CVE-2013-4352 — NULL Pointer Dereference in Apache Http Server

CWE-476 — NULL Pointer Dereference9 documents8 sources
Severity
4.3MEDIUMNVD
EPSS
24.4%
top 3.89%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Apache Http Server
Timeline
PublishedJul 20
Latest updateMay 13

Description

The cache_invalidate function in modules/cache/cache_storage.c in the mod_cache module in the Apache HTTP Server 2.4.6, when a caching forward proxy is enabled, allows remote HTTP servers to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger a missing hostname value.

CVSS vector

AV:N/AC:M/C:N/I:N/A:PExploitability: 8.6 | Impact: 2.9

Affected Packages1 packages

🔴Vulnerability Details

3
GHSA
GHSA-qvf4-vfh5-xgq5: The cache_invalidate function in modules/cache/cache_storage↗2022-05-13
▶
OSV
CVE-2013-4352: The cache_invalidate function in modules/cache/cache_storage↗2014-07-20
▶
CVEList
CVE-2013-4352: The cache_invalidate function in modules/cache/cache_storage↗2014-07-20
▶

📋Vendor Advisories

3
Red Hat
httpd: mod_cache NULL pointer dereference crash↗2014-07-17
▶
Debian
CVE-2013-4352: apache2 - The cache_invalidate function in modules/cache/cache_storage.c in the mod_cache ...↗2013
▶
Apache
Apache httpd: CVE-2013-4352↗
▶

💬Community

2
Bugzilla
CVE-2014-0231 CVE-2014-0118 CVE-2014-0117 CVE-2014-0226 CVE-2013-4352 httpd: various flaws [fedora-all]↗2014-07-17
▶
Bugzilla
CVE-2013-4352 httpd: mod_cache NULL pointer dereference crash↗2014-07-17
▶
CVE-2013-4352 — NULL Pointer Dereference in Apache | cvebase