CVE-2018-17189
MEDIUM severity · CVSS 5.3 · Uncontrolled resource consumption
5.3CVSS MEDIUM
Summary
In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections.
Impact & exploitability
Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
Confidentiality impactNone
Integrity impactNone
Availability impactLow
Exploit probability (EPSS)20%
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products we track (2)
Recommendation
Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.
Additional information
- NVD record
- https://httpd.apache.org/security/vulnerabilities_24.htmlAdvisory
- http://www.securityfocus.com/bid/106685Advisory
- https://access.redhat.com/errata/RHSA-2019:3932Advisory
- https://access.redhat.com/errata/RHSA-2019:3933Advisory
- https://access.redhat.com/errata/RHSA-2019:3935Advisory
- https://access.redhat.com/errata/RHSA-2019:4126Advisory
- https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E