CVE-2018-1303
Fixed in a distro release EPSS 70%
A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of mod_cache_socache. The vulnerability is considered as low risk since mod_cache_socache is not widely used, mod_cache_disk is not concerned by this vulnerability.
Products: Apache Software Foundation Apache HTTP Server
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | apache2 | 2.4.33-r0 |
| Alpine 3.11 | apache2 | 2.4.33-r0 |
| Alpine 3.12 | apache2 | 2.4.33-r0 |
| Alpine 3.13 | apache2 | 2.4.33-r0 |
| Alpine 3.14 | apache2 | 2.4.33-r0 |
| Alpine 3.15 | apache2 | 2.4.33-r0 |
| Alpine 3.16 | apache2 | 2.4.33-r0 |
| Alpine 3.17 | apache2 | 2.4.33-r0 |
| Alpine 3.18 | apache2 | 2.4.33-r0 |
| Alpine 3.19 | apache2 | 2.4.33-r0 |
| Alpine 3.20 | apache2 | 2.4.33-r0 |
| Alpine 3.21 | apache2 | 2.4.33-r0 |
| Alpine 3.22 | apache2 | 2.4.33-r0 |
| Alpine 3.23 | apache2 | 2.4.33-r0 |
| Alpine 3.24 | apache2 | 2.4.33-r0 |
| Alpine 3.4 | apache2 | 2.4.33-r0 |
| Alpine 3.5 | apache2 | 2.4.33-r0 |
| Alpine 3.6 | apache2 | 2.4.33-r0 |
| Alpine 3.7 | apache2 | 2.4.33-r0 |
| Alpine 3.8 | apache2 | 2.4.33-r0 |
| Alpine 3.9 | apache2 | 2.4.33-r0 |
| Debian 12 | apache2 | 2.4.33-1 |
| Debian 13 | apache2 | 2.4.33-1 |
| Debian 14 | apache2 | 2.4.33-1 |
| Debian 8 | apache2 | 2.4.10-10+deb8u12 |
| Debian 9 | apache2 | 2.4.25-3+deb9u4 |
| Red Hat Enterprise Linux 7 | httpd | 0:2.4.6-95.el7 |
| Red Hat Enterprise Linux 7 | httpd-debuginfo | 0:2.4.6-95.el7 |
| Red Hat Enterprise Linux 7 | httpd-devel | 0:2.4.6-95.el7 |
| Red Hat Enterprise Linux 7 | httpd-manual | 0:2.4.6-95.el7 |
| Red Hat Enterprise Linux 7 | httpd-tools | 0:2.4.6-95.el7 |
| Red Hat Enterprise Linux 7 | mod_ldap | 0:2.4.6-95.el7 |
| Red Hat Enterprise Linux 7 | mod_proxy_html | 1:2.4.6-95.el7 |
| Red Hat Enterprise Linux 7 | mod_session | 0:2.4.6-95.el7 |
| Red Hat Enterprise Linux 7 | mod_ssl | 1:2.4.6-95.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24 | 0:1-6.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24 | 0:1-6.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-apache-commons-daemon-jsvc | 1:1.1.0-3.redhat_2.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-apache-commons-daemon-jsvc | 1:1.1.0-3.redhat_2.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-apache-commons-daemon-jsvc-debuginfo | 1:1.1.0-3.redhat_2.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-apache-commons-daemon-jsvc-debuginfo | 1:1.1.0-3.redhat_2.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr | 0:1.6.3-31.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr | 0:1.6.3-31.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-debuginfo | 0:1.6.3-31.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-debuginfo | 0:1.6.3-31.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-devel | 0:1.6.3-31.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-devel | 0:1.6.3-31.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util | 0:1.6.1-24.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util | 0:1.6.1-24.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util-debuginfo | 0:1.6.1-24.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util-debuginfo | 0:1.6.1-24.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util-devel | 0:1.6.1-24.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util-devel | 0:1.6.1-24.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util-ldap | 0:1.6.1-24.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util-ldap | 0:1.6.1-24.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util-mysql | 0:1.6.1-24.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util-mysql | 0:1.6.1-24.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util-nss | 0:1.6.1-24.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util-nss | 0:1.6.1-24.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util-odbc | 0:1.6.1-24.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util-odbc | 0:1.6.1-24.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util-openssl | 0:1.6.1-24.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util-openssl | 0:1.6.1-24.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util-pgsql | 0:1.6.1-24.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util-pgsql | 0:1.6.1-24.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util-sqlite | 0:1.6.1-24.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-util-sqlite | 0:1.6.1-24.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd | 0:2.4.29-35.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd | 0:2.4.29-35.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-debuginfo | 0:2.4.29-35.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-debuginfo | 0:2.4.29-35.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-devel | 0:2.4.29-35.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-devel | 0:2.4.29-35.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-manual | 0:2.4.29-35.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-manual | 0:2.4.29-35.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-selinux | 0:2.4.29-35.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-selinux | 0:2.4.29-35.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-tools | 0:2.4.29-35.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-tools | 0:2.4.29-35.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_cluster-native | 0:1.3.8-3.Final_redhat_2.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_cluster-native | 0:1.3.8-3.Final_redhat_2.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_cluster-native-debuginfo | 0:1.3.8-3.Final_redhat_2.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_cluster-native-debuginfo | 0:1.3.8-3.Final_redhat_2.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk | 0:1.2.46-1.redhat_1.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk | 0:1.2.46-1.redhat_1.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk-ap24 | 0:1.2.46-1.redhat_1.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk-ap24 | 0:1.2.46-1.redhat_1.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk-debuginfo | 0:1.2.46-1.redhat_1.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk-debuginfo | 0:1.2.46-1.redhat_1.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk-manual | 0:1.2.46-1.redhat_1.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_jk-manual | 0:1.2.46-1.redhat_1.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ldap | 0:2.4.29-35.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ldap | 0:2.4.29-35.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_html | 1:2.4.29-35.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_html | 1:2.4.29-35.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_session | 0:2.4.29-35.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_session | 0:2.4.29-35.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ssl | 1:2.4.29-35.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ssl | 1:2.4.29-35.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-nghttp2 | 0:1.29.0-9.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-nghttp2 | 0:1.29.0-9.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-nghttp2-debuginfo | 0:1.29.0-9.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-nghttp2-debuginfo | 0:1.29.0-9.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-nghttp2-devel | 0:1.29.0-9.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-nghttp2-devel | 0:1.29.0-9.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl | 1:1.0.2n-14.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl | 1:1.0.2n-14.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-debuginfo | 1:1.0.2n-14.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-debuginfo | 1:1.0.2n-14.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-devel | 1:1.0.2n-14.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-devel | 1:1.0.2n-14.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-libs | 1:1.0.2n-14.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-libs | 1:1.0.2n-14.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-perl | 1:1.0.2n-14.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-perl | 1:1.0.2n-14.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-static | 1:1.0.2n-14.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-static | 1:1.0.2n-14.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-runtime | 0:1-6.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-runtime | 0:1-6.jbcs.el7 |
| Red Hat rhel software collections 3 | httpd24-curl | 0:7.61.1-1.el7 |
| Red Hat rhel software collections 3 | httpd24-curl | 0:7.61.1-1.el6 |
| Red Hat rhel software collections 3 | httpd24-curl-debuginfo | 0:7.61.1-1.el7 |
| Red Hat rhel software collections 3 | httpd24-curl-debuginfo | 0:7.61.1-1.el6 |
| Red Hat rhel software collections 3 | httpd24-httpd | 0:2.4.34-7.el7 |
| Red Hat rhel software collections 3 | httpd24-httpd | 0:2.4.34-7.el6 |
| Red Hat rhel software collections 3 | httpd24-httpd-debuginfo | 0:2.4.34-7.el7 |
| Red Hat rhel software collections 3 | httpd24-httpd-debuginfo | 0:2.4.34-7.el6 |
| Red Hat rhel software collections 3 | httpd24-httpd-devel | 0:2.4.34-7.el6 |
| Red Hat rhel software collections 3 | httpd24-httpd-devel | 0:2.4.34-7.el7 |
| Red Hat rhel software collections 3 | httpd24-httpd-manual | 0:2.4.34-7.el7 |
| Red Hat rhel software collections 3 | httpd24-httpd-manual | 0:2.4.34-7.el6 |
| Red Hat rhel software collections 3 | httpd24-httpd-tools | 0:2.4.34-7.el7 |
| Red Hat rhel software collections 3 | httpd24-httpd-tools | 0:2.4.34-7.el6 |
| Red Hat rhel software collections 3 | httpd24-libcurl | 0:7.61.1-1.el7 |
| Red Hat rhel software collections 3 | httpd24-libcurl | 0:7.61.1-1.el6 |
| Red Hat rhel software collections 3 | httpd24-libcurl-devel | 0:7.61.1-1.el7 |
| Red Hat rhel software collections 3 | httpd24-libcurl-devel | 0:7.61.1-1.el6 |
| Red Hat rhel software collections 3 | httpd24-libnghttp2 | 0:1.7.1-7.el7 |
| Red Hat rhel software collections 3 | httpd24-libnghttp2 | 0:1.7.1-7.el6 |
| Red Hat rhel software collections 3 | httpd24-libnghttp2-devel | 0:1.7.1-7.el7 |
| Red Hat rhel software collections 3 | httpd24-libnghttp2-devel | 0:1.7.1-7.el6 |
| Red Hat rhel software collections 3 | httpd24-mod_ldap | 0:2.4.34-7.el6 |
| Red Hat rhel software collections 3 | httpd24-mod_ldap | 0:2.4.34-7.el7 |
| Red Hat rhel software collections 3 | httpd24-mod_md | 0:2.4.34-7.el7 |
| Red Hat rhel software collections 3 | httpd24-mod_proxy_html | 1:2.4.34-7.el6 |
| Red Hat rhel software collections 3 | httpd24-mod_proxy_html | 1:2.4.34-7.el7 |
| Red Hat rhel software collections 3 | httpd24-mod_session | 0:2.4.34-7.el6 |
| Red Hat rhel software collections 3 | httpd24-mod_session | 0:2.4.34-7.el7 |
| Red Hat rhel software collections 3 | httpd24-mod_ssl | 1:2.4.34-7.el7 |
| Red Hat rhel software collections 3 | httpd24-mod_ssl | 1:2.4.34-7.el6 |
| Red Hat rhel software collections 3 | httpd24-nghttp2 | 0:1.7.1-7.el6 |
| Red Hat rhel software collections 3 | httpd24-nghttp2 | 0:1.7.1-7.el7 |
| Red Hat rhel software collections 3 | httpd24-nghttp2-debuginfo | 0:1.7.1-7.el6 |
| Red Hat rhel software collections 3 | httpd24-nghttp2-debuginfo | 0:1.7.1-7.el7 |
| SUSE Linux Enterprise Server 12 SP1-LTSS | apache2 | 2.4.16-20.16.1 |
| SUSE Linux Enterprise Server 12 SP2-BCL | apache2 | 2.4.23-29.18.2 |
| SUSE Linux Enterprise Server 12 SP2-LTSS | apache2 | 2.4.23-29.18.2 |
| SUSE Linux Enterprise Server 12 SP3 | apache2 | 2.4.23-29.18.2 |
| SUSE Linux Enterprise Server 12-LTSS | apache2 | 2.4.10-14.31.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | apache2 | 2.4.16-20.16.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | apache2 | 2.4.23-29.18.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | apache2 | 2.4.23-29.18.2 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | apache2 | 2.4.23-29.18.2 |
| SUSE OpenStack Cloud 6 | apache2 | 2.4.16-20.16.1 |
| SUSE OpenStack Cloud 7 | apache2 | 2.4.23-29.18.2 |
| Ubuntu 14.04 LTS | apache2 | 2.4.7-1ubuntu4.20 |
| Ubuntu 16.04 LTS | apache2 | 2.4.18-2ubuntu3.8 |
| Ubuntu 18.04 LTS | apache2 | 2.4.29-1ubuntu4.1 |