What’s Vulnerable › Vulnerabilities
CVE-2018-1312
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 15.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2018-03-26 · updated 2026-06-17
- Weakness: CWE-287
Description
In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed. In a cluster of servers using a common Digest authentication configuration, HTTP requests could be replayed across servers by an attacker without detection.
Affected products
- Apache HTTP Server: 2.4.1, 2.4.2, 2.4.3, 2.4.4, 2.4.6, 2.4.7 (+13)
- Canonical Ubuntu Linux: 12.04, 14.04, 16.04, 17.10, 18.04
- Debian Linux: 7.0, 8.0, 9.0
- NetApp Cloud Backup: all versions
- Clustered Data ONTAP: all versions
- NetApp StorageGRID: all versions
- RedHat Enterprise Linux Desktop: 7.0
- RedHat Enterprise Linux Eus: 7.6
- RedHat Enterprise Linux Server: 7.0
- RedHat Enterprise Linux Server Aus: 7.6
- RedHat Enterprise Linux Server Tus: 7.6
- RedHat Enterprise Linux Workstation: 7.0
- RedHat Jboss Core Services: 1.0
References
- http://www.openwall.com/lists/oss-security/2018/03/24/7
- http://www.securityfocus.com/bid/103524
- http://www.securitytracker.com/id/1040571
- https://access.redhat.com/errata/RHSA-2018:3558
- https://access.redhat.com/errata/RHSA-2019:0366
- https://access.redhat.com/errata/RHSA-2019:0367
- https://access.redhat.com/errata/RHSA-2019:1898
- https://httpd.apache.org/security/vulnerabilities_24.html
- https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E
Get alerted when CVE-2018-1312 or the next vulnerability affects your stack