Improper input validation in Apache Http Server
CVE-2012-0021
The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server 2.2.17 through 2.2.21, when a threaded MPM is used, does not properly handle a %{}C format string, which allows remote attackers to cause a denial of service (daemon crash) via a cookie that lacks both a name and a value.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.308 (98.1th percentile) — read the EPSS interpretation.
Affected products
- Apache Http_server — versions 2.2.17, 2.2.18, 2.2.19
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secalert@redhat.com (x_refsource_CONFIRM, Patch)
- secalert@redhat.com (x_refsource_HP, vendor-advisory)
- secalert@redhat.com (vendor-advisory, x_refsource_MANDRIVA)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_HP, vendor-advisory)
- secalert@redhat.com (x_refsource_CONFIRM, Patch)
- secalert@redhat.com (x_refsource_CONFIRM)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
- secalert@redhat.com (x_refsource_CONFIRM, Vendor Advisory)
- secalert@redhat.com (vendor-advisory, x_refsource_APPLE)
Frequently asked questions
- What is CVE-2012-0021?
- CVE-2012-0021 is a vulnerability in Apache Http Server, classified under Improper Input Validation. Published 2012-01-28.
- Is CVE-2012-0021 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.