Wind River Support Network

HomeDefectsLIN9-6661
Fixed

LIN9-6661 : Security Advisory - apache - CVE-2018-1283

Created: Apr 2, 2018    Updated: Dec 3, 2018
Resolved Date: Apr 10, 2018
Found In Version: 9.0.0.15
Fix Version: 9.0.0.16
Severity: Standard
Applicable for: Wind River Linux 9
Component/s: Userspace

Description

In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their content by using a Session header. This comes from the HTTP_SESSION variable name used by mod_session to forward its data to CGIs, since the prefix HTTP_ is also used by the Apache HTTP Server to pass HTTP header fields, per CGI specifications.

https://nvd.nist.gov/vuln/detail/CVE-2018-1283

Other Downloads


CVEs


Live chat
Online