ClearOS Documentation

×

Warning

301 error for file:https://clearos.com/dokuwiki2/lib/exe/css.php?t=dokuwiki&tseed=82873f9c9a1f5784b951644363f20ef8

User Tools

Site Tools


CVE 2018-1312

'In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed. In a cluster of servers using a common Digest authentication configuration, HTTP requests could be replayed across servers by an attacker without detection.'

ClearCenter response

Short response

The 'AuthType Digest' parameter specified by this vulnerability is NOT enabled by default in ClearOS. Further, this parameter is not tunable to be made available via ClearOS' Webconfig. If you have manually turned this parameter on, disable it.

Long response

The 'AuthType Digest' parameter specified by this vulnerability is NOT enabled by default in ClearOS. Further, this parameter is not tunable to be made available via ClearOS' Webconfig nor does any app in the ClearOS Marketplace require that this parameter be enabled. Users of ClearOS' Webconfig or ClearOS' Web Server would have to be enabled by the user in command line. If you are using custom code that has required you to manipulate this value, please disable it.

Resolution

If you have enabled 'AuthType Digest' through custom editing of ClearOS via command line, disable it.

content/en_us/announcements_cve_cve-2018-1312.txt · Last modified: 2018/09/28 10:21 by dloper

https://clearos.com/dokuwiki2/lib/exe/indexer.php?id=content%3Aen_us%3Aannouncements_cve_cve-2018-1312&1558822795