CVE-2018-1303

A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of mod_cache_socache. The vulnerability is considered as low risk since mod_cache_socache is not widely used, mod_cache_disk is not concerned by this vulnerability.

Link	Resource
https://httpd.apache.org/security/vulnerabilities_24.html	Vendor Advisory
http://www.openwall.com/lists/oss-security/2018/03/24/3	Mailing List Third Party Advisory
http://www.securitytracker.com/id/1040572	Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/103522	Third Party Advisory VDB Entry
https://www.debian.org/security/2018/dsa-4164	Third Party Advisory
https://usn.ubuntu.com/3627-1/	Third Party Advisory
https://usn.ubuntu.com/3627-2/	Third Party Advisory
https://security.netapp.com/advisory/ntap-20180601-0004/	Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3558	Third Party Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0367	Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:0366	Third Party Advisory
https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830@%3Ccvs.httpd.apache.org%3E
https://www.tenable.com/security/tns-2019-09
https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/re473305a65b4db888e3556e4dae10c2a04ee89dcff2e26ecdbd860a9@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770@%3Ccvs.httpd.apache.org%3E

Configuration 1

cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* cpe:2.3:a:netapp:santricity_cloud_connector:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:storage_automation_store:-:*:*:*:*:*:*:* cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:* cpe:2.3:o:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*

---

Published : 2018-03-26 03:29

Updated : 2021-06-06 11:15

---

NVD link : CVE-2018-1303

Mitre link : CVE-2018-1303

No products.

CWE-125

Out-of-bounds Read