Denial of Service Vulnerability in Apache2: CVE-2018-1333
Summary
ALPINE-CVE-2018-1333: By specially crafting HTTP/2 requests, workers would be allocated 60 seconds longer than necessary, leading to worker exhaustion and a denial of service. Affects apache2 versions < 2.4.34-r0. Fixed in 2.4.34-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache HTTP Server, commonly referred to as Apache2, is a widely used open-source web server software that enables the hosting of websites and web applications. It is known for its flexibility, performance, and robust feature set, making it a popular choice among developers and system administrators. However, like any software, it can be susceptible to vulnerabilities that may compromise its security and functionality. This specific vulnerability, identified as CVE-2018-1333, affects multiple versions of Apache2, particularly versions 2.4.18 to 2.4.30 and 2.4.33, leading to potential denial of service (DoS) attacks.
Vulnerability Detail
The vulnerability arises from the way Apache2 handles HTTP/2 requests. By specially crafting these requests, an attacker can cause the server to allocate resources for an extended period—up to 60 seconds longer than necessary. This excessive resource allocation can lead to worker exhaustion, where the server runs out of available worker threads to handle incoming requests, ultimately resulting in a denial of service. The vulnerability is particularly concerning as it can be exploited without authentication, making it accessible to any remote attacker.
How To Fix
Minimum fixed version
2.4.34-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider disabling HTTP/2 support in your Apache configuration as a temporary workaround. This can be done by commenting out or removing the 'Protocols h2 http/1.1' line in your Apache configuration file (usually located at /etc/apache2/httpd.conf or similar). After making changes, restart the Apache service using:
service apache2 restart
Conclusion
CVE-2018-1333 represents a significant denial of service vulnerability in Apache2, affecting multiple versions of the software. It is essential for users to update to the patched version 2.4.34 or later to protect their systems from potential exploitation. For those unable to update immediately, disabling HTTP/2 support serves as a temporary workaround. Regular monitoring and vulnerability management, such as using tools like Vulert, can help maintain the security of open-source software.
See every vulnerability recorded for apache2 →
FAQ
CVE-2018-1333 is a vulnerability in Apache2 that allows attackers to exploit HTTP/2 requests, leading to denial of service by exhausting server resources.
The vulnerability affects Apache2 versions 2.4.18 to 2.4.30 and 2.4.33. It is crucial to update to version 2.4.34 or later.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for CVE-2018-1333 is 7.5, indicating a high severity level.
As a temporary measure, you can disable HTTP/2 support in your Apache configuration to mitigate the risk until you can apply the update.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
