CVE-2018-1301: Buffer Overflow
A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size limit is reached by reading the HTTP header. This vulnerability is considered very hard if not impossible to trigger in non-debug mode (both log and build level), so it is classified as low risk for common server usage.
Versions Affected: httpd 2.0.1 to 2.4.29
External references:
https://httpd.apache.org/security/vulnerabilities24.html
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/httpdto a version that resolves this vulnerability.Fixed in 2.4.30 - Upgrade
Upgrade
debian/apache2to a version that resolves this vulnerability.Fixed in 2.4.62-1~deb11u1Fixed in 2.4.67-1~deb11u3Fixed in 2.4.68-1~deb12u1Fixed in 2.4.67-1~deb12u3Fixed in 2.4.68-1~deb13u1Fixed in 2.4.67-1~deb13u3Fixed in 2.4.68-1 - Upgrade
Upgrade
httpdto a version that resolves this vulnerability.Fixed in 2.4.30 - Compensating control
If possible, run Apache HTTP Server in non-debug mode (both log and build level) since the described vulnerability is considered very hard or impossible to trigger in non-debug mode.
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2018-1301.
What is the severity level of CVE-2018-1301?
The severity level of CVE-2018-1301 is medium.
Which software versions are affected by CVE-2018-1301?
Apache HTTP Server versions prior to 2.4.30 are affected by CVE-2018-1301.
How can the CVE-2018-1301 vulnerability be exploited?
The vulnerability can be exploited by sending a specially crafted request to the Apache HTTP Server, triggering an out of bound access after a size limit is reached by reading the HTTP header.
What is the remedy for CVE-2018-1301?
The remedy for CVE-2018-1301 is to upgrade the Apache HTTP Server to version 2.4.30 or later.