CVE-2018-1312: Critical severity Apache HTTP Server vulnerability
In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed. In a cluster of servers using a common Digest authentication configuration, HTTP requests could be replayed across servers by an attacker without detection.
Other sources
When generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed. In a cluster of servers using a common Digest authentication configuration, HTTP requests could be replayed across servers by an attacker without detection.
Versions Affected: httpd 2.2.0 to 2.4.29
External references:
https://httpd.apache.org/security/vulnerabilities24.html
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/httpdto a version that resolves this vulnerability.Fixed in 2.4.30 - Upgrade
Upgrade
debian/apache2to a version that resolves this vulnerability.Fixed in 2.4.62-1~deb11u1Fixed in 2.4.67-1~deb11u3Fixed in 2.4.68-1~deb12u1Fixed in 2.4.67-1~deb12u3Fixed in 2.4.68-1~deb13u1Fixed in 2.4.67-1~deb13u3Fixed in 2.4.68-1 - Upgrade
Upgrade
Apache httpdto a version that resolves this vulnerability.Fixed in 2.4.30
Event History
Frequently Asked Questions
What is CVE-2018-1312?
CVE-2018-1312 is a vulnerability in Apache httpd that allows for HTTP request replay attacks.
How severe is CVE-2018-1312?
CVE-2018-1312 has a severity rating of 9.8 (Critical).
What software versions are affected by CVE-2018-1312?
Apache httpd versions 2.2.0 to 2.4.29 are affected.
How can I fix CVE-2018-1312?
To fix CVE-2018-1312, you need to upgrade Apache httpd to version 2.4.30 or higher.
Where can I find more information about CVE-2018-1312?
You can find more information about CVE-2018-1312 on the Apache httpd website and the Redhat Bugzilla website.