CVE-2018-11763 in Retail Xstore Point of Service

Summary

In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Reservation

06/05/2018

Status

Confirmed

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
133729	Oracle Retail Xstore Point of Service Xstore Office denial of service	404	Not defined	Official fix	CVE-2018-11763
133728	Oracle Retail Xstore Point of Service Apache HTTP Server denial of service	404	Not defined	Official fix	CVE-2018-11763
133643	Oracle Hospitality Guest Access Apache HTTP Server denial of service	404	Not defined	Official fix	CVE-2018-11763
133563	Oracle Enterprise Manager Ops Center Networking denial of service	404	Not defined	Official fix	CVE-2018-11763
133520	Oracle Instantis EnterpriseTrack Apache HTTP Server denial of service	404	Not defined	Official fix	CVE-2018-11763
129717	Oracle Secure Global Desktop Apache HTTP Server input validation	20	Not defined	Official fix	CVE-2018-11763
124447	Apache HTTP Server SETTINGS Frame input validation	20	Not defined	Official fix	CVE-2018-11763

Sources

• MITRE
• NVD
• CVE Details