| nessus
via4
|
| NASL family | Amazon Linux Local Security Checks | | NASL id | ALA_ALAS-2018-1062.NASL | | description | By specially crafting HTTP requests, the mod_md challenge handler
would dereference a NULL pointer and cause the child process to
segfault. This could be used to DoS the server. Fixed in Apache HTTP
Server 2.4.34 (Affected 2.4.33).(CVE-2018-8011) | | last seen | 2019-01-16 | | modified | 2018-09-17 | | plugin id | 112090 | | published | 2018-08-24 | | reporter | Tenable | | source | https://www.tenable.com/plugins/index.php?view=single&id=112090 | | title | Amazon Linux AMI : httpd24 (ALAS-2018-1062) |
| NASL family | FreeBSD Local Security Checks | | NASL id | FREEBSD_PKG_8B1A50AB8A8E11E8ADD2B499BAEBFEAF.NASL | | description | The Apache project reports :
- DoS for HTTP/2 connections by crafted requests (CVE-2018-1333). By
specially crafting HTTP/2 requests, workers would be allocated 60
seconds longer than necessary, leading to worker exhaustion and a
denial of service. (low)
- mod_md, DoS via Coredumps on specially crafted requests
(CVE-2018-8011). By specially crafting HTTP requests, the mod_md
challenge handler would dereference a NULL pointer and cause the child
process to segfault. This could be used to DoS the server. (moderate) | | last seen | 2019-01-16 | | modified | 2018-11-10 | | plugin id | 111177 | | published | 2018-07-20 | | reporter | Tenable | | source | https://www.tenable.com/plugins/index.php?view=single&id=111177 | | title | FreeBSD : Apache httpd -- multiple vulnerabilities (8b1a50ab-8a8e-11e8-add2-b499baebfeaf) |
| NASL family | Amazon Linux Local Security Checks | | NASL id | AL2_ALAS-2018-1062.NASL | | description | By specially crafting HTTP requests, the mod_md challenge handler
would dereference a NULL pointer and cause the child process to
segfault. This could be used to DoS the server. Fixed in Apache HTTP
Server 2.4.34 (Affected 2.4.33). (CVE-2018-8011) | | last seen | 2019-01-16 | | modified | 2018-09-17 | | plugin id | 112087 | | published | 2018-08-24 | | reporter | Tenable | | source | https://www.tenable.com/plugins/index.php?view=single&id=112087 | | title | Amazon Linux 2 : httpd (ALAS-2018-1062) |
| NASL family | SuSE Local Security Checks | | NASL id | SUSE_SU-2018-2424-1.NASL | | description | This update for apache2 fixes the following issues: The following
security vulnerabilities were fixed :
- CVE-2018-1333: Fixed a worker exhaustion that could have
lead to a denial of service via specially crafted HTTP/2
requests (bsc#1101689).
- CVE-2018-8011: Fixed a NULL pointer dereference in
mod_md, which could have lead to a denial of service via
specially crafted HTTP requests (bsc#1101688). Note: We
are currently not shipping this modules, since it is
still considered experimental, but we might start to
ship it with future releases.
Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues. | | last seen | 2019-01-16 | | modified | 2019-01-02 | | plugin id | 120085 | | published | 2019-01-02 | | reporter | Tenable | | source | https://www.tenable.com/plugins/index.php?view=single&id=120085 | | title | SUSE SLES15 Security Update : apache2 (SUSE-SU-2018:2424-1) |
| NASL family | Fedora Local Security Checks | | NASL id | FEDORA_2018-C3DC008C54.NASL | | description | This update includes the latest upstream release,
**httpd 2.4.34**, with multiple bug fixes and enhancements. See
http://www.apache.org/dist/httpd/CHANGES_2.4.34 for more information
on the changes in this version.
A security vulnerability is addressed in this update :
- `mod_md`: DoS via Coredumps on specially crafted
requests (CVE-2018-8011) The following changes are also
included in this update :
- The post-transaction scriptlet to restart
`httpd.service` no longer blocks waiting for the restart
to complete.
- `mod_ssl` now supports loading private keys (and
associated certificates) from a PKCS#11 provider. Use a
`pkcs11:` URI in the `SSLCertificateKeyFile` (and
optionally `SSLCertificateFile`) directive(s).
- An example Lua-based `server-status.conf` is packaged in
the docdir
- `httpd` now Obsoletes `mod_proxy_uwsgi` (RHBZ#1599113)
- `mod_systemd` now logs listening ports at startup
Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as
possible without introducing additional issues. | | last seen | 2019-01-16 | | modified | 2018-09-17 | | plugin id | 111401 | | published | 2018-07-30 | | reporter | Tenable | | source | https://www.tenable.com/plugins/index.php?view=single&id=111401 | | title | Fedora 27 : httpd (2018-c3dc008c54) |
| NASL family | Slackware Local Security Checks | | NASL id | SLACKWARE_SSA_2018-199-01.NASL | | description | New httpd packages are available for Slackware 14.0, 14.1, 14.2, and
-current to fix security issues. | | last seen | 2018-10-05 | | modified | 2018-10-04 | | plugin id | 111185 | | published | 2018-07-20 | | reporter | Tenable | | source | https://www.tenable.com/plugins/index.php?view=single&id=111185 | | title | Slackware 14.0 / 14.1 / 14.2 / current : httpd (SSA:2018-199-01) |
| NASL family | SuSE Local Security Checks | | NASL id | OPENSUSE-2018-907.NASL | | description | This update for apache2 fixes the following issues :
The following security vulnerabilities were fixed :
- CVE-2018-1333: Fixed a worker exhaustion that could have
lead to a denial of service via specially crafted HTTP/2
requests (bsc#1101689).
- CVE-2018-8011: Fixed a NULL pointer dereference in
mod_md, which could have lead to a denial of service via
specially crafted HTTP requests (bsc#1101688). Note: We
are currently not shipping this modules, since it is
still considered experimental, but we might start to
ship it with future releases.
This update was imported from the SUSE:SLE-15:Update update project. | | last seen | 2019-01-16 | | modified | 2018-10-04 | | plugin id | 112006 | | published | 2018-08-20 | | reporter | Tenable | | source | https://www.tenable.com/plugins/index.php?view=single&id=112006 | | title | openSUSE Security Update : apache2 (openSUSE-2018-907) |
| NASL family | Web Servers | | NASL id | APACHE_2_4_34.NASL | | description | According to its banner, the version of Apache running on the remote
host is 2.4.x prior to 2.4.34. It is, therefore, affected by the
following vulnerabilities:
- By specially crafting HTTP/2 requests, workers would be
allocated 60 seconds longer than necessary, leading to
worker exhaustion and a denial of service. (CVE-2018-1333)
- By specially crafting HTTP requests, the mod_md challenge
handler would dereference a NULL pointer and cause the
child process to segfault. This could be used to DoS the
server. (CVE-2018-8011)
Note that Nessus has not tested for these issues but has instead
relied only on the application's self-reported version number. | | last seen | 2019-01-16 | | modified | 2018-12-13 | | plugin id | 111788 | | published | 2018-08-16 | | reporter | Tenable | | source | https://www.tenable.com/plugins/index.php?view=single&id=111788 | | title | Apache 2.4.x < 2.4.34 Multiple Vulnerabilities |
| NASL family | Fedora Local Security Checks | | NASL id | FEDORA_2018-49D3B42425.NASL | | description | This update includes the latest upstream release,
**httpd 2.4.34**, with multiple bug fixes and enhancements. See
http://www.apache.org/dist/httpd/CHANGES_2.4.34 for more information
on the changes in this version.
A security vulnerability is addressed in this update :
- `mod_md`: DoS via Coredumps on specially crafted
requests (CVE-2018-8011) The following changes are also
included in this update :
- The post-transaction scriptlet to restart
`httpd.service` no longer blocks waiting for the restart
to complete.
- `mod_ssl` now supports loading private keys (and
associated certificates) from a PKCS#11 provider. Use a
`pkcs11:` URI in the `SSLCertificateKeyFile` (and
optionally `SSLCertificateFile`) directive(s).
- An example Lua-based `server-status.conf` is packaged in
the docdir
- `httpd` now Obsoletes `mod_proxy_uwsgi` (RHBZ#1599113)
- `mod_systemd` now logs listening ports at startup
Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as
possible without introducing additional issues. | | last seen | 2019-01-16 | | modified | 2019-01-03 | | plugin id | 120394 | | published | 2019-01-03 | | reporter | Tenable | | source | https://www.tenable.com/plugins/index.php?view=single&id=120394 | | title | Fedora 28 : httpd (2018-49d3b42425) |
|
