Bug#904106: apache2: CVE-2018-1333: DoS for HTTP/2 connections by crafted requests

To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: Bug#904106: apache2: CVE-2018-1333: DoS for HTTP/2 connections by crafted requests
From: Salvatore Bonaccorso <carnil@debian.org>
Date: Thu, 19 Jul 2018 21:19:09 +0200
Message-id: <[🔎] 153202794966.13316.10626352183236186449.reportbug@eldamar.local>
Reply-to: Salvatore Bonaccorso <carnil@debian.org>, 904106@bugs.debian.org

Source: apache2
Version: 2.4.18-1
Severity: important
Tags: security upstream

Hi,

The following vulnerability was published for apache2.

CVE-2018-1333[0]:
| By specially crafting HTTP/2 requests, workers would be allocated 60
| seconds longer than necessary, leading to worker exhaustion and a
| denial of service. Fixed in Apache HTTP Server 2.4.34 (Affected
| 2.4.18-2.4.30,2.4.33).

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2018-1333
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1333
[1] https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2018-1333

Regards,
Salvatore

Reply to:

Follow-Ups:
- Bug#904106: marked as done (apache2: CVE-2018-1333: DoS for HTTP/2 connections by crafted requests)
  - From: "Debian Bug Tracking System" <owner@bugs.debian.org>

Prev by Date: Bug#902658: apache2: apachectl graceful/restart results in segfault
Next by Date: Bug#904107: apache2: CVE-2018-8011: mod_md, DoS via Coredumps on specially crafted requests
Previous by thread: apr_1.6.3-3_amd64.changes ACCEPTED into unstable
Next by thread: Bug#904106: marked as done (apache2: CVE-2018-1333: DoS for HTTP/2 connections by crafted requests)
Index(es):
- Date
- Thread