Wind River Support Network


LIN8-8980 : Security Advisory - apache - CVE-2018-1283

Created: Apr 2, 2018    Updated: Dec 3, 2018
Resolved Date: May 9, 2018
Found In Version:
Fix Version:
Severity: Standard
Applicable for: Wind River Linux 8
Component/s: Userspace


In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their content by using a Session header. This comes from the HTTP_SESSION variable name used by mod_session to forward its data to CGIs, since the prefix HTTP_ is also used by the Apache HTTP Server to pass HTTP header fields, per CGI specifications.

Other Downloads


Live chat