NetSight
IP …
critical9.8

CVE-2018-1312

In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated u…

Impact

In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed. In a cluster of servers using a common Digest authentication configuration, HTTP requests could be replayed across servers by an attacker without detection.

Affected products

VendorProductAffected versions
ApacheHttp Server
Versions 2.4.1, 2.4.2, 2.4.3, 2.4.4, 2.4.6, 2.4.7
CanonicalUbuntu Linux
Versions 12.04, 14.04, 16.04, 17.10, 18.04
DebianDebian Linux
Versions 7.0, 8.0, 9.0
NetappCloud Backup
All versions
NetappStoragegrid
All versions
NetappClustered Data Ontap
All versions
RedhatJboss Core Services
Version 1.0
RedhatEnterprise Linux Desktop
Version 7.0
RedhatEnterprise Linux Eus
Version 7.6
RedhatEnterprise Linux Server
Version 7.0
RedhatEnterprise Linux Server Aus
Version 7.6
RedhatEnterprise Linux Server Tus
Version 7.6

Weakness classification

CWE-287

References