Wind River Support Network

HomeDefectsLIN10-3662
Fixed

LIN10-3662 : Security Advisory - apache - CVE-2018-1283

Created: Apr 2, 2018    Updated: Dec 3, 2018
Resolved Date: Apr 24, 2018
Found In Version: 10.17.41.1
Fix Version: 10.17.41.7
Severity: Standard
Applicable for: Wind River Linux LTS 17
Component/s: Userspace

Description

In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their content by using a Session header. This comes from the HTTP_SESSION variable name used by mod_session to forward its data to CGIs, since the prefix HTTP_ is also used by the Apache HTTP Server to pass HTTP header fields, per CGI specifications.

https://nvd.nist.gov/vuln/detail/CVE-2018-1283

Other Downloads

CVEs

Live chat
Online
  • Linkedin
  • Facebook
  • Twitter
  • Youtube