p PatchFirst

CVE-2018-1301

CVE-2018-1301

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound access after a size limit is reached by reading the HTTP header. This vulnerability is considered very hard if not impossible to trigger in non-debug mode (both log and build level), so it is classified as low risk for common server usage.

CVSS 5.9 · Medium · EPSS 15.0% · Fix available

Published
Updated

Stack: system · web

Affected products and versions

  • apache httpd

    Versions
    • 2.2.0 to 2.4.29: Affected

    No fix published

  • apache2 Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.4.33-1

    Update to 2.4.33-1

  • apache2 Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.4.33-1

    Update to 2.4.33-1

  • apache2 Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.4.33-1

    Update to 2.4.33-1

  • apache2 Ubuntu:14.04:LTS

    Versions
    • 2.4.6-2ubuntu2
    • 2.4.6-2ubuntu3
    • 2.4.6-2ubuntu4
    • 2.4.7-1ubuntu1
    • 2.4.7-1ubuntu2
    • 2.4.7-1ubuntu3
    • 2.4.7-1ubuntu4
    • 2.4.7-1ubuntu4.1
    • 2.4.7-1ubuntu4.4
    • 2.4.7-1ubuntu4.5
    • 2.4.7-1ubuntu4.6
    • 2.4.7-1ubuntu4.7
    • 2.4.7-1ubuntu4.8
    • 2.4.7-1ubuntu4.9
    • 2.4.7-1ubuntu4.10
    • 2.4.7-1ubuntu4.11
    • 2.4.7-1ubuntu4.13
    • 2.4.7-1ubuntu4.15
    • 2.4.7-1ubuntu4.16
    • 2.4.7-1ubuntu4.17
    • 2.4.7-1ubuntu4.18
    • 2.4.7-1ubuntu4.19
    Affected ranges
    • ECOSYSTEM: < 2.4.7-1ubuntu4.20

    Update to 2.4.7-1ubuntu4.20

  • apache2 Ubuntu:16.04:LTS

    Versions
    • 2.4.12-2ubuntu2
    • 2.4.17-1ubuntu1
    • 2.4.17-2ubuntu1
    • 2.4.17-3ubuntu1
    • 2.4.18-1ubuntu1
    • 2.4.18-2ubuntu1
    • 2.4.18-2ubuntu2
    • 2.4.18-2ubuntu3
    • 2.4.18-2ubuntu3.1
    • 2.4.18-2ubuntu3.2
    • 2.4.18-2ubuntu3.3
    • 2.4.18-2ubuntu3.4
    • 2.4.18-2ubuntu3.5
    • 2.4.18-2ubuntu3.7
    Affected ranges
    • ECOSYSTEM: < 2.4.18-2ubuntu3.8

    Update to 2.4.18-2ubuntu3.8

  • apache2 Ubuntu:18.04:LTS

    Versions
    • 2.4.27-2ubuntu3
    • 2.4.29-1ubuntu1
    • 2.4.29-1ubuntu2
    • 2.4.29-1ubuntu3
    • 2.4.29-1ubuntu4
    Affected ranges
    • ECOSYSTEM: < 2.4.29-1ubuntu4.1

    Update to 2.4.29-1ubuntu4.1

Original sources

Check your server →