In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed. In a cluster of servers using a common Digest authentication configuration, HTTP requests could be replayed across servers by an attacker without detection.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-apache2 | Apr 2, 2018 | Mar 26, 2018 | |
| Amazon_linux | — | amazon-linux-upgrade-httpd24 | May 4, 2018 | Mar 23, 2018 |
| Apache Httpd | View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗ | apache-httpd-upgrade-latest | Mar 26, 2018 | Mar 26, 2018 |
| Arch Linux | View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗View advisory ↗ | arch-linux-upgrade-latest | Jul 11, 2025 | Mar 26, 2018 |
| Centos_linux | — | centos-upgrade-httpdcentos-upgrade-httpd-debuginfocentos-upgrade-httpd-develcentos-upgrade-httpd-manualcentos-upgrade-httpd-toolscentos-upgrade-mod_ldapcentos-upgrade-mod_proxy_htmlcentos-upgrade-mod_sessioncentos-upgrade-mod_ssl | Aug 2, 2019 | Mar 23, 2018 |
| Debian | debian-upgrade-apache2 | Apr 4, 2018 | Mar 23, 2018 | |
| Freebsd | freebsd-upgrade-package-apache24freebsd-upgrade-package-apache22 | Mar 25, 2018 | Mar 24, 2018 | |
| Hpux | — | hpux-update-hpuxwsapache | Mar 28, 2022 | Mar 26, 2018 |
| Huawei Euleros 2_0_sp1 | huawei-euleros-2_0_sp1-upgrade-httpdhuawei-euleros-2_0_sp1-upgrade-httpd-develhuawei-euleros-2_0_sp1-upgrade-httpd-manualhuawei-euleros-2_0_sp1-upgrade-httpd-toolshuawei-euleros-2_0_sp1-upgrade-mod_ssl | May 29, 2018 | Mar 26, 2018 | |
| Huawei Euleros 2_0_sp2 | huawei-euleros-2_0_sp2-upgrade-httpdhuawei-euleros-2_0_sp2-upgrade-httpd-develhuawei-euleros-2_0_sp2-upgrade-httpd-manualhuawei-euleros-2_0_sp2-upgrade-httpd-toolshuawei-euleros-2_0_sp2-upgrade-mod_ssl | May 29, 2018 | Mar 26, 2018 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-httpdhuawei-euleros-2_0_sp3-upgrade-httpd-develhuawei-euleros-2_0_sp3-upgrade-httpd-manualhuawei-euleros-2_0_sp3-upgrade-httpd-toolshuawei-euleros-2_0_sp3-upgrade-mod_ssl | Jul 3, 2018 | Mar 26, 2018 | |
| Ibm Http_server | — | ibm-http_server-apply-fix-pack-9_0_0_8 | Aug 6, 2018 | Mar 26, 2018 |
| Oracle Solaris | oracle-solaris-11-3-upgrade-web-server-apache-24-2-4-33-0-175-3-32-0-3-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-dbd-2-4-33-0-175-3-32-0-3-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-ldap-2-4-33-0-175-3-32-0-3-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-lua-2-4-33-0-175-3-32-0-3-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-ssl-2-4-33-0-175-3-32-0-3-0oracle-solaris-11-3-upgrade-web-server-apache-24-module-apache-ssl-fips-140-2-4-33-0-175-3-32-0-3-0 | May 16, 2018 | Mar 26, 2018 | |
| Oracle_linux | — | oracle-linux-upgrade-httpdoracle-linux-upgrade-httpd-develoracle-linux-upgrade-httpd-manualoracle-linux-upgrade-httpd-toolsoracle-linux-upgrade-mod-ldaporacle-linux-upgrade-mod-proxy-htmloracle-linux-upgrade-mod-sessionoracle-linux-upgrade-mod-ssl | Jul 21, 2020 | Mar 21, 2018 |
| Redhat_linux | — | redhat-upgrade-httpdredhat-upgrade-httpd-debuginforedhat-upgrade-httpd-develredhat-upgrade-httpd-manualredhat-upgrade-httpd-toolsredhat-upgrade-mod_ldapredhat-upgrade-mod_proxy_htmlredhat-upgrade-mod_sessionredhat-upgrade-mod_ssl | Jul 30, 2019 | Mar 26, 2018 |
| Suse | — | suse-upgrade-apache2suse-upgrade-apache2-develsuse-upgrade-apache2-docsuse-upgrade-apache2-example-pagessuse-upgrade-apache2-preforksuse-upgrade-apache2-utilssuse-upgrade-apache2-worker | Apr 6, 2018 | Mar 23, 2018 |
| Ubuntu | ubuntu-upgrade-apache2-2-binubuntu-upgrade-apache2-bin | Apr 25, 2018 | Mar 23, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub