CVE-2018-1301: Buffer Overflow
A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size limit is reached by reading the HTTP header. This vulnerability is considered very hard if not impossible to trigger in non-debug mode (both log and build level), so it is classified as low risk for common server usage.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/httpdto a version that resolves this vulnerability.Fixed in 2.4.30 - Upgrade
Upgrade
debian/apache2to a version that resolves this vulnerability.Fixed in 2.4.68-1~deb12u1Fixed in 2.4.67-1~deb12u3Fixed in 2.4.68-1~deb13u1Fixed in 2.4.69-1~deb13u1Fixed in 2.4.69-1Fixed in 2.4.70-1 - Upgrade
Upgrade
Apache HTTP Serverto a version that resolves this vulnerability.Fixed in 2.4.30
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2018-1301.
What is the severity level of CVE-2018-1301?
The severity level of CVE-2018-1301 is medium.
Which software versions are affected by CVE-2018-1301?
Apache HTTP Server versions prior to 2.4.30 are affected by CVE-2018-1301.
How can the CVE-2018-1301 vulnerability be exploited?
The vulnerability can be exploited by sending a specially crafted request to the Apache HTTP Server, triggering an out of bound access after a size limit is reached by reading the HTTP header.
What is the remedy for CVE-2018-1301?
The remedy for CVE-2018-1301 is to upgrade the Apache HTTP Server to version 2.4.30 or later.