CVE-2018-1303: High severity Apache HTTP Server vulnerability
A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of modcachesocache. The vulnerability is considered as low risk since modcachesocache is not widely used, modcachedisk is not concerned by this vulnerability.
Other sources
Apache HTTP Server (httpd) through version 2.4.29 is vulnerable to an out of bounds read in the modcachesocache.c:readtable() function. A remote attacker could exploit this to cause a denial of service.
Upstream Advisory:
https://httpd.apache.org/security/vulnerabilities24.html
Upstream Patch:
https://svn.apache.org/viewvc?view=revision&sortby=log&revision=1824475
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/httpdto a version that resolves this vulnerability.Fixed in 2.4.30 - Upgrade
Upgrade
debian/apache2to a version that resolves this vulnerability.Fixed in 2.4.68-1~deb12u1Fixed in 2.4.67-1~deb12u3Fixed in 2.4.68-1~deb13u1Fixed in 2.4.67-1~deb13u3Fixed in 2.4.68-2 - Upgrade
Upgrade
Apache HTTP Server (httpd)to a version that resolves this vulnerability.Fixed in 2.4.30 - Upgrade
Upgrade
Apache HTTP Server (httpd)to a version that resolves this vulnerability.Fixed in 2.4.30Patch 1824475
Event History
Frequently Asked Questions
What is CVE-2018-1303?
CVE-2018-1303 is a vulnerability in Apache HTTP Server that allows a specially crafted HTTP request header to crash the server due to an out-of-bounds read leading to a denial of service.
How severe is CVE-2018-1303?
CVE-2018-1303 has a severity rating of 7.5 (High).
Which versions of Apache HTTP Server are affected by CVE-2018-1303?
Apache HTTP Server versions prior to 2.4.30 are affected by CVE-2018-1303.
How can I fix CVE-2018-1303?
To fix CVE-2018-1303, you should upgrade Apache HTTP Server to version 2.4.30 or higher.
Where can I find more information about CVE-2018-1303?
You can find more information about CVE-2018-1303 at the following references: [1] [2] [3].