In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured ciphers with possibly either CBC or ECB modes of operation (AES256-CBC by default), hence no selectable or builtin authenticated encryption. This made it vulnerable to padding oracle attacks, particularly with CBC.
CVSS Details
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | alpine-linux-upgrade-apache2 | Aug 30, 2017 | Jul 27, 2017 |
| Amazon_linux | — | amazon-linux-upgrade-httpd24 | Jan 20, 2017 | Dec 20, 2016 |
| Apache Httpd | View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗ | apache-httpd-upgrade-latest | Jul 27, 2017 | Jul 27, 2017 |
| Apple Osx Apache | apple-osx-security-update-2017-001-sierraapple-osx-security-update-2017-004-el-capitanapple-osx-upgrade-latest | Mar 28, 2017 | Mar 28, 2017 | |
| Centos_linux | — | centos-upgrade-httpdcentos-upgrade-httpd-debuginfocentos-upgrade-httpd-develcentos-upgrade-httpd-manualcentos-upgrade-httpd-toolscentos-upgrade-mod_ldapcentos-upgrade-mod_proxy_htmlcentos-upgrade-mod_sessioncentos-upgrade-mod_ssl | Apr 13, 2017 | Dec 20, 2016 |
| Debian | debian-upgrade-apache2 | Feb 27, 2017 | Dec 20, 2016 | |
| Freebsd | freebsd-upgrade-package-apache24 | Dec 21, 2016 | Dec 21, 2016 | |
| Gentoo Linux | gentoo-linux-upgrade-www-servers-apache | Oct 30, 2017 | Jul 27, 2017 | |
| Hpux | — | hpux-update-hpuxws24apache-apachehpux-update-hpuxws24apache-apache2hpux-update-hpuxws24apache-auth_ldaphpux-update-hpuxws24apache-auth_ldap2hpux-update-hpuxws24apache-mod_jkhpux-update-hpuxws24apache-mod_jk2hpux-update-hpuxws24apache-mod_perlhpux-update-hpuxws24apache-mod_perl2hpux-update-hpuxws24apache-webproxyhpux-update-hpuxws24apache-webproxy2 | Aug 11, 2017 | Jul 27, 2017 |
| Huawei Euleros 2_0_sp1 | huawei-euleros-2_0_sp1-upgrade-httpdhuawei-euleros-2_0_sp1-upgrade-httpd-develhuawei-euleros-2_0_sp1-upgrade-httpd-manualhuawei-euleros-2_0_sp1-upgrade-httpd-toolshuawei-euleros-2_0_sp1-upgrade-mod_ssl | Jan 18, 2018 | Jul 27, 2017 | |
| Huawei Euleros 2_0_sp2 | huawei-euleros-2_0_sp2-upgrade-httpdhuawei-euleros-2_0_sp2-upgrade-httpd-develhuawei-euleros-2_0_sp2-upgrade-httpd-manualhuawei-euleros-2_0_sp2-upgrade-httpd-toolshuawei-euleros-2_0_sp2-upgrade-mod_ssl | Jan 18, 2018 | Jul 27, 2017 | |
| Ibm Http_server | — | ibm-http_server-apply-fix-pack-9_0_0_3 | Jun 22, 2018 | Jul 27, 2017 |
| Oracle Solaris | oracle-solaris-11-3-upgrade-web-server-apache-24-2-4-25-0-175-3-17-0-3-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-dbd-2-4-25-0-175-3-17-0-3-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-gss-2-4-25-0-175-3-17-0-3-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-ldap-2-4-25-0-175-3-17-0-3-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-lua-2-4-25-0-175-3-17-0-3-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-ssl-2-4-25-0-175-3-17-0-3-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-ssl-fips-140-2-4-25-0-175-3-17-0-3-0 | May 29, 2017 | May 29, 2017 | |
| Oracle_linux | — | oracle-linux-upgrade-httpdoracle-linux-upgrade-httpd-develoracle-linux-upgrade-httpd-manualoracle-linux-upgrade-httpd-toolsoracle-linux-upgrade-mod-ldaporacle-linux-upgrade-mod-proxy-htmloracle-linux-upgrade-mod-sessionoracle-linux-upgrade-mod-ssl | Apr 13, 2017 | Dec 20, 2016 |
| Redhat_linux | — | redhat-upgrade-httpdredhat-upgrade-httpd-debuginforedhat-upgrade-httpd-develredhat-upgrade-httpd-manualredhat-upgrade-httpd-toolsredhat-upgrade-mod_ldapredhat-upgrade-mod_proxy_htmlredhat-upgrade-mod_sessionredhat-upgrade-mod_ssl | Apr 12, 2017 | Dec 20, 2016 |
| Suse | — | suse-upgrade-apache2suse-upgrade-apache2-develsuse-upgrade-apache2-docsuse-upgrade-apache2-eventsuse-upgrade-apache2-example-pagessuse-upgrade-apache2-preforksuse-upgrade-apache2-utilssuse-upgrade-apache2-worker | Mar 23, 2017 | Dec 20, 2016 |
| Ubuntu | ubuntu-upgrade-apache2-bin | May 9, 2017 | Dec 20, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub