CVE-2018-1283

Publication date 26 March 2018

Last updated 24 July 2024

Ubuntu priority

Cvss 3 Severity Score

In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their content by using a “Session” header. This comes from the “HTTP_SESSION” variable name used by mod_session to forward its data to CGIs, since the prefix “HTTP_” is also used by the Apache HTTP Server to pass HTTP header fields, per CGI specifications.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
apache2	18.04 LTS bionic	Fixed 2.4.29-1ubuntu4.1
	17.10 artful	Fixed 2.4.27-2ubuntu4.1
	16.04 LTS xenial	Fixed 2.4.18-2ubuntu3.8
	14.04 LTS trusty	Fixed 2.4.7-1ubuntu4.20

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
apache2	Upstream: https://svn.apache.org/viewvc?view=revision&revision=1824390 Upstream: https://svn.apache.org/viewvc?view=revision&revision=1824477

Severity score breakdown

Parameter	Value
Base score	5.3 · Medium
Attack vector	Network
Attack complexity	High
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	High
Availability impact	None
Vector	CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

CVE-2018-1283

Cvss 3 Severity Score

Status

Patch details

Severity score breakdown

References

Related Ubuntu Security Notices (USN)

Other references