CVE-2018-1333high
New! CVE Severity Now Using CVSS v3
The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Description
By specially crafting HTTP/2 requests, workers would be allocated 60 seconds longer than necessary, leading to worker exhaustion and a denial of service. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.18-2.4.30,2.4.33).
References
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2018-1333
http://www.securitytracker.com/id/1041402
https://security.netapp.com/advisory/ntap-20180926-0007/
https://usn.ubuntu.com/3783-1/
https://access.redhat.com/errata/RHSA-2018:3558
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us
https://access.redhat.com/errata/RHSA-2019:0367
https://access.redhat.com/errata/RHSA-2019:0366
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://www.tenable.com/security/tns-2019-09
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Ccvs.httpd.apache.org%3E
Details
Source: MITRE
Published: 2018-06-18
Updated: 2021-06-06
Type: CWE-400
Risk Information
CVSS v2
Base Score: 5
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Impact Score: 2.9
Exploitability Score: 10
Severity: MEDIUM
CVSS v3
Base Score: 7.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Impact Score: 3.6
Exploitability Score: 3.9
Severity: HIGH
Vulnerable Software
Configuration 1
OR
cpe:2.3:a:apache:http_server:2.4.33:*:*:*:*:*:*:*
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* versions from 2.4.18 to 2.4.30 (inclusive)
Configuration 2
AND
OR
OR
Configuration 3
OR
Configuration 4
OR
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 123274 | openSUSE Security Update : apache2 (openSUSE-2019-632) | Nessus | SuSE Local Security Checks | high |
| 122292 | RHEL 6 / 7 : Red Hat JBoss Core Services Apache HTTP Server 2.4.29 (RHSA-2019:0367) | Nessus | Red Hat Local Security Checks | critical |
| 121991 | Photon OS 2.0: Httpd PHSA-2018-2.0-0089 | Nessus | PhotonOS Local Security Checks | high |
| 121885 | Photon OS 1.0: Httpd PHSA-2018-1.0-0181 | Nessus | PhotonOS Local Security Checks | high |
| 98915 | Apache 2.4.x < 2.4.34 Multiple Vulnerabilities | Web Application Scanning | Component Vulnerability | high |
| 120085 | SUSE SLES15 Security Update : apache2 (SUSE-SU-2018:2424-1) | Nessus | SuSE Local Security Checks | high |
| 117916 | Ubuntu 18.04 LTS : apache2 vulnerabilities (USN-3783-1) | Nessus | Ubuntu Local Security Checks | high |
| 117399 | Photon OS 2.0: Httpd PHSA-2018-2.0-0089 (deprecated) | Nessus | PhotonOS Local Security Checks | high |
| 117336 | Photon OS 1.0: Httpd PHSA-2018-1.0-0181 (deprecated) | Nessus | PhotonOS Local Security Checks | high |
| 112006 | openSUSE Security Update : apache2 (openSUSE-2018-907) | Nessus | SuSE Local Security Checks | high |
| 112002 | openSUSE Security Update : apache2 (openSUSE-2018-893) | Nessus | SuSE Local Security Checks | high |
| 111788 | Apache 2.4.x < 2.4.34 Multiple Vulnerabilities | Nessus | Web Servers | high |
| 111784 | SUSE SLES12 Security Update : apache2 (SUSE-SU-2018:2336-1) | Nessus | SuSE Local Security Checks | high |
| 111185 | Slackware 14.0 / 14.1 / 14.2 / current : httpd (SSA:2018-199-01) | Nessus | Slackware Local Security Checks | high |
| 111177 | FreeBSD : Apache httpd -- multiple vulnerabilities (8b1a50ab-8a8e-11e8-add2-b499baebfeaf) | Nessus | FreeBSD Local Security Checks | high |