Wind River Support Network

HomeDefectsLIN6-14455
Fixed

LIN6-14455 : Security Advisory - apache - CVE-2018-1283

Created: Apr 2, 2018    Updated: Dec 3, 2018
Resolved Date: Jun 7, 2018
Found In Version: 6.0.0.36
Fix Version: 6.0.0.37
Severity: Standard
Applicable for: Wind River Linux 6
Component/s: Userspace

Description

In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their content by using a Session header. This comes from the HTTP_SESSION variable name used by mod_session to forward its data to CGIs, since the prefix HTTP_ is also used by the Apache HTTP Server to pass HTTP header fields, per CGI specifications.

https://nvd.nist.gov/vuln/detail/CVE-2018-1283

Other Downloads


Live chat
Online