CVE-2018-17189
30.01.2019, 22:29
In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections.Enginsight
| Vendor | Product | Version |
|---|---|---|
| apache | http_server | 2.4.17 |
| apache | http_server | 2.4.18 |
| apache | http_server | 2.4.20 |
| apache | http_server | 2.4.23 |
| apache | http_server | 2.4.25 |
| apache | http_server | 2.4.26 |
| apache | http_server | 2.4.27 |
| apache | http_server | 2.4.28 |
| apache | http_server | 2.4.29 |
| apache | http_server | 2.4.30 |
| apache | http_server | 2.4.33 |
| apache | http_server | 2.4.34 |
| apache | http_server | 2.4.35 |
| apache | http_server | 2.4.37 |
| netapp | santricity_cloud_connector | - |
| netapp | storage_automation_store | - |
| debian | debian_linux | 9.0 |
| oracle | enterprise_manager_ops_center | 12.3.3 |
| oracle | hospitality_guest_access | 4.2.0 |
| oracle | hospitality_guest_access | 4.2.1 |
| oracle | instantis_enterprisetrack | 17.1 |
| oracle | instantis_enterprisetrack | 17.2 |
| oracle | instantis_enterprisetrack | 17.3 |
| oracle | retail_xstore_point_of_service | 7.0 |
| oracle | retail_xstore_point_of_service | 7.1 |
| oracle | sun_zfs_storage_appliance_kit | 8.8.6 |
| canonical | ubuntu_linux | 14.04 |
| canonical | ubuntu_linux | 16.04 |
| canonical | ubuntu_linux | 18.04 |
| canonical | ubuntu_linux | 18.10 |
| redhat | jboss_core_services | 1.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
References