Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-17189: In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections. 1668497: CVE-2018-17189 httpd: mod_http2: DoS via slow, unneeded request bodies
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | mod_http2 | 0:1.14.1-1.amzn2 |
| Amazon Linux · 2 | mod_http2-debuginfo | 0:1.14.1-1.amzn2 |
Vulnerabilities 1
-
Unscored —CVE-2018-17189 EPSS 19%
In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the …
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2018-17189.html