CVE-2008-2364: apache http_server

CVSS: 5.0v2.0MediumModified

AliasesDEBIAN-CVE-2008-2364

Published 13-06-2008Last modified 07-08-2024

Vulnerability summary

CVE-2008-2364 is a medium (CVSS 5.0) vulnerability in apache http_server. EPSS estimates a 12.71% chance of exploitation in the next 30 days, higher than 96.2% of scored vulnerabilities.

Overall risk

23/100

0100

Low · default modelHow is this calculated?

CVSS score

5.0/10

010

Medium · v2.0 (NVD)

EPSS score

12.71%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 4 · Related 1

OPENSUSE-SU-2024:10623-1 RHSA-2008:0966 RHSA-2008:0967 RHSA-2010:0602

Timeline

13-06-2008
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

The ap_proxy_http_process_response function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server 2.0.63 and 2.2.8 does not limit the number of forwarded interim responses, which allows remote HTTP servers to cause a denial of service (memory consumption) via a large number of interim responses.

CVSS metrics

1 score · 1 source · 1 version

v2.05.0

EPSS trend

Probability

12.71%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

0.00 pp

From 12.71% on 19-09-2026

19-09-202619-10-2026

EPSS score

12.71%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Affected systems

Redhat4 products

enterprise_linux_desktop3.0 | 4.0 | 5.0
enterprise_linux_eus4.7 | 5.2
enterprise_linux_server3.0 | 4.0 | 5.0
enterprise_linux_workstation3.0 | 4.0 | 5.0

Apache1 product

http_server≥ 2.0.35, < 2.0.64 | ≥ 2.2.0, < 2.2.9

Canonical1 product

ubuntu_linuxEOL6.06 | 7.10 | 8.04

Debian1 product

apache2< 2.2.9-1

Fedoraproject1 product

fedoraEOL8 | 9

5 vendors · 8 products

References

67 links

lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
secunia.com/advisories/34259Third Party AdvisoryX Refsource SECUNIANot Applicable
secunia.com/advisories/34219Third Party AdvisoryX Refsource SECUNIANot Applicable
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11713VDB EntrySignatureX Refsource OVALThird Party Advisory
secunia.com/advisories/31026Third Party AdvisoryX Refsource SECUNIANot Applicable
marc.info?l=bugtraq&m=125631037611762&w=2Vendor AdvisoryX Refsource HPIssue TrackingMailing ListThird Party Advisory
secunia.com/advisories/31651Third Party AdvisoryX Refsource SECUNIANot Applicable
sunsolve.sun.com/search/document.do?assetkey=1-26-247666-1Vendor AdvisoryX Refsource SUNALERTBroken Link
www.securityfocus.com/bid/31681VDB EntryX Refsource BIDThird Party Advisory
secunia.com/advisories/32838Third Party AdvisoryX Refsource SECUNIANot Applicable

Show all 67 references

www.securityfocus.com/archive/1/498567/100/0/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
secunia.com/advisories/31904Third Party AdvisoryX Refsource SECUNIANot Applicable
www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.htmlX Refsource CONFIRMThird Party Advisory
rhn.redhat.com/errata/RHSA-2008-0967.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.securityfocus.com/bid/29653VDB EntryX Refsource BIDPatchThird Party Advisory
secunia.com/advisories/34418Third Party AdvisoryX Refsource SECUNIANot Applicable
secunia.com/advisories/30621Third Party AdvisoryX Refsource SECUNIANot ApplicableVendor Advisory
secunia.com/advisories/32685Third Party AdvisoryX Refsource SECUNIANot Applicable
exchange.xforce.ibmcloud.com/vulnerabilities/42987VDB EntryX Refsource XFThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
secunia.com/advisories/31416Third Party AdvisoryX Refsource SECUNIANot Applicable
www.securitytracker.com/id?1020267VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory
svn.apache.org/viewvc/…X Refsource CONFIRMPatchVendor Advisory
www.ubuntu.com/usn/USN-731-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
www.vupen.com/english/advisories/2009/0320VDB EntryX Refsource VUPENPermissions Required
h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01539432Vendor AdvisoryX Refsource HPBroken Link
www-01.ibm.com/support/docview.wss?uid=swg27008517X Refsource CONFIRMThird Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9577VDB EntrySignatureX Refsource OVALThird Party Advisory
secunia.com/advisories/32222Third Party AdvisoryX Refsource SECUNIANot Applicable
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6084VDB EntrySignatureX Refsource OVALThird Party Advisory
www.redhat.com/support/errata/RHSA-2008-0966.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
secunia.com/advisories/33156Third Party AdvisoryX Refsource SECUNIANot Applicable
secunia.com/advisories/33797Third Party AdvisoryX Refsource SECUNIANot Applicable
www.securityfocus.com/archive/1/494858/100/0/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
secunia.com/advisories/31404Third Party AdvisoryX Refsource SECUNIANot Applicable
www.redhat.com/archives/fedora-package-announce/2008-August/msg00055.htmlVendor AdvisoryX Refsource FEDORAMailing ListThird Party Advisory
security.gentoo.org/glsa/glsa-200807-06.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
www.vupen.com/english/advisories/2008/2780VDB EntryX Refsource VUPENPermissions Required
marc.info?l=bugtraq&m=123376588623823&w=2Vendor AdvisoryX Refsource HPIssue TrackingMailing ListThird Party Advisory
www.mandriva.com/security/advisories?name=MDVSA-2008:237Vendor AdvisoryX Refsource MANDRIVABroken Link
www.redhat.com/archives/fedora-package-announce/2008-August/msg00153.htmlVendor AdvisoryX Refsource FEDORAMailing ListThird Party Advisory
www.vupen.com/english/advisories/2008/1798VDB EntryX Refsource VUPENPermissions Required
lists.apple.com/archives/security-announce/2008/Oct/msg00001.htmlVendor AdvisoryX Refsource APPLEBroken LinkMailing List
support.apple.com/kb/HT3216X Refsource CONFIRMBroken Link
www.mandriva.com/security/advisories?name=MDVSA-2008:195Vendor AdvisoryX Refsource MANDRIVABroken Link
www-1.ibm.com/support/docview.wss?uid=swg1PK67579Vendor AdvisoryX Refsource AIXAPARThird Party Advisory
wiki.rpath.com/wiki/Advisories:rPSA-2008-0328X Refsource CONFIRMBroken Link
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
lists.apache.org/thread.html/…Mailing ListX Refsource MLIST
security-tracker.debian.org/tracker/CVE-2008-2364Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities