p PatchFirst

CVE-2018-1302

CVE-2018-1302

This page contains facts from public vulnerability sources. Check the original advisory before updating.

When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerability hard to trigger in usual configurations, the reporter and the team could not reproduce it outside debug builds, so it is classified as low risk.

CVSS 5.9 · Medium · EPSS 12.9% · Fix available

Published
Updated

Stack: system · web

Affected products and versions

  • apache httpd

    Versions
    • 2.4.17 to 2.4.29: Affected

    No fix published

  • apache2 Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.4.33-1

    Update to 2.4.33-1

  • apache2 Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.4.33-1

    Update to 2.4.33-1

  • apache2 Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.4.33-1

    Update to 2.4.33-1

  • apache2 Ubuntu:18.04:LTS

    Versions
    • 2.4.27-2ubuntu3
    • 2.4.29-1ubuntu1
    • 2.4.29-1ubuntu2
    • 2.4.29-1ubuntu3
    • 2.4.29-1ubuntu4
    • 2.4.29-1ubuntu4.1
    • 2.4.29-1ubuntu4.2
    • 2.4.29-1ubuntu4.3
    Affected ranges
    • ECOSYSTEM: < 2.4.29-1ubuntu4.4

    Update to 2.4.29-1ubuntu4.4

Original sources

Check your server →