CVE-2014-0231

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 43.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-07-20 · updated 2026-06-17
Weakness: CWE-399

Description

The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read from its stdin file descriptor.

Affected products

Apache HTTP Server: from 2.2.0 before 2.2.29; from 2.4.0 before 2.4.10 — fixed in 2.2.29, 2.4.10

How to fix

Upgrade to a fixed version: Apache HTTP Server 2.2.29, 2.4.10. Check the vendor advisory for mitigations.

References

http://advisories.mageia.org/MGASA-2014-0304.html
http://advisories.mageia.org/MGASA-2014-0305.html
http://httpd.apache.org/security/vulnerabilities_24.html
http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.html
http://marc.info/?l=bugtraq&m=143403519711434&w=2
http://marc.info/?l=bugtraq&m=143748090628601&w=2
http://marc.info/?l=bugtraq&m=144050155601375&w=2
http://marc.info/?l=bugtraq&m=144493176821532&w=2
http://packetstormsecurity.com/files/130769/RSA-Digital-Certificate-Solution-XSS-Denial-Of-Service.html
http://rhn.redhat.com/errata/RHSA-2014-1019.html
http://rhn.redhat.com/errata/RHSA-2014-1020.html
http://rhn.redhat.com/errata/RHSA-2014-1021.html

Get alerted when CVE-2014-0231 or the next vulnerability affects your stack