UpHeron
All vulnerabilities

Servers and applications

CVE-2018-1312

In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent reply attacks was not correctly generated using a pseudo-random seed. In a cluster of servers using a common Digest authentication configuration, HTTP requests could be replayed across servers by an attacker without detection.

Severity
Critical 9.8
Published
26 Mar 2018
Last changed
17 Jun 2026
Added to UpHeron
17 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
Apache HTTP ServerServers and applications · cpe:a:apache:http_server
  • Version 2.4.29
  • Version 2.4.28
  • Version 2.4.27
  • Version 2.4.26
All 19 release lines
  • Version 2.4.1
  • Version 2.4.2
  • Version 2.4.3
  • Version 2.4.4
  • Version 2.4.6
  • Version 2.4.7
  • Version 2.4.9
  • Version 2.4.10
  • Version 2.4.12
  • Version 2.4.16
  • Version 2.4.17
  • Version 2.4.18
  • Version 2.4.20
  • Version 2.4.23
  • Version 2.4.25
  • Version 2.4.26
  • Version 2.4.27
  • Version 2.4.28
  • Version 2.4.29

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2018-1312
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2018-1312