CVE-2018-1302
Fixed in a distro release EPSS 13%
When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerability hard to trigger in usual configurations, the reporter and the team could not reproduce it outside debug builds, so it is classified as low risk.
Products: Apache Software Foundation Apache HTTP Server
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | apache2 | 2.4.33-r0 |
| Alpine 3.11 | apache2 | 2.4.33-r0 |
| Alpine 3.12 | apache2 | 2.4.33-r0 |
| Alpine 3.13 | apache2 | 2.4.33-r0 |
| Alpine 3.14 | apache2 | 2.4.33-r0 |
| Alpine 3.15 | apache2 | 2.4.33-r0 |
| Alpine 3.16 | apache2 | 2.4.33-r0 |
| Alpine 3.17 | apache2 | 2.4.33-r0 |
| Alpine 3.18 | apache2 | 2.4.33-r0 |
| Alpine 3.19 | apache2 | 2.4.33-r0 |
| Alpine 3.20 | apache2 | 2.4.33-r0 |
| Alpine 3.21 | apache2 | 2.4.33-r0 |
| Alpine 3.22 | apache2 | 2.4.33-r0 |
| Alpine 3.23 | apache2 | 2.4.33-r0 |
| Alpine 3.24 | apache2 | 2.4.33-r0 |
| Alpine 3.4 | apache2 | 2.4.33-r0 |
| Alpine 3.5 | apache2 | 2.4.33-r0 |
| Alpine 3.6 | apache2 | 2.4.33-r0 |
| Alpine 3.7 | apache2 | 2.4.33-r0 |
| Alpine 3.8 | apache2 | 2.4.33-r0 |
| Alpine 3.9 | apache2 | 2.4.33-r0 |
| Arch Linux | apache | 2.4.33-1 |
| Debian 12 | apache2 | 2.4.33-1 |
| Debian 13 | apache2 | 2.4.33-1 |
| Debian 14 | apache2 | 2.4.33-1 |
| Red Hat jboss core services 1 | jbcs-httpd24 | 0:1-6.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24 | 0:1-6.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-apache-commons-daemon-jsvc | 1:1.1.0-3.redhat_2.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-apache-commons-daemon-jsvc | 1:1.1.0-3.redhat_2.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-apache-commons-daemon-jsvc-debuginfo | 1:1.1.0-3.redhat_2.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-apache-commons-daemon-jsvc-debuginfo | 1:1.1.0-3.redhat_2.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr | 0:1.6.3-31.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr | 0:1.6.3-31.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-debuginfo | 0:1.6.3-31.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-debuginfo | 0:1.6.3-31.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-devel | 0:1.6.3-31.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-devel | 0:1.6.3-31.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util | 0:1.6.1-24.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util | 0:1.6.1-24.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util-debuginfo | 0:1.6.1-24.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util-debuginfo | 0:1.6.1-24.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util-devel | 0:1.6.1-24.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util-devel | 0:1.6.1-24.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util-ldap | 0:1.6.1-24.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util-ldap | 0:1.6.1-24.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util-mysql | 0:1.6.1-24.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util-mysql | 0:1.6.1-24.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util-nss | 0:1.6.1-24.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util-nss | 0:1.6.1-24.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util-odbc | 0:1.6.1-24.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util-odbc | 0:1.6.1-24.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util-openssl | 0:1.6.1-24.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util-openssl | 0:1.6.1-24.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util-pgsql | 0:1.6.1-24.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util-pgsql | 0:1.6.1-24.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util-sqlite | 0:1.6.1-24.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util-sqlite | 0:1.6.1-24.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd | 0:2.4.29-35.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd | 0:2.4.29-35.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-debuginfo | 0:2.4.29-35.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-debuginfo | 0:2.4.29-35.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-devel | 0:2.4.29-35.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-devel | 0:2.4.29-35.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-manual | 0:2.4.29-35.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-manual | 0:2.4.29-35.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-selinux | 0:2.4.29-35.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-selinux | 0:2.4.29-35.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-tools | 0:2.4.29-35.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-tools | 0:2.4.29-35.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_cluster-native | 0:1.3.8-3.Final_redhat_2.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_cluster-native | 0:1.3.8-3.Final_redhat_2.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_cluster-native-debuginfo | 0:1.3.8-3.Final_redhat_2.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_cluster-native-debuginfo | 0:1.3.8-3.Final_redhat_2.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk | 0:1.2.46-1.redhat_1.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk | 0:1.2.46-1.redhat_1.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk-ap24 | 0:1.2.46-1.redhat_1.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk-ap24 | 0:1.2.46-1.redhat_1.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk-debuginfo | 0:1.2.46-1.redhat_1.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk-debuginfo | 0:1.2.46-1.redhat_1.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk-manual | 0:1.2.46-1.redhat_1.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk-manual | 0:1.2.46-1.redhat_1.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ldap | 0:2.4.29-35.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ldap | 0:2.4.29-35.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_html | 1:2.4.29-35.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_html | 1:2.4.29-35.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_session | 0:2.4.29-35.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_session | 0:2.4.29-35.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ssl | 1:2.4.29-35.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ssl | 1:2.4.29-35.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-nghttp2 | 0:1.29.0-9.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-nghttp2 | 0:1.29.0-9.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-nghttp2-debuginfo | 0:1.29.0-9.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-nghttp2-debuginfo | 0:1.29.0-9.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-nghttp2-devel | 0:1.29.0-9.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-nghttp2-devel | 0:1.29.0-9.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl | 1:1.0.2n-14.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl | 1:1.0.2n-14.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-debuginfo | 1:1.0.2n-14.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-debuginfo | 1:1.0.2n-14.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-devel | 1:1.0.2n-14.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-devel | 1:1.0.2n-14.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-libs | 1:1.0.2n-14.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-libs | 1:1.0.2n-14.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-perl | 1:1.0.2n-14.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-perl | 1:1.0.2n-14.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-static | 1:1.0.2n-14.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-static | 1:1.0.2n-14.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-runtime | 0:1-6.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-runtime | 0:1-6.jbcs.el6 |
| SUSE Linux Enterprise Server 12 SP2-BCL | apache2 | 2.4.23-29.18.2 |
| SUSE Linux Enterprise Server 12 SP2-LTSS | apache2 | 2.4.23-29.18.2 |
| SUSE Linux Enterprise Server 12 SP3 | apache2 | 2.4.23-29.18.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | apache2 | 2.4.23-29.18.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | apache2 | 2.4.23-29.18.2 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | apache2 | 2.4.23-29.18.2 |
| SUSE OpenStack Cloud 7 | apache2 | 2.4.23-29.18.2 |
| Ubuntu 18.04 LTS | apache2 | 2.4.29-1ubuntu4.4 |