CVE-2014-0118
UnknownEPSS 37.16%
Last modified
CVE-2014-0118 is a vulnerability of currently unknown severity. The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted request data that decompresses to a much larger size.. EPSS estimates a 37.16% chance of exploitation in the next 30 days.
Description
The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted request data that decompresses to a much larger size.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Apache | Http Server | >= 2.2.0, < 2.2.29 |
| Apache | Http Server | >= 2.4.1, < 2.4.10 |
| Debian | Debian Linux | 7.0 |
| Debian | Debian Linux | 8.0 |
| Redhat | Jboss Enterprise Application Platform | 6.0.0 |
| Redhat | Jboss Enterprise Application Platform | 6.4.0 |
References
- http://advisories.mageia.org/MGASA-2014-0304.htmlThird Party Advisory
- http://advisories.mageia.org/MGASA-2014-0305.htmlThird Party Advisory
- http://httpd.apache.org/security/vulnerabilities_24.htmlPatch, Vendor Advisory
- http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.htmlBroken Link, Mailing List
- http://marc.info/?l=bugtraq&m=143403519711434&w=2Issue Tracking, Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=143748090628601&w=2Issue Tracking, Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=144050155601375&w=2Issue Tracking, Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=144493176821532&w=2Issue Tracking, Mailing List, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2014-1019.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2014-1020.htmlThird Party Advisory
- http://www.debian.org/security/2014/dsa-2989Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.htmlThird Party Advisory
- http://www.securityfocus.com/bid/68745Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=1120601Issue Tracking, Third Party Advisory
- https://puppet.com/security/cve/cve-2014-0118Third Party Advisory
- https://security.gentoo.org/glsa/201504-03Third Party Advisory
- https://support.apple.com/HT204659Third Party Advisory
- http://advisories.mageia.org/MGASA-2014-0304.htmlThird Party Advisory
- http://advisories.mageia.org/MGASA-2014-0305.htmlThird Party Advisory
- http://httpd.apache.org/security/vulnerabilities_24.htmlPatch, Vendor Advisory
- http://lists.apple.com/archives/security-announce/2015/Apr/msg00001.htmlBroken Link, Mailing List
- http://marc.info/?l=bugtraq&m=143403519711434&w=2Issue Tracking, Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=143748090628601&w=2Issue Tracking, Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=144050155601375&w=2Issue Tracking, Mailing List, Third Party Advisory
- http://marc.info/?l=bugtraq&m=144493176821532&w=2Issue Tracking, Mailing List, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2014-1019.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2014-1020.htmlThird Party Advisory
- http://www.debian.org/security/2014/dsa-2989Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.htmlThird Party Advisory
- http://www.securityfocus.com/bid/68745Third Party Advisory, VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=1120601Issue Tracking, Third Party Advisory
- https://puppet.com/security/cve/cve-2014-0118Third Party Advisory
- https://security.gentoo.org/glsa/201504-03Third Party Advisory
- https://support.apple.com/HT204659Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2014-0118?
The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted request data that decompresses to a much larger size.
How severe is CVE-2014-0118?
Severity scoring for CVE-2014-0118 is pending analysis. The EPSS model estimates a 37.16% probability of exploitation in the next 30 days.
How do I fix CVE-2014-0118?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
Are you affected by CVE-2014-0118?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST