PT-2018-3178 · Apache+5 · Apache Http Server+5

Robert Swiecki · Published 2018-03-21 · Updated 2021-06-06 · CVE-2018-1301

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions prior to 2.4.30

Description A specially crafted request could crash the server due to an out of bound access after a size limit is reached by reading the HTTP header. This issue is considered very hard if not impossible to trigger in non-debug mode, so it is classified as low risk for common server usage. The issue is related to an out of bound access in memory after reaching the size limit by reading the HTTP header, which could allow a remote attacker to cause a denial of service.

Recommendations For versions prior to 2.4.30, update to version 2.4.30 or later to resolve the issue. As a temporary workaround, consider restricting access to the server or implementing additional security measures to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2018-1519

BDU:2019-04309

CESA-2020_1121

CVE-2018-1301

DLA-1389-1

DSA-4164-1

MGASA-2018-0460

RHSA-2018:3558

RHSA-2019:0367

RHSA-2020:1121

RHSA-2020_1121

SUSE-SU-2018:0879-1

SUSE-SU-2018:0901-1

SUSE-SU-2018:1079-1

SUSE-SU-2018:1161-1

SUSE-SU-2018:1161-2

USN-3627-1

USN-3627-2

USN-3937-2

Affected Products

Alt Linux

Apache Http Server

Centos

Red Hat

Suse

Ubuntu

References · 122

• https://usn.ubuntu.com/3937-2 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04309 · Security Note
• https://osv.dev/vulnerability/USN-3627-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1303 · Security Note
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20210611SE16 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:0367 · Vendor Advisory
• https://debian.org/security/2018/dsa-4164 · Vendor Advisory
• https://httpd.apache.org/security/vulnerabilities_24.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-1301 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04105 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1312 · Security Note
• https://access.redhat.com/errata/RHSA-2019:0366 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1312 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01564 · Security Note
• https://osv.dev/vulnerability/DSA-4164-1 · Vendor Advisory