CVE-2014-0231 (Apache vulnerability in mod_cgid module could allow denial of service attacks)

• Posted September 9, 2014

• Assessed Risk Level: Low

The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read from its stdin file descriptor.

Upstream CVSS v2 Score: 2.6

Vector: AV:N/AC:H/Au:N/C:N/I:N/A:P/E:ND/RL:U/RC:C

Status:

Affected Software Versions (affects Puppet Enterprise on Debian-based platforms only):

• Puppet Enterprise 2.x and 3.x

Resolved in:

• Puppet Enterprise 2.8.8, 3.3.2