Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

mod_ssl vulnerabilities and exploits

(subscribe to this query)
9.1
CVSSv3
CVE-2017-9788
In Apache httpd prior to 2.2.34 and 2.4.x prior to 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key with no '...
Apache Http ServerDebian Debian Linux 8.0Debian Debian Linux 9.0Apple Mac Os XNetapp Storage Automation Store -Netapp Oncommand Unified Manager -Redhat Enterprise Linux Desktop 7.0Redhat Enterprise Linux Server Aus 7.2Redhat Enterprise Linux Workstation 7.0Redhat Enterprise Linux Server Tus 7.2Redhat Enterprise Linux Server 7.0Redhat Enterprise Linux Server Eus 7.2Redhat Enterprise Linux Desktop 6.0Redhat Enterprise Linux Server 6.0Redhat Enterprise Linux Workstation 6.0Redhat Enterprise Linux Server Tus 7.3Redhat Enterprise Linux Server Aus 7.3Redhat Enterprise Linux Server Aus 7.4Redhat Enterprise Linux Server Eus 7.3Redhat Enterprise Linux Server Eus 7.4Redhat Enterprise Linux Server Tus 7.4Redhat Enterprise Linux Server Eus 7.5
7.8
CVSSv3
CVE-2019-0211
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent ...
Apache Http ServerFedoraproject Fedora 29Fedoraproject Fedora 30Canonical Ubuntu Linux 16.04Canonical Ubuntu Linux 14.04Canonical Ubuntu Linux 18.04Canonical Ubuntu Linux 18.10Debian Debian Linux 9.0Opensuse Leap 42.3Opensuse Leap 15.0
7.8
CVSSv3
CVE-2004-0940
Buffer overflow in the get_tag function in mod_include for Apache 1.3.x to 1.3.32 allows local users who can create SSI documents to execute arbitrary code as the apache user via SSI (XSSI) documents that trigger a length calculation error.
Openpkg Openpkg 2.0Openpkg Openpkg 2.1Openpkg Openpkg 2.2Apache Http ServerSlackware Slackware Linux 9.0Slackware Slackware Linux 8.1Slackware Slackware Linux 10.0Hp Hp-ux 11.11Suse Suse Linux 9.2Suse Suse Linux 9.0Slackware Slackware Linux 8.0Suse Suse Linux 8.2Slackware Slackware Linux 9.1Slackware Slackware Linux CurrentSuse Suse Linux 8.0Trustix Secure Linux 1.5Hp Hp-ux 11.00Hp Hp-ux 11.22Suse Suse Linux 9.1Hp Hp-ux 11.20Suse Suse Linux 8.1
7.8
CVSSv3
CVE-2002-0653
Off-by-one buffer overflow in the ssl_compat_directive function, as called by the rewrite_command hook for mod_ssl Apache module 2.8.9 and previous versions, allows local users to execute arbitrary code as the Apache server user via .htaccess files with long entries.
Modssl Mod Ssl
7.5
CVSSv3
CVE-2019-0217
In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.
Apache Http ServerDebian Debian Linux 8.0Debian Debian Linux 9.0Fedoraproject Fedora 28Fedoraproject Fedora 29Fedoraproject Fedora 30Canonical Ubuntu Linux 16.04Canonical Ubuntu Linux 14.04Canonical Ubuntu Linux 12.04Canonical Ubuntu Linux 18.04Canonical Ubuntu Linux 18.10Redhat Enterprise Linux Desktop 7.0Redhat Enterprise Linux Workstation 7.0Redhat Enterprise Linux Server 7.0Redhat Enterprise Linux -Opensuse Leap 42.3Opensuse Leap 15.0Netapp Clustered Data Ontap -Netapp Oncommand Unified Manager -Oracle Retail Xstore Point Of Service 7.1Oracle Retail Xstore Point Of Service 7.0Oracle Http Server 12.2.1.3.0
7.5
CVSSv3
CVE-2019-0215
In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client to bypass configured access control restrictions.
Apache Http Server 2.4.37Apache Http Server 2.4.38Fedoraproject Fedora 29Fedoraproject Fedora 30
7.5
CVSSv3
CVE-2018-17199
In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since the expiry time is loaded when the session is decoded.
Apache Http ServerDebian Debian Linux 8.0Debian Debian Linux 9.0Netapp Santricity Cloud Connector -Netapp Storage Automation Store -Canonical Ubuntu Linux 16.04Canonical Ubuntu Linux 14.04Canonical Ubuntu Linux 18.04Canonical Ubuntu Linux 18.10Oracle Enterprise Manager Ops Center 12.3.3
7.5
CVSSv3
CVE-2019-0190
A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request that would cause mod_ssl to enter a loop leading to a denial of service. This bug can be only triggered with Apache HTTP Server version 2.4.37 when using OpenSS...
Apache Http Server 2.4.37Oracle Retail Xstore Point Of Service 7.1Oracle Retail Xstore Point Of Service 7.0Oracle Hospitality Guest Access 4.2.0Oracle Hospitality Guest Access 4.2.1Oracle Enterprise Manager Ops Center 12.3.3Oracle Instantis Enterprisetrack 17.1Oracle Instantis Enterprisetrack 17.2Oracle Instantis Enterprisetrack 17.3
7.5
CVSSv3
CVE-2016-8743
Apache HTTP Server, in all releases before 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interac...
Apache Http ServerNetapp Clustered Data Ontap -Netapp Oncommand Unified Manager -Debian Debian Linux 8.0Debian Debian Linux 9.0Redhat Enterprise Linux Desktop 7.0Redhat Enterprise Linux Workstation 7.0Redhat Enterprise Linux Server 7.0Redhat Enterprise Linux Desktop 6.0Redhat Enterprise Linux Server 6.0Redhat Enterprise Linux Workstation 6.0Redhat Enterprise Linux Server Tus 7.3Redhat Enterprise Linux Server Aus 7.3Redhat Enterprise Linux Server Aus 7.4Redhat Enterprise Linux Eus 7.3Redhat Enterprise Linux Eus 7.4Redhat Enterprise Linux Eus 7.5Redhat Enterprise Linux Server Tus 7.6Redhat Enterprise Linux Server Aus 7.6Redhat Enterprise Linux Eus 7.6Redhat Enterprise Linux Server Aus 7.7Redhat Enterprise Linux Server Tus 7.7
5.3
CVSSv3
CVE-2019-0196
A vulnerability was found in Apache HTTP Server 2.4.17 to 2.4.38. Using fuzzed network input, the http/2 request handling could be made to access freed memory in string comparison when determining the method of a request and thus process the request incorrectly.
Apache Http ServerCanonical Ubuntu Linux 16.04Canonical Ubuntu Linux 14.04Canonical Ubuntu Linux 18.04Canonical Ubuntu Linux 18.10Debian Debian Linux 9.0
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-3400CVE-2023-7252CVE-2024-21111denial of serviceCVE-2024-29661CVE-2024-22856remote attackersencryptionCVE-2023-38299
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook