Detections
Analytics
CVE-2018-1312
critical
Description
In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed. In a cluster of servers using a common Digest authentication configuration, HTTP requests could be replayed across servers by an attacker without detection.
References
https://www.tenable.com/security/tns-2019-09
https://www.debian.org/security/2018/dsa-4164
https://usn.ubuntu.com/3937-2/
https://usn.ubuntu.com/3627-2/
https://usn.ubuntu.com/3627-1/
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us
https://security.netapp.com/advisory/ntap-20180601-0004/
https://lists.debian.org/debian-lts-announce/2018/05/msg00020.html
https://access.redhat.com/errata/RHSA-2019:1898
https://access.redhat.com/errata/RHSA-2019:0367
https://access.redhat.com/errata/RHSA-2019:0366
https://access.redhat.com/errata/RHSA-2018:3558