Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
Bug 1560395 - (CVE-2018-1283) CVE-2018-1283 httpd: Improper handling of headers in mod_session can allow a remote user to modify session data for CGI applications
CVE-2018-1283 httpd: Improper handling of headers in mod_session can allow a ...
Status: NEW
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20180321,repor...
: Security
Depends On: 1560401 1566531 1566539 1560396
Blocks: 1560397
  Show dependency treegraph
 
Reported: 2018-03-26 00:22 EDT by Sam Fowler
Modified: 2018-10-30 12:53 EDT (History)
49 users (show)

See Also:
Fixed In Version: httpd 2.4.30
Doc Type: If docs needed, set a value
Doc Text:
It has been discovered that the mod_session module of Apache HTTP Server (httpd), through version 2.4.29, has an improper input validation flaw in the way it handles HTTP session headers in some configurations. A remote attacker may influence their content by using a "Session" header.
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Sam Fowler 2018-03-26 00:22:56 EDT
Apache HTTP Server (httpd) through version 2.4.29 has a vulnerability in the handling of HTTP session headers in mod_session. When mod_session is configured to forward its session data to CGI applications (SessionEnv on, not the default), a remote user may influence their content by using a "Session" header.


Upstream Advisory:

https://httpd.apache.org/security/vulnerabilities_24.html


Upstream Patch:

https://svn.apache.org/viewvc?view=revision&sortby=log&revision=1824477
Comment 1 Sam Fowler 2018-03-26 00:23:14 EDT
Created httpd tracking bugs for this issue:

Affects: fedora-all [bug 1560396]
Comment 7 Riccardo Schirone 2018-04-12 10:26:50 EDT
Statement:

This issue did not affect the versions of httpd as shipped with Red Hat Enterprise Linux 5 and 6 as they did not include mod_session module.
Comment 8 Jason Shepherd 2018-05-25 01:00:46 EDT
mod_session is not installed in RHMAP HTTPD image. Marking RHMAP as not affected.
[root@5736ef9f6784 /]# ls /opt/rh/httpd24/root/usr/lib64/httpd/modules/mod_s
mod_sed.so               mod_slotmem_shm.so       mod_socache_shmcb.so     mod_status.so            mod_systemd.so           
mod_setenvif.so          mod_socache_dbm.so       mod_speling.so           mod_substitute.so        
mod_slotmem_plain.so     mod_socache_memcache.so  mod_ssl.so               mod_suexec.so

Note You need to log in before you can comment on or make changes to this bug.