CVE-2018-1303

Advisory lineage Upstream: 0 Downstream: 14
Modified
Published: 26 Mar 2018, 15:00
Last modified:17 Sept 2024, 02:10

Vulnerability Summary

Overall Risk (default)
medium
37/100
CVSS Score
7.5 HIGH
v3.0 (nvd)
EPSS Score
34.55% HIGH
35% probability -3.18%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

26 Mar 2018, 15:00
Published
Vulnerability first disclosed
17 Sept 2024, 02:10
Last Modified
Vulnerability information updated

Description

A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of mod_cache_socache. The vulnerability is considered as low risk since mod_cache_socache is not widely used, mod_cache_disk is not concerned by this vulnerability.

CVSS Metrics

  • v3.0•HIGH•Score: 7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • v2.0•MEDIUM•Score: 5AV:N/AC:L/Au:N/C:N/I:N/A:P

EPSS Trends

Current EPSS score: 34.55%• Percentile: 97%

Techniques & Countermeasures

  • CWE-125•Out-of-bounds Read

    The product reads data past the end, or before the beginning, of the intended buffer.

Affected Systems

  • apache software foundation•apache http server

    2.4.5 to 2.4.29

  • Unknown•HTTP Server

    ≤ 2.4.29

  • canonical•ubuntu_linux

    14.04 | 16.04 | 17.10 | 18.04

  • debian•debian_linux

    8.0 | 9.0

  • netapp•clustered_data_ontap

    na

  • netapp•santricity_cloud_connector

    na

  • netapp•storage_automation_store

    na

  • netapp•storagegrid

    na

References (25)