MGASA-2018-0007

mod_sessioncrypto was encrypting its data/cookie using the configured ciphers with possibly either CBC or ECB modes of operation (AES256-CBC by default), hence no selectable or builtin authenticated encryption. This made it vulnerable to padding oracle attacks, particularly with CBC (CVE-2016-0736).

Malicious input to modauthdigest will cause the server to crash, and each instance continues to crash even for subsequently valid requests (CVE-2016-2161).

Emmanuel Dreyfus reported that the use of apgetbasicauthpw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed (CVE-2017-3167).

Vasileios Panopoulos of AdNovum Informatik AG discovered that modssl may dereference a NULL pointer when third-party modules call aphookprocessconnection() during an HTTP request to an HTTPS port leading to a denial of service (CVE-2017-3169).

Javier Jimenez reported that the HTTP strict parsing contains a flaw leading to a buffer overread in apfindtoken(). A remote attacker can take advantage of this flaw by carefully crafting a sequence of request headers to cause a segmentation fault, or to force apfindtoken() to return an incorrect value (CVE-2017-7668).

ChenQin and Hanno Boeck reported that mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header (CVE-2017-7679).

Robert Swiecki reported that modauthdigest does not properly initialize or reset the value placeholder in [Proxy-]Authorization headers of type "Digest" between successive key=value assignments, leading to information disclosure or denial of service (CVE-2017-9788).

Hanno Böck discovered that the Apache HTTP Server incorrectly handled Limit directives in .htaccess files. In certain configurations, a remote attacker could possibly use this issue to read arbitrary server memory, including sensitive information. This issue is known as Optionsbleed (CVE-2017-9798).