CVE-2018-11763

Public on 2018-09-25
Modified on 2019-01-25
Description
In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol.
Severity
Medium severity
Medium
See what this means
CVSS v3 Base Score
7.5
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 2 - Core httpd 2019-01-23 ALAS2-2019-1155 Fixed
Amazon Linux 1 httpd24 2018-12-13 ALAS-2018-1104 Fixed
Amazon Linux 2 - Core mod_http2 2018-11-07 ALAS2-2018-1104 Fixed

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

FAQs regarding Amazon Linux ALAS/CVE Severity Red Hat: CVE-2018-11763 Mitre: CVE-2018-11763