CVE-2014-0118: Medium severity apache http server vulnerability
The deflateinfilter function in moddeflate.c in the moddeflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted request data that decompresses to a much larger size.
Other sources
The following flaw has been fixed in the Apache HTTP Server:
"A resource consumption flaw was found in moddeflate. If request body decompression was configured (using the "DEFLATE" input filter), a remote attacker could cause the server to consume significant memory and/or CPU resources. The use of request body decompression is not a common configuration."
External References:
http://httpd.apache.org/security/vulnerabilities24.html
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0118?
CVE-2014-0118 has a severity rating indicating a denial of service risk due to excessive resource consumption.
How do I fix CVE-2014-0118?
To fix CVE-2014-0118, upgrade your Apache HTTP Server to version 2.4.10 or later.
Which versions of Apache HTTP Server are affected by CVE-2014-0118?
CVE-2014-0118 affects Apache HTTP Server versions prior to 2.4.10 and those between 2.2.0 and 2.2.29.
Can CVE-2014-0118 be exploited remotely?
Yes, CVE-2014-0118 can be exploited remotely through crafted request data if request body decompression is enabled.
What are the potential impacts of CVE-2014-0118?
The potential impacts of CVE-2014-0118 include denial of service, as attackers can consume excessive server resources.