CVE-2018-1283: Medium severity Apache HTTP Server vulnerability
Apache HTTP Server (httpd) through version 2.4.29 has a vulnerability in the handling of HTTP session headers in modsession. When modsession is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their content by using a "Session" header.
Upstream Advisory:
https://httpd.apache.org/security/vulnerabilities24.html
Upstream Patch:
https://svn.apache.org/viewvc?view=revision&sortby=log&revision=1824477
Other sources
In Apache httpd 2.4.0 to 2.4.29, when modsession is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their content by using a "Session" header. This comes from the "HTTPSESSION" variable name used by modsession to forward its data to CGIs, since the prefix "HTTP" is also used by the Apache HTTP Server to pass HTTP header fields, per CGI specifications.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/httpdto a version that resolves this vulnerability.Fixed in 2.4.30 - Upgrade
Upgrade
debian/apache2to a version that resolves this vulnerability.Fixed in 2.4.62-1~deb11u1Fixed in 2.4.67-1~deb11u3Fixed in 2.4.68-1~deb12u1Fixed in 2.4.67-1~deb12u3Fixed in 2.4.68-1~deb13u1Fixed in 2.4.67-1~deb13u3Fixed in 2.4.68-1 - Upgrade
Upgrade
apache/httpd (mod_session)to a version that resolves this vulnerability.Fixed in 2.4.29
Event History
Frequently Asked Questions
What is CVE-2018-1283?
CVE-2018-1283 is a vulnerability in Apache httpd that allows a remote user to influence the content of CGI applications by using a specific header.
How severe is CVE-2018-1283?
CVE-2018-1283 has a severity rating of 5.3, which is considered medium.
Which versions of Apache httpd are affected by CVE-2018-1283?
Apache httpd versions 2.4.0 to 2.4.29 are affected by CVE-2018-1283.
How do I fix CVE-2018-1283?
To fix CVE-2018-1283, it is recommended to upgrade to Apache httpd version 2.4.30 or later.
Where can I find more information about CVE-2018-1283?
You can find more information about CVE-2018-1283 on the Apache httpd website and the Red Hat bugzilla.