CVE-2018-1312

httpd: Weak Digest auth nonce generation in mod_auth_digest

In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed. In a cluster of servers using a common Digest authentication configuration, HTTP requests could be replayed across servers by an attacker without detection.

CVSS 3.1 · 9.8 Critical EPSS 15.8% KEV · Not listed

Vendors

Apache Canonical Debian and 2 more

Products

Http Server Ubuntu Linux Debian Linux and 12 more

CVE-2018-1303

httpd: Out of bounds read in mod_cache_socache can allow a remote attacker to cause DoS

A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of mod_cache_socache. The vulnerability is considered as low risk since mod_cache_socache is not widely used, mod_cache_disk is not concerned by this vulnerability.

CVSS 3.0 · 7.5 High EPSS 69.8% KEV · Not listed

Vendors

Apache Canonical Debian and 2 more

Products

Http Server Ubuntu Linux Debian Linux and 7 more

CVE-2018-1302

httpd: Use-after-free on HTTP/2 stream shutdown

When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerability hard to trigger in usual configurations, the reporter and the team could not reproduce it outside debug builds, so it is classified as low risk.

CVSS 3.0 · 5.9 Medium EPSS 12.9% KEV · Not listed

Vendors

Apache Canonical Netapp and 1 more

Products

Http Server Ubuntu Linux Clustered Data Ontap and 4 more

CVE-2018-1301

httpd: Out of bounds access after failure in reading the HTTP request

A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size limit is reached by reading the HTTP header. This vulnerability is considered very hard if not impossible to trigger in non-debug mode (both log and build level), so it is classified as low risk for common server usage.

CVSS 3.0 · 5.9 Medium EPSS 14.5% KEV · Not listed

Vendors

Apache Canonical Debian and 2 more

Products

Http Server Ubuntu Linux Debian Linux and 7 more

CVE-2018-1283

httpd: Improper handling of headers in mod_session can allow a remote user to modify session data for CGI applications

In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their content by using a "Session" header. This comes from the "HTTP_SESSION" variable name used by mod_session to forward its data to CGIs, since the prefix "HTTP_" is also used by the Apache HTTP Server to pass HTTP header fields, per CGI specifications.

CVSS 3.0 · 5.3 Medium EPSS 9.7% KEV · Not listed

Vendors

Apache Canonical Debian and 2 more

Products

Http Server Ubuntu Linux Debian Linux and 7 more

CVE-2018-17199

httpd: mod_session_cookie does not respect expiry time

In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since the expiry time is loaded when the session is decoded.

CVSS 3.0 · 7.5 High EPSS 20.0% KEV · Not listed

Vendors

Apache Canonical Debian and 3 more

Products

Http Server Ubuntu Linux Debian Linux and 6 more

CVE-2018-17189

httpd: mod_http2: DoS via slow, unneeded request bodies

In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections.

CVSS 3.1 · 5.3 Medium EPSS 19.4% KEV · Not listed

Vendors

Apache Canonical Debian and 4 more

Products

Http Server Ubuntu Linux Debian Linux and 11 more

CVE-2018-11763

httpd: DoS for HTTP/2 connections by continuous SETTINGS frames

In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol.

CVSS 3.0 · 5.9 Medium EPSS 51.0% KEV · Not listed

Vendors

Apache Canonical Netapp and 2 more

Products

Http Server Ubuntu Linux Storage Automation Store and 8 more

CVE-2018-11759

mod_jk: connector path traversal due to mishandled HTTP requests in httpd

The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via httpd, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing the application via the reverse proxy. It was also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is some overlap between this issue and CVE-2018-1323, they are not identical.

CVSS 3.0 · 7.5 High EPSS 90.6% KEV · Not listed

Vendors

Apache Debian Redhat

Products

Tomcat Jk Connector Debian Linux Jboss Core Services

CVE-2018-1000122

curl: RTSP RTP buffer over-read

A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage

CVSS 3.0 · 9.1 Critical EPSS 9.0% KEV · Not listed

Vendors

Canonical Debian Haxx and 2 more

Products

Ubuntu Linux Debian Linux Curl and 13 more

CVE-2018-1000121

curl: LDAP NULL pointer dereference

A NULL pointer dereference exists in curl 7.21.0 to and including curl 7.58.0 in the LDAP code that allows an attacker to cause a denial of service

CVSS 3.0 · 7.5 High EPSS 9.2% KEV · Not listed

Vendors

Canonical Debian Haxx and 2 more

Products

Ubuntu Linux Debian Linux Curl and 13 more

CVE-2018-1000120

curl: FTP path trickery leads to NIL byte out of bounds write

A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse.

CVSS 3.0 · 9.8 Critical EPSS 11.6% KEV · Not listed

Vendors

Canonical Debian Haxx and 2 more

Products

Ubuntu Linux Debian Linux Curl and 13 more

CVE-2018-1000007

curl: HTTP authentication leak in redirects

libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties. When asked to send custom headers in its HTTP requests, libcurl will send that set of headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the `Location:` response header value. Sending the same set of headers to subsequent hosts is in particular a problem for applications that pass on custom `Authorization:` headers, as this header often contains privacy sensitive information or data that could allow others to impersonate the libcurl-using client's request.

CVSS 3.1 · 9.8 Critical EPSS 9.9% KEV · Not listed

Vendors

Canonical Debian Fujitsu and 2 more

Products

Ubuntu Linux Debian Linux M10-1 and 24 more

CVE-2018-1000005

curl: Out-of-bounds read in code handling HTTP/2 trailers

libcurl 7.49.0 to and including 7.57.0 contains an out bounds read in code handling HTTP/2 trailers. It was reported (https://github.com/curl/curl/pull/2231) that reading an HTTP/2 trailer could mess up future trailers since the stored size was one byte less than required. The problem is that the code that creates HTTP/1-like headers from the HTTP/2 trailer data once appended a string like `:` to the target buffer, while this was recently changed to `: ` (a space was added after the colon) but the following math wasn't updated correspondingly. When accessed, the data is read out of bounds and causes either a crash or that the (too large) data gets passed to client write. This could lead to a denial-of-service situation or an information disclosure if someone has a service that echoes back or uses the trailers for something.

CVSS 3.0 · 9.1 Critical EPSS 4.6% KEV · Not listed

Vendors

Canonical Debian Haxx and 1 more

Products

Ubuntu Linux Debian Linux Libcurl and 1 more

CVE-2018-0739

Constructed ASN.1 types with a recursive definition could exceed the stack

Constructed ASN.1 types with a recursive definition (such as can be found in PKCS7) could eventually exceed the stack given malicious input with excessive recursion. This could result in a Denial Of Service attack. There are no such structures used within SSL/TLS that come from untrusted sources so this is considered safe. Fixed in OpenSSL 1.1.0h (Affected 1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n).

CVSS 3.0 · 6.5 Medium EPSS 18.6% KEV · Not listed

Vendors

Canonical Debian Openssl and 1 more

Products

Ubuntu Linux Debian Linux Openssl and 3 more

CVE-2018-0500

curl: Heap-based buffer overflow in Curl_smtp_escape_eob() when uploading data over SMTP

Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that might be exploitable by an attacker who can control the data that curl transmits over SMTP with certain settings (i.e., use of a nonstandard --limit-rate argument or CURLOPT_BUFFERSIZE value).

CVSS 3.0 · 9.8 Critical EPSS 6.4% KEV · Not listed

Vendors

Canonical Haxx Redhat

Products

Ubuntu Linux Curl Jboss Core Services

CVE-2017-15715

httpd: <FilesMatch> bypass with a trailing newline in the file name

In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked, but only by matching the trailing portion of the filename.

CVSS 3.0 · 8.1 High EPSS 86.2% KEV · Not listed

Vendors

Apache Canonical Debian and 2 more

Products

Http Server Ubuntu Linux Debian Linux and 7 more

CVE-2017-15710

httpd: Out of bounds write in mod_authnz_ldap when using too small Accept-Language values

In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured with AuthLDAPCharsetConfig, uses the Accept-Language header value to lookup the right charset encoding when verifying the user's credentials. If the header value is not present in the charset conversion table, a fallback mechanism is used to truncate it to a two characters value to allow a quick retry (for example, 'en-US' is truncated to 'en'). A header value of less than two characters forces an out of bound write of one NUL byte to a memory location that is not part of the string. In the worst case, quite unlikely, the process would crash which could be used as a Denial of Service attack. In the more likely case, this memory is already reserved for future use and the issue has no effect at all.

CVSS 3.0 · 7.5 High EPSS 17.5% KEV · Not listed

Vendors

Apache Canonical Debian and 2 more

Products

Http Server Ubuntu Linux Debian Linux and 7 more

CVE-2017-15412

libxml2: Use after free in xmlXPathCompOpEvalPositionalPredicate() function in xpath.c

Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS 2.9% KEV · Not listed

Vendors

Debian Google Redhat and 1 more

Products

Debian Linux Chrome Ansible Tower and 7 more

CVE-2017-10140

libdb: Reads DB_CONFIG from the current working directory

Postfix before 2.11.10, 3.0.x before 3.0.10, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 might allow local users to gain privileges by leveraging undocumented functionality in Berkeley DB 2.x and later, related to reading settings from DB_CONFIG in the current directory.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Postfix Redhat

Products

Postfix Jboss Core Services