By specially crafting HTTP/2 requests, workers would be allocated 60 seconds longer than necessary, leading to worker exhaustion and a denial of service. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.18-2.4.30,2.4.33).

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3558 advisory.

    The Apache HTTP Server is a powerful, efficient, and extensible web server. The httpd24 packages provide a     recent stable release of version 2.4 of the Apache HTTP Server, along with the mod_auth_kerb module.

    The following packages have been upgraded to a later upstream version: httpd24-httpd (2.4.34),     httpd24-curl (7.61.1). (BZ#1590833, BZ#1648928)

    Security Fix(es):

    * httpd: Improper handling of headers in mod_session can allow a remote user to modify session data for     CGI applications (CVE-2018-1283)

    * httpd: Out of bounds read in mod_cache_socache can allow a remote attacker to cause DoS (CVE-2018-1303)

    * httpd: mod_http2: Too much time allocated to workers, possibly leading to DoS (CVE-2018-1333)

    * httpd: DoS for HTTP/2 connections by continuous SETTINGS frames (CVE-2018-11763)

    * httpd: Out of bounds write in mod_authnz_ldap when using too small Accept-Language values     (CVE-2017-15710)

    * httpd: <FilesMatch> bypass with a trailing newline in the file name (CVE-2017-15715)

    * httpd: Out of bounds access after failure in reading the HTTP request (CVE-2018-1301)

    * httpd: Weak Digest auth nonce generation in mod_auth_digest (CVE-2018-1312)

    * curl: Multiple security issues were fixed in httpd24-curl (CVE-2016-5419, CVE-2016-5420, CVE-2016-5421,     CVE-2016-7141, CVE-2016-7167, CVE-2016-8615, CVE-2016-8616, CVE-2016-8617, CVE-2016-8618, CVE-2016-8619,     CVE-2016-8620, CVE-2016-8621, CVE-2016-8622, CVE-2016-8623, CVE-2016-8624, CVE-2016-8625, CVE-2016-9586,     CVE-2017-1000100, CVE-2017-1000101, CVE-2017-1000254, CVE-2017-1000257, CVE-2017-7407, CVE-2017-8816,     CVE-2017-8817, CVE-2018-1000007, CVE-2018-1000120, CVE-2018-1000121, CVE-2018-1000122, CVE-2018-1000301,     CVE-2018-14618)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank the Curl project for reporting CVE-2017-8816, CVE-2017-8817, CVE-2017-1000254,     CVE-2017-1000257, CVE-2018-1000007, CVE-2018-1000120, CVE-2018-1000122, CVE-2018-1000301, CVE-2016-9586,     CVE-2017-1000100, CVE-2017-1000101, CVE-2018-14618, and CVE-2018-1000121. Upstream acknowledges Alex     Nichols as the original reporter of CVE-2017-8816; the OSS-Fuzz project as the original reporter of     CVE-2017-8817 and CVE-2018-1000301; Max Dymond as the original reporter of CVE-2017-1000254 and     CVE-2018-1000122; Brian Carpenter and the OSS-Fuzz project as the original reporters of CVE-2017-1000257;
    Craig de Stigter as the original reporter of CVE-2018-1000007; Duy Phan Thanh as the original reporter of     CVE-2018-1000120; Even Rouault as the original reporter of CVE-2017-1000100; Brian Carpenter as the     original reporter of CVE-2017-1000101; Zhaoyang Wu as the original reporter of CVE-2018-14618; and Dario     Weisser as the original reporter of CVE-2018-1000121.

    Bug Fix(es):

    * Previously, the Apache HTTP Server from the httpd24 Software Collection was unable to handle situations     when static content was repeatedly requested in a browser by refreshing the page. As a consequence, HTTP/2     connections timed out and httpd became unresponsive. This bug has been fixed, and HTTP/2 connections now     work as expected in the described scenario. (BZ#1518737)

    Enhancement(s):

    * This update adds the mod_md module to the httpd24 Software Collection. This module enables managing     domains across virtual hosts and certificate provisioning using the Automatic Certificate Management     Environment (ACME) protocol. The mod_md module is available only for Red Hat Enterprise Linux 7.
    (BZ#1640722)

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Software Collections 3.2 Release     Notes linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for apache2 fixes the following issues :

The following security vulnerabilities were fixed :

  - CVE-2018-1333: Fixed a worker exhaustion that could have     lead to a denial of service via specially crafted HTTP/2     requests (bsc#1101689).

  - CVE-2018-8011: Fixed a NULL pointer dereference in     mod_md, which could have lead to a denial of service via     specially crafted HTTP requests (bsc#1101688). Note: We     are currently not shipping this modules, since it is     still considered experimental, but we might start to     ship it with future releases.

This update was imported from the SUSE:SLE-15:Update update project.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:0367 advisory.

    Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This     software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged     under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent     update experience.

    This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.29 Service Pack 1 serves as an update     to Red Hat JBoss Core Services Apache HTTP Server 2.4.29, and includes bug fixes for CVEs which are linked     to in the References section.

    Security Fixes:

    * httpd: DoS for HTTP/2 connections by continuous SETTINGS (CVE-2018-11763)

    * httpd: Weak Digest auth nonce generation in mod_auth_digest     (CVE-2018-1312)

    * httpd: Out of bound access after failure in reading the HTTP request     (CVE-2018-1301)

    * httpd: Use-after-free on HTTP/2 stream shutdown (CVE-2018-1302)

    * httpd: <FilesMatch> bypass with a trailing newline in the file name     (CVE-2017-15715)

    * httpd: Out of bound write in mod_authnz_ldap when using too small     Accept-Language values (CVE-2017-15710)

    * httpd: Out of bounds read in mod_cache_socache can allow a remote     attacker to cause a denial of service (CVE-2018-1303)

    * httpd: Improper handling of headers in mod_session can allow a remote     user to modify session data for CGI applications (CVE-2018-1283)

    * httpd: mod_http2: too much time allocated to workers, possibly leading to     DoS (CVE-2018-1333)

    * mod_jk: connector path traversal due to mishandled HTTP requests in httpd     (CVE-2018-11759)

    * nghttp2: Null pointer dereference when too large ALTSVC frame is received     (CVE-2018-1000168)

    * openssl: Handling of crafted recursive ASN.1 structures can cause a stack     overflow and resulting denial of service (CVE-2018-0739)

    Details around each issue, including information about the CVE, severity of     the issue, and the CVSS score, can be found on the CVE pages listed in the     Reference section below.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the httpd package has been released.

According to its banner, the version of Apache running on the remote host is 2.4.x prior to 2.4.34. It is, therefore, affected by the following vulnerabilities:

 - By specially crafting HTTP/2 requests, workers would be allocated 60 seconds longer than necessary, leading to worker exhaustion and a denial of service. (CVE-2018-1333)

 - By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used to DoS the server. (CVE-2018-8011)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for apache2 fixes the following issues: The following security vulnerabilities were fixed :

  - CVE-2018-1333: Fixed a worker exhaustion that could have     lead to a denial of service via specially crafted HTTP/2     requests (bsc#1101689).

  - CVE-2018-8011: Fixed a NULL pointer dereference in     mod_md, which could have lead to a denial of service via     specially crafted HTTP requests (bsc#1101688). Note: We     are currently not shipping this modules, since it is     still considered experimental, but we might start to     ship it with future releases.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3783-1 advisory.

    Robert Swiecki discovered that the Apache HTTP Server HTTP/2 module incorrectly destroyed certain streams.
    A remote attacker could possibly use this issue to cause the server to crash, leading to a denial of     service. (CVE-2018-1302)

    Craig Young discovered that the Apache HTTP Server HTTP/2 module incorrectly handled certain requests. A     remote attacker could possibly use this issue to cause the server to consume resources, leading to a     denial of service. (CVE-2018-1333)

    Gal Goldshtein discovered that the Apache HTTP Server HTTP/2 module incorrectly handled large SETTINGS     frames. A remote attacker could possibly use this issue to cause the server to consume resources, leading     to a denial of service. (CVE-2018-11763)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of 'httpd' packages of Photon OS has been released.

This update for apache2 fixes the following issues :

The following security vulnerability were fixed :

  - CVE-2018-1333: Fixed a worker exhaustion that could have     lead to a denial of service via specially crafted HTTP/2     requests (bsc#1101689).

This update was imported from the SUSE:SLE-12-SP2:Update update project.

According to its banner, the version of Apache running on the remote host is 2.4.x prior to 2.4.34. It is, therefore, affected by the following vulnerabilities:

  - By specially crafting HTTP/2 requests, workers would be     allocated 60 seconds longer than necessary, leading to     worker exhaustion and a denial of service. (CVE-2018-1333)

  - By specially crafting HTTP requests, the mod_md challenge     handler would dereference a NULL pointer and cause the     child process to segfault. This could be used to DoS the     server. (CVE-2018-8011)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for apache2 fixes the following issues: The following security vulnerability were fixed :

  - CVE-2018-1333: Fixed a worker exhaustion that could have     lead to a denial of service via specially crafted HTTP/2     requests (bsc#1101689).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New httpd packages are available for Slackware 14.0, 14.1, 14.2, and
-current to fix security issues.

The Apache project reports :

- DoS for HTTP/2 connections by crafted requests (CVE-2018-1333). By specially crafting HTTP/2 requests, workers would be allocated 60 seconds longer than necessary, leading to worker exhaustion and a denial of service. (low)

- mod_md, DoS via Coredumps on specially crafted requests (CVE-2018-8011). By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used to DoS the server. (moderate)

ID	Name	Product	Family	Severity
194113	RHEL 6 / 7 : httpd24 (RHSA-2018:3558)	Nessus	Red Hat Local Security Checks	critical
123274	openSUSE Security Update : apache2 (openSUSE-2019-632)	Nessus	SuSE Local Security Checks	high
122292	RHEL 6 / 7 : Red Hat JBoss Core Services Apache HTTP Server 2.4.29 (RHSA-2019:0367)	Nessus	Red Hat Local Security Checks	critical
121991	Photon OS 2.0: Httpd PHSA-2018-2.0-0089	Nessus	PhotonOS Local Security Checks	high
121885	Photon OS 1.0: Httpd PHSA-2018-1.0-0181	Nessus	PhotonOS Local Security Checks	high
98915	Apache 2.4.x < 2.4.34 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
120085	SUSE SLES15 Security Update : apache2 (SUSE-SU-2018:2424-1)	Nessus	SuSE Local Security Checks	high
117916	Ubuntu 18.04 LTS : Apache HTTP Server vulnerabilities (USN-3783-1)	Nessus	Ubuntu Local Security Checks	high
117399	Photon OS 2.0: Httpd PHSA-2018-2.0-0089 (deprecated)	Nessus	PhotonOS Local Security Checks	high
117336	Photon OS 1.0: Httpd PHSA-2018-1.0-0181 (deprecated)	Nessus	PhotonOS Local Security Checks	high
112006	openSUSE Security Update : apache2 (openSUSE-2018-907)	Nessus	SuSE Local Security Checks	high
112002	openSUSE Security Update : apache2 (openSUSE-2018-893)	Nessus	SuSE Local Security Checks	high
111788	Apache 2.4.x < 2.4.34 Multiple Vulnerabilities	Nessus	Web Servers	high
111784	SUSE SLES12 Security Update : apache2 (SUSE-SU-2018:2336-1)	Nessus	SuSE Local Security Checks	high
111185	Slackware 14.0 / 14.1 / 14.2 / current : httpd (SSA:2018-199-01)	Nessus	Slackware Local Security Checks	high
111177	FreeBSD : Apache httpd -- multiple vulnerabilities (8b1a50ab-8a8e-11e8-add2-b499baebfeaf)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2018-1333

high

Tenable Plugins

critical

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high