CVE-2018-11763

Advisory lineage Upstream: 0 Downstream: 13
Modified
Published: 25 Sept 2018, 21:00
Last modified:17 Sept 2024, 02:21

Vulnerability Summary

Overall Risk (default)
medium
28/100
CVSS Score
5.9 MEDIUM
v3.0 (nvd)
EPSS Score
22.36% HIGH
22% probability +4.96%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

25 Sept 2018, 21:00
Published
Vulnerability first disclosed
17 Sept 2024, 02:21
Last Modified
Vulnerability information updated

Description

In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol.

CVSS Metrics

  • v3.0•MEDIUM•Score: 5.9CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
  • v2.0•MEDIUM•Score: 4.3AV:N/AC:M/Au:N/C:N/I:N/A:P

EPSS Trends

Current EPSS score: 22.36%• Percentile: 96%

Affected Systems

  • apache software foundation•apache http server

    2.4.17 to 2.4.34

  • Unknown•HTTP Server

    ≥ 2.4.17, ≤ 2.4.34

  • canonical•ubuntu_linux

    18.04

  • netapp•storage_automation_store

    na

  • oracle•enterprise_manager_ops_center

    12.3.3

  • oracle•hospitality_guest_access

    4.2.0 | 4.2.1

  • oracle•instantis_enterprisetrack

    17.1 | 17.2 | 17.3

  • oracle•retail_xstore_point_of_service

    7.0 | 7.1

  • oracle•secure_global_desktop

    5.4

  • redhat•enterprise_linux

    6.0 | 7.0 | 7.4 | 7.5 | 7.6

References (26)