CVE-2018-17189

CWE-400 — Uncontrolled Resource Consumption10 documents8 sources
Severity
5.3MEDIUM
EPSS
5.6%
top 9.67%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
11
Apache Software Foundation Apache Http ServerApache Http ServerCanonical Ubuntu Linux+8 more
Timeline
PublishedJan 30
Latest updateMay 13

Description

In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitability: 3.9 | Impact: 1.4

Affected Packages9 packages

▶NVDapache/http_server14 versions+13
▶Debianapache2< 2.4.38-1+3

Also affects: Debian Linux 9.0, Fedora 28, 29, Ubuntu Linux 14.04, 16.04, 18.04, 18.10

🔴Vulnerability Details

4
GHSA
GHSA-xcwr-pcwv-7gm8: In Apache HTTP server versions 2↗2022-05-13
▶
OSV
apache2 vulnerabilities↗2019-04-04
▶
CVEList
CVE-2018-17189: In Apache HTTP server versions 2↗2019-01-30
▶
OSV
CVE-2018-17189: In Apache HTTP server versions 2↗2019-01-30
▶

📋Vendor Advisories

3
Ubuntu
Apache HTTP Server vulnerabilities↗2019-04-04
▶
Red Hat
httpd: mod_http2: DoS via slow, unneeded request bodies↗2019-01-22
▶
Debian
CVE-2018-17189: apache2 - In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a ...↗2018
▶

💬Community

2
Bugzilla
CVE-2018-17189 httpd: mod_http2: DoS via slow, unneeded request bodies↗2019-01-22
▶
Bugzilla
CVE-2018-17189 mod_http2: httpd: mod_http2: DoS via slow, unneeded request bodies [fedora-all]↗2019-01-22
▶