Back to search
CVE-2018-1302
Published: Mar 26, 2018
Modified: Sep 17, 2024
PUBLISHED
Description
When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerability hard to trigger in usual configurations, the reporter and the team could not reproduce it outside debug builds, so it is classified as low risk.
| Vendor | Product | Versions |
|---|---|---|
Apache Software Foundation | Apache HTTP Server | affected 2.4.17 to 2.4.29 |
References
https://security.netapp.com/advisory/ntap-20180601-0004/
x_refsource_CONFIRM
RHSA-2019:0367
vendor-advisory
x_refsource_REDHAT
[oss-security] 20180323 CVE-2018-1302: Possible write of after free on HTTP/2 stream shutdown
mailing-list
x_refsource_MLIST
103528
vdb-entry
x_refsource_BID
1040567
vdb-entry
x_refsource_SECTRACK
USN-3783-1
vendor-advisory
x_refsource_UBUNTU
https://httpd.apache.org/security/vulnerabilities_24.html
x_refsource_CONFIRM
RHSA-2019:0366
vendor-advisory
x_refsource_REDHAT
https://www.tenable.com/security/tns-2019-09
x_refsource_CONFIRM
[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/
mailing-list
x_refsource_MLIST
[httpd-cvs] 20210330 svn commit: r1073143 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/
mailing-list
x_refsource_MLIST
[httpd-cvs] 20210330 svn commit: r1073139 [11/13] - in /websites/staging/httpd/trunk/content: ./ security/json/
mailing-list
x_refsource_MLIST
[httpd-cvs] 20210330 svn commit: r1888194 [11/13] - /httpd/site/trunk/content/security/json/
mailing-list
x_refsource_MLIST
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now