Patchwire CVEs, their patch status, and feeds to follow them

CVE-2018-17199

Fixed in a distro release EPSS 20%

In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since the expiry time is loaded when the session is decoded.

Published 2019-01-30 · CVE record · OSV

Products: Apache Software Foundation Apache HTTP Server

Distro releases

ReleasePackageFixed in
AlmaLinux 8mod_http21.15.7-3.module_el8.5.0+2609+b30d9eec
AlmaLinux 8mod_md1:2.0.8-8.module_el8.5.0+2609+b30d9eec
AlmaLinux 8mod_md1:2.0.8-8.module_el8.6.0+2872+fe0ff7aa
Alpine 3.10apache22.4.38-r0
Alpine 3.11apache22.4.38-r0
Alpine 3.12apache22.4.38-r0
Alpine 3.13apache22.4.38-r0
Alpine 3.14apache22.4.38-r0
Alpine 3.15apache22.4.38-r0
Alpine 3.16apache22.4.38-r0
Alpine 3.17apache22.4.38-r0
Alpine 3.18apache22.4.38-r0
Alpine 3.19apache22.4.38-r0
Alpine 3.20apache22.4.38-r0
Alpine 3.21apache22.4.38-r0
Alpine 3.22apache22.4.38-r0
Alpine 3.23apache22.4.38-r0
Alpine 3.24apache22.4.38-r0
Alpine 3.6apache22.4.38-r0
Alpine 3.7apache22.4.38-r0
Alpine 3.8apache22.4.38-r0
Alpine 3.9apache22.4.38-r0
Arch Linuxapache2.4.38-1
Debian 12apache22.4.38-1
Debian 13apache22.4.38-1
Debian 14apache22.4.38-1
Debian 8apache22.4.10-10+deb8u13
Debian 9apache22.4.25-3+deb9u7
Red Hat Enterprise Linux 7httpd0:2.4.6-93.el7
Red Hat Enterprise Linux 7httpd-debuginfo0:2.4.6-93.el7
Red Hat Enterprise Linux 7httpd-devel0:2.4.6-93.el7
Red Hat Enterprise Linux 7httpd-manual0:2.4.6-93.el7
Red Hat Enterprise Linux 7httpd-tools0:2.4.6-93.el7
Red Hat Enterprise Linux 7mod_ldap0:2.4.6-93.el7
Red Hat Enterprise Linux 7mod_proxy_html1:2.4.6-93.el7
Red Hat Enterprise Linux 7mod_session0:2.4.6-93.el7
Red Hat Enterprise Linux 7mod_ssl1:2.4.6-93.el7
Red Hat Enterprise Linux 8httpd0:2.4.37-39.module+el8.4.0+9658+b87b2deb
Red Hat Enterprise Linux 8httpd-debuginfo0:2.4.37-39.module+el8.4.0+9658+b87b2deb
Red Hat Enterprise Linux 8httpd-debugsource0:2.4.37-39.module+el8.4.0+9658+b87b2deb
Red Hat Enterprise Linux 8httpd-devel0:2.4.37-39.module+el8.4.0+9658+b87b2deb
Red Hat Enterprise Linux 8httpd-filesystem0:2.4.37-39.module+el8.4.0+9658+b87b2deb
Red Hat Enterprise Linux 8httpd-manual0:2.4.37-39.module+el8.4.0+9658+b87b2deb
Red Hat Enterprise Linux 8httpd-tools0:2.4.37-39.module+el8.4.0+9658+b87b2deb
Red Hat Enterprise Linux 8httpd-tools-debuginfo0:2.4.37-39.module+el8.4.0+9658+b87b2deb
Red Hat Enterprise Linux 8mod_http20:1.15.7-3.module+el8.4.0+8625+d397f3da
Red Hat Enterprise Linux 8mod_http2-debuginfo0:1.15.7-3.module+el8.4.0+8625+d397f3da
Red Hat Enterprise Linux 8mod_http2-debugsource0:1.15.7-3.module+el8.4.0+8625+d397f3da
Red Hat Enterprise Linux 8mod_ldap0:2.4.37-39.module+el8.4.0+9658+b87b2deb
Red Hat Enterprise Linux 8mod_ldap-debuginfo0:2.4.37-39.module+el8.4.0+9658+b87b2deb
Red Hat Enterprise Linux 8mod_md1:2.0.8-8.module+el8.3.0+6814+67d1e611
Red Hat Enterprise Linux 8mod_md-debuginfo1:2.0.8-8.module+el8.3.0+6814+67d1e611
Red Hat Enterprise Linux 8mod_md-debugsource1:2.0.8-8.module+el8.3.0+6814+67d1e611
Red Hat Enterprise Linux 8mod_proxy_html1:2.4.37-39.module+el8.4.0+9658+b87b2deb
Red Hat Enterprise Linux 8mod_proxy_html-debuginfo1:2.4.37-39.module+el8.4.0+9658+b87b2deb
Red Hat Enterprise Linux 8mod_session0:2.4.37-39.module+el8.4.0+9658+b87b2deb
Red Hat Enterprise Linux 8mod_session-debuginfo0:2.4.37-39.module+el8.4.0+9658+b87b2deb
Red Hat Enterprise Linux 8mod_ssl1:2.4.37-39.module+el8.4.0+9658+b87b2deb
Red Hat Enterprise Linux 8mod_ssl-debuginfo1:2.4.37-39.module+el8.4.0+9658+b87b2deb
Red Hat jboss core services 1jbcs-httpd24-apr0:1.6.3-63.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-apr0:1.6.3-63.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-apr-debuginfo0:1.6.3-63.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-apr-debuginfo0:1.6.3-63.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-apr-devel0:1.6.3-63.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-apr-devel0:1.6.3-63.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-apr-util0:1.6.1-48.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-apr-util0:1.6.1-48.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-apr-util-debuginfo0:1.6.1-48.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-apr-util-debuginfo0:1.6.1-48.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-apr-util-devel0:1.6.1-48.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-apr-util-devel0:1.6.1-48.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-apr-util-ldap0:1.6.1-48.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-apr-util-ldap0:1.6.1-48.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-apr-util-mysql0:1.6.1-48.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-apr-util-mysql0:1.6.1-48.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-apr-util-nss0:1.6.1-48.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-apr-util-nss0:1.6.1-48.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-apr-util-odbc0:1.6.1-48.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-apr-util-odbc0:1.6.1-48.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-apr-util-openssl0:1.6.1-48.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-apr-util-openssl0:1.6.1-48.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-apr-util-pgsql0:1.6.1-48.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-apr-util-pgsql0:1.6.1-48.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-apr-util-sqlite0:1.6.1-48.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-apr-util-sqlite0:1.6.1-48.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-brotli0:1.0.6-7.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-brotli0:1.0.6-7.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-brotli-debuginfo0:1.0.6-7.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-brotli-debuginfo0:1.0.6-7.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-brotli-devel0:1.0.6-7.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-brotli-devel0:1.0.6-7.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-curl0:7.64.1-14.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-curl0:7.64.1-14.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-curl-debuginfo0:7.64.1-14.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-curl-debuginfo0:7.64.1-14.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-httpd0:2.4.37-33.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-httpd0:2.4.37-33.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-httpd-debuginfo0:2.4.37-33.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-httpd-debuginfo0:2.4.37-33.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-httpd-devel0:2.4.37-33.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-httpd-devel0:2.4.37-33.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-httpd-manual0:2.4.37-33.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-httpd-manual0:2.4.37-33.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-httpd-selinux0:2.4.37-33.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-httpd-selinux0:2.4.37-33.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-httpd-tools0:2.4.37-33.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-httpd-tools0:2.4.37-33.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-jansson0:2.11-20.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-jansson0:2.11-20.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-jansson-debuginfo0:2.11-20.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-jansson-debuginfo0:2.11-20.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-jansson-devel0:2.11-20.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-jansson-devel0:2.11-20.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-libcurl0:7.64.1-14.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-libcurl0:7.64.1-14.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-libcurl-devel0:7.64.1-14.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-libcurl-devel0:7.64.1-14.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-mod_cluster-native0:1.3.12-9.Final_redhat_2.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-mod_cluster-native0:1.3.12-9.Final_redhat_2.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-mod_cluster-native-debuginfo0:1.3.12-9.Final_redhat_2.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-mod_cluster-native-debuginfo0:1.3.12-9.Final_redhat_2.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-mod_jk0:1.2.46-22.redhat_1.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-mod_jk0:1.2.46-22.redhat_1.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-mod_jk-ap240:1.2.46-22.redhat_1.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-mod_jk-ap240:1.2.46-22.redhat_1.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-mod_jk-debuginfo0:1.2.46-22.redhat_1.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-mod_jk-debuginfo0:1.2.46-22.redhat_1.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-mod_jk-manual0:1.2.46-22.redhat_1.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-mod_jk-manual0:1.2.46-22.redhat_1.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-mod_ldap0:2.4.37-33.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-mod_ldap0:2.4.37-33.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-mod_md0:2.4.37-33.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-mod_md0:2.4.37-33.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-mod_proxy_html1:2.4.37-33.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-mod_proxy_html1:2.4.37-33.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-mod_security0:2.9.2-16.GA.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-mod_security0:2.9.2-16.GA.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-mod_security-debuginfo0:2.9.2-16.GA.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-mod_security-debuginfo0:2.9.2-16.GA.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-mod_session0:2.4.37-33.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-mod_session0:2.4.37-33.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-mod_ssl1:2.4.37-33.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-mod_ssl1:2.4.37-33.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-nghttp20:1.39.2-4.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-nghttp20:1.39.2-4.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-nghttp2-debuginfo0:1.39.2-4.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-nghttp2-debuginfo0:1.39.2-4.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-nghttp2-devel0:1.39.2-4.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-nghttp2-devel0:1.39.2-4.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-openssl1:1.1.1-25.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-openssl1:1.1.1-25.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-openssl-debuginfo1:1.1.1-25.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-openssl-debuginfo1:1.1.1-25.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-openssl-devel1:1.1.1-25.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-openssl-devel1:1.1.1-25.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-openssl-libs1:1.1.1-25.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-openssl-libs1:1.1.1-25.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-openssl-perl1:1.1.1-25.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-openssl-perl1:1.1.1-25.jbcs.el7
Red Hat jboss core services 1jbcs-httpd24-openssl-static1:1.1.1-25.jbcs.el6
Red Hat jboss core services 1jbcs-httpd24-openssl-static1:1.1.1-25.jbcs.el7
Red Hat rhel software collections 3httpd240:1.1-19.el6
Red Hat rhel software collections 3httpd240:1.1-19.el7
Red Hat rhel software collections 3httpd24-build0:1.1-19.el6
Red Hat rhel software collections 3httpd24-httpd0:2.4.34-15.el6
Red Hat rhel software collections 3httpd24-httpd0:2.4.34-15.el7
Red Hat rhel software collections 3httpd24-httpd-debuginfo0:2.4.34-15.el6
Red Hat rhel software collections 3httpd24-httpd-debuginfo0:2.4.34-15.el7
Red Hat rhel software collections 3httpd24-httpd-devel0:2.4.34-15.el7
Red Hat rhel software collections 3httpd24-httpd-devel0:2.4.34-15.el6
Red Hat rhel software collections 3httpd24-httpd-manual0:2.4.34-15.el6
Red Hat rhel software collections 3httpd24-httpd-manual0:2.4.34-15.el7
Red Hat rhel software collections 3httpd24-httpd-tools0:2.4.34-15.el6
Red Hat rhel software collections 3httpd24-httpd-tools0:2.4.34-15.el7
Red Hat rhel software collections 3httpd24-libnghttp20:1.7.1-8.el6
Red Hat rhel software collections 3httpd24-libnghttp20:1.7.1-8.el7
Red Hat rhel software collections 3httpd24-libnghttp2-devel0:1.7.1-8.el6
Red Hat rhel software collections 3httpd24-libnghttp2-devel0:1.7.1-8.el7
Red Hat rhel software collections 3httpd24-mod_ldap0:2.4.34-15.el7
Red Hat rhel software collections 3httpd24-mod_ldap0:2.4.34-15.el6
Red Hat rhel software collections 3httpd24-mod_md0:2.4.34-15.el7
Red Hat rhel software collections 3httpd24-mod_proxy_html1:2.4.34-15.el7
Red Hat rhel software collections 3httpd24-mod_proxy_html1:2.4.34-15.el6
Red Hat rhel software collections 3httpd24-mod_session0:2.4.34-15.el7
Red Hat rhel software collections 3httpd24-mod_session0:2.4.34-15.el6
Red Hat rhel software collections 3httpd24-mod_ssl1:2.4.34-15.el7
Red Hat rhel software collections 3httpd24-mod_ssl1:2.4.34-15.el6
Red Hat rhel software collections 3httpd24-nghttp20:1.7.1-8.el7
Red Hat rhel software collections 3httpd24-nghttp20:1.7.1-8.el6
Red Hat rhel software collections 3httpd24-nghttp2-debuginfo0:1.7.1-8.el7
Red Hat rhel software collections 3httpd24-nghttp2-debuginfo0:1.7.1-8.el6
Red Hat rhel software collections 3httpd24-runtime0:1.1-19.el7
Red Hat rhel software collections 3httpd24-runtime0:1.1-19.el6
Red Hat rhel software collections 3httpd24-scldevel0:1.1-19.el7
Red Hat rhel software collections 3httpd24-scldevel0:1.1-19.el6
Rocky Linux 8httpd0:2.4.37-39.module+el8.4.0+571+fd70afb1
Rocky Linux 8mod_http20:1.15.7-3.module+el8.4.0+553+7a69454b
Rocky Linux 8mod_http20:1.15.7-3.module+el8.5.0+695+1fa8055e
Rocky Linux 8mod_md1:2.0.8-8.module+el8.5.0+695+1fa8055e
Rocky Linux 8mod_md1:2.0.8-8.module+el8.4.0+553+7a69454b
SUSE Linux Enterprise Module for Server Applications 15apache22.4.33-3.9.7
SUSE Linux Enterprise Server 12 SP1-LTSSapache22.4.16-20.24.1
SUSE Linux Enterprise Server 12 SP3apache22.4.23-29.34.4
SUSE Linux Enterprise Server 12 SP4apache22.4.23-29.34.4
SUSE Linux Enterprise Server 12-LTSSapache22.4.10-14.36.1
SUSE Linux Enterprise Server for SAP Applications 12 SP1apache22.4.16-20.24.1
SUSE Linux Enterprise Server for SAP Applications 12 SP3apache22.4.23-29.34.4
SUSE Linux Enterprise Server for SAP Applications 12 SP4apache22.4.23-29.34.4
SUSE Linux Enterprise Software Development Kit 12 SP3apache22.4.23-29.34.4
SUSE Linux Enterprise Software Development Kit 12 SP4apache22.4.23-29.34.4
Ubuntu 14.04 LTSapache22.4.7-1ubuntu4.22
Ubuntu 16.04 LTSapache22.4.18-2ubuntu3.10
Ubuntu 18.04 LTSapache22.4.29-1ubuntu4.6
openSUSE Leap 15.0apache22.4.33-lp150.2.9.1