Skip to content
OpenAdvisories
Medium ALAS2-2018-1062 1 CVE

Moderate: httpd security update (Amazon Linux 2)

Published Aug 21, 2018 · Updated Aug 21, 2018

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-8011: By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used to DoS the server. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.33). 1605052: CVE-2018-8011 httpd: mod_md: NULL pointer dereference causing httpd child process crash

Fixed packages 11

ReleasePackageFixed in
Amazon Linux · 2 httpd 0:2.4.34-1.amzn2.1.0
Amazon Linux · 2 httpd-debuginfo 0:2.4.34-1.amzn2.1.0
Amazon Linux · 2 httpd-devel 0:2.4.34-1.amzn2.1.0
Amazon Linux · 2 httpd-filesystem 0:2.4.34-1.amzn2.1.0
Amazon Linux · 2 httpd-manual 0:2.4.34-1.amzn2.1.0
Amazon Linux · 2 httpd-tools 0:2.4.34-1.amzn2.1.0
Amazon Linux · 2 mod_ldap 0:2.4.34-1.amzn2.1.0
Amazon Linux · 2 mod_md 0:2.4.34-1.amzn2.1.0
Amazon Linux · 2 mod_proxy_html 1:2.4.34-1.amzn2.1.0
Amazon Linux · 2 mod_session 0:2.4.34-1.amzn2.1.0
Amazon Linux · 2 mod_ssl 1:2.4.34-1.amzn2.1.0

Vulnerabilities 1

  • Unscored —
    CVE-2018-8011 Scanner template EPSS 55%

    mod_md, DoS via Coredumps on specially crafted requests

    By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used to DoS the server. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.33).

    Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-8011.html