5.9
CVE-2018-1302
- EPSS 8.12%
- Published 26.03.2018 15:29:00
- Last modified 21.11.2024 03:59:34
- Source security@apache.org
- Teams watchlist Login
- Open Login
When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerability hard to trigger in usual configurations, the reporter and the team could not reproduce it outside debug builds, so it is classified as low risk.
Data is provided by the National Vulnerability Database (NVD)
Apache ≫ HTTP Server Version <= 2.4.29
Canonical ≫ Ubuntu Linux Version18.04 SwEditionlts
Netapp ≫ Clustered Data Ontap Version-
Netapp ≫ Santricity Cloud Connector Version-
Netapp ≫ Storage Automation Store Version-
Netapp ≫ Storagegrid Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 8.12% | 0.918 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 5.9 | 2.2 | 3.6 |
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
|
| nvd@nist.gov | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:N/I:N/A:P
|
CWE-476 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.