache Http Server+5

Published 2018-03-21 · Updated 2021-06-06 · CVE-2018-1283

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Apache httpd versions 2.4.0 through 2.4.29

Description The issue arises when mod session is configured to forward its session data to CGI applications, allowing a remote user to influence their content by using a "Session" header. This is due to the "HTTP SESSION" variable name used by mod session, which conflicts with the prefix "HTTP " used by the Apache HTTP Server to pass HTTP header fields, per CGI specifications.

Recommendations For Apache httpd versions 2.4.0 through 2.4.29, consider disabling the mod session module or setting SessionEnv to off to prevent the exploitation of this issue. As a temporary workaround, restrict access to CGI applications that use the HTTP SESSION variable until a patch is available.

Fix

RCE

Use After Free

Weakness Enumeration

CWE-20

CWE-416

Related Identifiers

ALT-PU-2018-1519

BDU:2019-04308

CESA-2020_3958

CVE-2018-1283

DSA-4164-1

MGASA-2018-0460

RHSA-2018:3558

RHSA-2019:0367

RHSA-2020:3958

RHSA-2020_3958

SUSE-SU-2018:0879-1

SUSE-SU-2018:0901-1

SUSE-SU-2018:1161-1

SUSE-SU-2018:1161-2

USN-3627-1

USN-3627-2

Affected Products

Alt Linux

Apache Http Server

Centos

Red Hat

Suse

Ubuntu

References · 124

• https://bdu.fstec.ru/vul/2019-04309 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10098 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2018-1283 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3627-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1303 · Security Note
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20210611SE16 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:0367 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-1283 · Vendor Advisory
• https://debian.org/security/2018/dsa-4164 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-1283 · Security Note
• https://bdu.fstec.ru/vul/2019-04105 · Security Note
• https://bdu.fstec.ru/vul/2020-01010 · Security Note
• https://httpd.apache.org/security/vulnerabilities_24.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1312 · Security Note
• https://access.redhat.com/errata/RHSA-2019:0366 · Vendor Advisory