Apache HTTP Server 2.4.17 to 2.4.34 Denial of Service Vulnerability in apache2 Package
Summary
ALPINE-CVE-2018-11763: In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. Affects apache2 versions < 2.4.35-r0. Fixed in 2.4.35-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server is a widely used open-source web server software that enables users to serve web content. It is known for its flexibility, power, and extensive feature set, including support for various protocols and modules. The apache2 package in Alpine Linux provides a lightweight version of this server, optimized for performance and security. However, certain versions of this package are vulnerable to a Denial of Service (DoS) attack due to improper handling of HTTP/2 connections, which can lead to resource exhaustion.
Vulnerability Detail
The vulnerability, identified as CVE-2018-11763, affects Apache HTTP Server versions 2.4.17 to 2.4.34. By sending continuous, large SETTINGS frames over HTTP/2 connections, an attacker can monopolize server resources, including CPU time and threads, without triggering connection timeouts. This can lead to degraded performance or complete unavailability of the server, impacting legitimate users and services. The issue arises from the server's inability to manage resource allocation effectively under certain conditions.
How To Fix
Minimum fixed version
2.4.35-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the HTTP/2 protocol (h2) in your Apache configuration to mitigate the risk of this vulnerability. This can be done by commenting out or removing the 'Protocols h2 http/1.1' line in your Apache configuration file.
Conclusion
The CVE-2018-11763 vulnerability in Apache HTTP Server poses a significant risk to systems using affected versions of the apache2 package. It is crucial to update to the patched version 2.4.35-r0 or later to safeguard against potential Denial of Service attacks. Implementing the recommended workaround can provide temporary relief until an update can be applied.
See every vulnerability recorded for apache2 →
FAQ
CVE-2018-11763 is a vulnerability in Apache HTTP Server that allows an attacker to perform a Denial of Service attack by exploiting HTTP/2 connections.
The vulnerability affects Apache HTTP Server versions 2.4.17 to 2.4.34.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of this vulnerability is 5.9, indicating a moderate severity level.
If you cannot update the package immediately, consider disabling the HTTP/2 protocol as a temporary workaround to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
