Red Hat Bugzilla – Bug 1560395
CVE-2018-1283 httpd: Improper handling of headers in mod_session can allow a remote user to modify session data for CGI applications
Last modified: 2018-10-30 12:53:03 EDT
Apache HTTP Server (httpd) through version 2.4.29 has a vulnerability in the handling of HTTP session headers in mod_session. When mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their content by using a "Session" header. Upstream Advisory: https://httpd.apache.org/security/vulnerabilities_24.html Upstream Patch: https://svn.apache.org/viewvc?view=revision&sortby=log&revision=1824477
Created httpd tracking bugs for this issue: Affects: fedora-all [bug 1560396]
Statement: This issue did not affect the versions of httpd as shipped with Red Hat Enterprise Linux 5 and 6 as they did not include mod_session module.
mod_session is not installed in RHMAP HTTPD image. Marking RHMAP as not affected. [root@5736ef9f6784 /]# ls /opt/rh/httpd24/root/usr/lib64/httpd/modules/mod_s mod_sed.so mod_slotmem_shm.so mod_socache_shmcb.so mod_status.so mod_systemd.so mod_setenvif.so mod_socache_dbm.so mod_speling.so mod_substitute.so mod_slotmem_plain.so mod_socache_memcache.so mod_ssl.so mod_suexec.so