Allele Security Alert
ASA-2019-00026
Identifier(s)
ASA-2019-00026, CVE-2018-17189
Title
mod_http2, DoS via slow, unneeded request bodies
Vendor(s)
Apache Software Foundation
Product(s)
Apache HTTP Server (httpd)
Affected version(s)
Apache HTTP Server versions 2.4.17 to 2.4.37
Fixed version(s)
Apache HTTP Server version 2.4.38
Proof of concept
Unknown
Description
By sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections in Apache HTTP Server versions 2.4.37 and prior.
Technical details
Unknown
Credits
Gal Goldshtein (F5 Networks)
Reference(s)
Apache HTTP Server 2.4 vulnerabilities
https://httpd.apache.org/security/vulnerabilities_24.html
CVE-2018-17189: mod_http2, DoS via slow, unneeded request bodies
https://seclists.org/oss-sec/2019/q1/80
CVE-2018-17189
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17189
CVE-2018-17189
https://nvd.nist.gov/vuln/detail/CVE-2018-17189
If there is any error in this alert or you wish a comprehensive analysis, let us know.
Last modified: October 2, 2019