CVE-2018-1312
Published: 26 March 2018
In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed. In a cluster of servers using a common Digest authentication configuration, HTTP requests could be replayed across servers by an attacker without detection.
Priority
CVSS 3 base score: 9.8
Status
| Package | Release | Status |
|---|---|---|
|
apache2 Launchpad, Ubuntu, Debian |
artful |
Released
(2.4.27-2ubuntu4.1)
|
| bionic |
Released
(2.4.29-1ubuntu4.1)
|
|
| cosmic |
Released
(2.4.29-1ubuntu4.1)
|
|
| precise |
Released
(2.2.22-1ubuntu1.15)
|
|
| trusty |
Released
(2.4.7-1ubuntu4.20)
|
|
| upstream |
Released
(2.4.30)
|
|
| xenial |
Released
(2.4.18-2ubuntu3.8)
|
|
|
Patches: upstream: https://svn.apache.org/viewvc?view=revision&revision=1824481 (2.4) |
||
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1312
- http://www.openwall.com/lists/oss-security/2018/03/24/7
- https://httpd.apache.org/security/vulnerabilities_24.html
- https://ubuntu.com/security/notices/USN-3627-1
- https://ubuntu.com/security/notices/USN-3627-2
- https://ubuntu.com/security/notices/USN-3937-2
- NVD
- Launchpad
- Debian