CVE-2018-11763

Published: Sep 25, 2018Modified: Nov 21, 2024

5.9

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.2 / Impact: 3.6

Source: NVD

Description

In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol.

Affected (17)

Products: Apache: Http Server · Canonical: Ubuntu Linux · Redhat: Enterprise Linux · +2 more

Show all products

Apache: Http Server · Canonical: Ubuntu Linux · Redhat: Enterprise Linux · Oracle: Enterprise Manager Ops Center, Hospitality Guest Access, Instantis Enterprisetrack, Retail Xstore Point Of Service, Secure Global Desktop · Netapp: Storage Automation Store

1 product

1 product

1 product

5 products

Enterprise Manager Ops Center

Hospitality Guest Access

Instantis Enterprisetrack

Retail Xstore Point Of Service

Secure Global Desktop

Netapp

1 product

Storage Automation Store

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Http Server	From 2.4.17 to 2.4.34

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 18.04

Configuration C

5 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 6.0
Redhat Enterprise Linux	Version 7.0
Redhat Enterprise Linux	Version 7.4
Redhat Enterprise Linux	Version 7.5
Redhat Enterprise Linux	Version 7.6

Configuration D

9 vulnerable

Vulnerable Software	Affected Versions
Oracle Enterprise Manager Ops Center	Version 12.3.3
Oracle Hospitality Guest Access	Version 4.2.0
Oracle Hospitality Guest Access	Version 4.2.1
Oracle Instantis Enterprisetrack	Version 17.1
Oracle Instantis Enterprisetrack	Version 17.2
Oracle Instantis Enterprisetrack	Version 17.3
Oracle Retail Xstore Point Of Service	Version 7.0
Oracle Retail Xstore Point Of Service	Version 7.1
Oracle Secure Global Desktop	Version 5.4

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Netapp Storage Automation Store	All versions

References (52)

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html

Source: security@apache.org

http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00056.html

Source: security@apache.org

http://www.securityfocus.com/bid/105414

Source: security@apache.org

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1041713

Source: security@apache.org

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2018:3558

Source: security@apache.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:0366

Source: security@apache.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:0367

Source: security@apache.org

Third Party Advisory

https://httpd.apache.org/security/vulnerabilities_24.html

Source: security@apache.org

Vendor Advisory

https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

https://security.netapp.com/advisory/ntap-20190204-0004/

Source: security@apache.org

Third Party Advisory

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us

Source: security@apache.org

Third Party Advisory

https://usn.ubuntu.com/3783-1/

Source: security@apache.org

Third Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html

Source: security@apache.org

PatchThird Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html

Source: security@apache.org

PatchThird Party Advisory

https://www.tenable.com/security/tns-2019-09

Source: security@apache.org

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00030.html