NULL pointer dereference in GoAhead and Appweb - CVE-2018-15504

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the server mishandles some HTTP request fields associated with time, which results in a NULL pointer dereference, as demonstrated by If-Modified-Since or If-Unmodified-Since with a month greater than 11. A remote attacker can perform a denial of service (DoS) attack.

Affected software

How to mitigate CVE-2018-15504

External References

• https://github.com/embedthis/appweb/commit/66067ae6d1fa08b37a270e7dc1821df52ed2daef
• https://github.com/embedthis/appweb/issues/605
• https://github.com/embedthis/goahead/issues/264

Related Security Bulletins

• NULL pointer dereference in EmbedThis GoAhead