Wind River Support Network


LIN10-3662 : Security Advisory - apache - CVE-2018-1283

Created: Apr 2, 2018    Updated: Dec 3, 2018
Resolved Date: Apr 24, 2018
Found In Version:
Fix Version:
Severity: Standard
Applicable for: Wind River Linux LTS 17
Component/s: Userspace


In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their content by using a Session header. This comes from the HTTP_SESSION variable name used by mod_session to forward its data to CGIs, since the prefix HTTP_ is also used by the Apache HTTP Server to pass HTTP header fields, per CGI specifications.

Other Downloads


Live chat