---

CVE-2018-17199 - log back

CVE-2018-17199 created at 25 Sep 2019 19:31:40
Severity	+ Medium
Remote	+ Remote
Type	+ Insufficient validation
Description	+ In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since the expiry time is loaded when the session is decoded.
References	+ https://httpd.apache.org/security/vulnerabilities_24.html#2.4.38
Notes