ClearOS Documentation

×

Warning

301 error for file:https://clearos.com/dokuwiki2/lib/exe/css.php?t=dokuwiki&tseed=82873f9c9a1f5784b951644363f20ef8

User Tools

Site Tools


CVE 2018-1303

'A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out of bound read while preparing data to be cached in shared memory. It could be used as a Denial of Service attack against users of mod_cache_socache. The vulnerability is considered as low risk since mod_cache_socache is not widely used, mod_cache_disk is not concerned by this vulnerability.'

ClearCenter response

Short response

The 'mod_cache_socache' parameter specified by this vulnerability is NOT enabled by default in ClearOS 7. Further, this parameter is not tunable to be made available via ClearOS' Webconfig. If you have manually turned this parameter on, disable it.

Long response

The 'mod_cache_socache' parameter specified by this vulnerability is NOT enabled by default in ClearOS 7. Further, this parameter is not tunable to be made available via ClearOS' Webconfig nor does any app in the ClearOS Marketplace require that this parameter be enabled. Users of ClearOS' Webconfig or ClearOS' Web Server would have to be enabled by the user in command line. If you are using custom code that has required you to manipulate this value, please disable it.

Resolution

If you have enabled 'mod_cache_socache' through custom editing of ClearOS via command line, disable it.

content/en_us/announcements_cve_cve-2018-1303.txt · Last modified: 2018/09/30 23:05 by dloper

https://clearos.com/dokuwiki2/lib/exe/indexer.php?id=content%3Aen_us%3Aannouncements_cve_cve-2018-1303&1558403502