CVE-2018-11773: Input Validation
First published: Mon Jul 29 2019(Updated: )
Apache VCL versions 2.1 through 2.5 do not properly validate form input when processing a submitted block allocation. The form data is then used as an argument to the php built in function strtotime. This allows for an attack against the underlying implementation of that function. The implementation of strtotime at the time the issue was discovered appeared to be resistant to a malicious attack. However, all VCL systems running versions earlier than 2.5.1 should be upgraded or patched. This vulnerability was found and reported to the Apache VCL project by ADLab of Venustech.
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Virtual Computing Lab | >=2.1<=2.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://lists.apache.org/thread.html/8f3284afbcb4b87ed107dac98603020c23a379c687858b41da763147@%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/db71c4edc21ecb834cf20e3ee23ffac5d37f32e7eb67257a413bf878@%3Cdev.vcl.apache.org%3E
- https://lists.apache.org/thread.html/db71c4edc21ecb834cf20e3ee23ffac5d37f32e7eb67257a413bf878%40%3Cdev.vcl.apache.org%3E
- https://lists.apache.org/thread.html/8f3284afbcb4b87ed107dac98603020c23a379c687858b41da763147%40%3Cannounce.apache.org%3E
Frequently Asked Questions
What is the severity of CVE-2018-11773?
CVE-2018-11773 has a medium severity rating due to its potential to be exploited via improper input validation.
How do I fix CVE-2018-11773?
To fix CVE-2018-11773, upgrade Apache VCL to version 2.6 or later where this vulnerability has been addressed.
What versions are affected by CVE-2018-11773?
CVE-2018-11773 affects Apache VCL versions from 2.1 to 2.5 inclusive.
What type of vulnerability is CVE-2018-11773?
CVE-2018-11773 is an input validation vulnerability that can lead to attacks exploiting the strtotime function in PHP.
Can CVE-2018-11773 be exploited remotely?
Yes, CVE-2018-11773 can potentially be exploited remotely through crafted input submissions.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/severity
- agent/weakness
- agent/author
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- vendor/apache
- canonical/apache virtual computing lab
- version/apache virtual computing lab/2.1
- version/apache virtual computing lab/2.5