PT-2018-3638 · Apache+2 · Apache Http Server+2

Daniel Caminada · Published 2018-03-09 · Updated 2021-06-06 · CVE-2018-8011

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache HTTP Server version 2.4.33

Description The issue is related to the mod md challenge handler, which can dereference a NULL pointer when specially crafted HTTP requests are made, causing the child process to segfault. This can be used to cause a denial of service (DoS) to the server.

Recommendations For Apache HTTP Server version 2.4.33, update to version 2.4.34 to resolve the issue. As a temporary workaround, consider restricting access to the mod md module to minimize the risk of exploitation.

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2018-2068

BDU:2021-01497

CVE-2018-8011

OPENSUSE-SU-2018_2433-1

SUSE-SU-2018:2424-1

Affected Products

Alt Linux

Apache Http Server

Suse

References · 46

• https://bdu.fstec.ru/vul/2021-01497 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-8011 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-8011 · Security Note
• https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2018-8011 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2018-8011 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04311 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-8011 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:2424-1 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2018-2068 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-8011 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1333 · Security Note
• https://osv.dev/vulnerability/CVE-2018-8011 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-8011 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8011 · Security Note
• https://cve.org/CVERecord?id=CVE-2018-8011 · Security Note