Detections
Analytics
CVE-2018-17189
medium
Description
In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections.
References
https://www.tenable.com/security/tns-2019-09
https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
https://www.oracle.com/security-alerts/cpujan2020.html
https://www.debian.org/security/2019/dsa-4422
https://usn.ubuntu.com/3937-1/
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03950en_us
https://security.netapp.com/advisory/ntap-20190125-0001/
https://security.gentoo.org/glsa/201903-21
https://seclists.org/bugtraq/2019/Apr/5
https://access.redhat.com/errata/RHSA-2019:4126
https://access.redhat.com/errata/RHSA-2019:3935
https://access.redhat.com/errata/RHSA-2019:3933