CVE-2009-1890

Advisory lineage Upstream: 0 Downstream: 7
Modified
Published: 05 Jul 2009, 16:00
Last modified:07 Aug 2024, 05:27

Vulnerability Summary

Overall Risk (default)
medium
36/100
CVSS Score
7.1 HIGH
v2.0 (nvd)
EPSS Score
37.87% HIGH
38% probability +16.31%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

05 Jul 2009, 16:00
Published
Vulnerability first disclosed
07 Aug 2024, 05:27
Last Modified
Vulnerability information updated

Description

The stream_reqbody_cl function in mod_proxy_http.c in the mod_proxy module in the Apache HTTP Server before 2.3.3, when a reverse proxy is configured, does not properly handle an amount of streamed data that exceeds the Content-Length value, which allows remote attackers to cause a denial of service (CPU consumption) via crafted requests.

CVSS Metrics

  • v2.0•HIGH•Score: 7.1AV:N/AC:M/Au:N/C:N/I:N/A:C

EPSS Trends

Current EPSS score: 37.87%• Percentile: 97%

Techniques & Countermeasures

  • CWE-400•Uncontrolled Resource Consumption

    The product does not properly control the allocation and maintenance of a limited resource.

Affected Systems

  • Unknown•HTTP Server

    ≥ 2.2.0, < 2.2.12

  • canonical•ubuntu_linux

    6.06 | 8.04 | 8.10 | 9.04

  • debian•debian_linux

    4.0 | 5.0 | 6.0

  • fedoraproject•fedora

    11

  • redhat•enterprise_linux_desktop

    5.0

  • redhat•enterprise_linux_eus

    5.3

  • redhat•enterprise_linux_server

    5.0

  • redhat•enterprise_linux_server_aus

    5.3

  • redhat•enterprise_linux_workstation

    5.0

References (49)