CVE-2018-1303

Impact:
Moderate
Public Date:
2018-03-21
CWE:
CWE-125
Bugzilla:
1560399: CVE-2018-1303 httpd: Out of bounds read in mod_cache_socache can allow a remote attacker to cause DoS

The MITRE CVE dictionary describes this issue as:

A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of mod_cache_socache. The vulnerability is considered as low risk since mod_cache_socache is not widely used, mod_cache_disk is not concerned by this vulnerability.

Find out more about CVE-2018-1303 from the MITRE CVE dictionary dictionary and NIST NVD.

Statement

The versions of httpd package shipped with Red Hat Enterprise Linux are by default configured in prefork MPM mode, which means that this flaw can result in a crash of child process. The main web server process will not be killed. Also, though the module is loaded by default, it needs to be specifically enabled in order to be exposed to the security flaw.

CVSS v3 metrics

CVSS3 Base Score 5.3
CVSS3 Base Metrics CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity Impact None
Availability Impact Low

Red Hat Security Errata

Platform Errata Release Date
Red Hat Software Collections for Red Hat Enterprise Linux 6 (httpd24-httpd) RHSA-2018:3558 2018-11-13
Red Hat Software Collections for Red Hat Enterprise Linux 7 (httpd24-httpd) RHSA-2018:3558 2018-11-13

Affected Packages State

Platform Package State
Red Hat Mobile Application Platform On-Premise 4 rhmap-httpd-docker Not affected
Red Hat JBoss Web Server 3 httpd Not affected
Red Hat JBoss EWS 2 httpd Not affected
Red Hat JBoss EAP 6 httpd Not affected
Red Hat JBoss EAP 5 httpd Not affected
Red Hat JBoss Core Services 1 httpd Affected
Red Hat Enterprise Linux 7 httpd Affected
Red Hat Enterprise Linux 6 httpd Will not fix
Red Hat Enterprise Linux 5 httpd Not affected

Last Modified

CVE description copyright © 2017, The MITRE Corporation

Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.