CVE-2012-4557: Medium severity apache http server vulnerability
The modproxyajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long request-processing time, which allows remote attackers to cause a denial of service (worker consumption) via an expensive request.
Other sources
When modproxyajp sends a request to a worker node and the time to process that request exceeds the configured timeout, the worker node will be marked as in the error state, stopping all traffic to the node until it is flagged as up again. A remote attacker could use this flaw to trigger a temporary denial of service attack, provided they were able to create a request that caused sufficient processing time to exceed the timeout threshold.
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2012-4557?
CVE-2012-4557 is rated as a medium severity vulnerability that can lead to a denial of service.
How do I fix CVE-2012-4557?
To fix CVE-2012-4557, upgrade the Apache HTTP Server to version 2.2.22 or later.
What versions are affected by CVE-2012-4557?
CVE-2012-4557 affects Apache HTTP Server versions 2.2.12 through 2.2.21.
What type of attack does CVE-2012-4557 facilitate?
CVE-2012-4557 allows remote attackers to cause a denial of service via expensive requests.
Is CVE-2012-4557 limited to specific platforms?
CVE-2012-4557 is specific to the Apache HTTP Server and can occur on any platform running the affected versions.