Total vulnerabilities in the database
In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol.
| Software | From | Fixed in |
|---|---|---|
| apache / http_server | 2.4.17 | 2.4.34.x |
| canonical / ubuntu_linux | 18.04 | 18.04.x |
| redhat / enterprise_linux | 7.4 | 7.4.x |
| redhat / enterprise_linux | 7.0 | 7.0.x |
| redhat / enterprise_linux | 6.0 | 6.0.x |
| redhat / enterprise_linux | 7.5 | 7.5.x |
| redhat / enterprise_linux | 7.6 | 7.6.x |
| oracle / retail_xstore_point_of_service | 7.1 | 7.1.x |
| oracle / retail_xstore_point_of_service | 7.0 | 7.0.x |
| oracle / hospitality_guest_access | 4.2.0 | 4.2.0.x |
| oracle / hospitality_guest_access | 4.2.1 | 4.2.1.x |
| oracle / enterprise_manager_ops_center | 12.3.3 | 12.3.3.x |
| oracle / secure_global_desktop | 5.4 | 5.4.x |
| oracle / instantis_enterprisetrack | 17.1 | 17.1.x |
| oracle / instantis_enterprisetrack | 17.2 | 17.2.x |
| oracle / instantis_enterprisetrack | 17.3 | 17.3.x |