ASA-2019-00026 – Apache HTTP Server: mod_http2, DoS via slow, unneeded request bodies

Posted on by Allele Security Intelligence in Alerts

Allele Security Alert

ASA-2019-00026

Identifier(s)

ASA-2019-00026, CVE-2018-17189

Title

mod_http2, DoS via slow, unneeded request bodies

Vendor(s)

Apache Software Foundation

Product(s)

Apache HTTP Server (httpd)

Affected version(s)

Apache HTTP Server versions 2.4.17 to 2.4.37

Fixed version(s)

Apache HTTP Server version 2.4.38

Proof of concept

Unknown

Description

By sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections in  Apache HTTP Server versions 2.4.37 and prior.

Technical details

Unknown

Credits

Gal Goldshtein (F5 Networks)

Reference(s)

Apache HTTP Server 2.4 vulnerabilities
https://httpd.apache.org/security/vulnerabilities_24.html

CVE-2018-17189: mod_http2, DoS via slow, unneeded request bodies
https://seclists.org/oss-sec/2019/q1/80

CVE-2018-17189
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17189

CVE-2018-17189
https://nvd.nist.gov/vuln/detail/CVE-2018-17189

If there is any error in this alert or you wish a comprehensive analysis, let us know.

Last modified: October 2, 2019

We are not responsible for any data loss, device corruption or any other type of issue due to the use of any information mentioned in our security alerts.