CVE-2018-17189

Name	CVE-2018-17189
Description	In Apache HTTP server versions 2.4.37 and prior, by sending request bodies in a slow loris way to plain resources, the h2 stream for that request unnecessarily occupied a server thread cleaning up that incoming data. This affects only HTTP/2 (mod_http2) connections.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-4422-1
Debian Bugs	920302

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
apache2 (PTS)	jessie, jessie (lts)	2.4.10-10+deb8u29	fixed
	stretch (security)	2.4.25-3+deb9u13	fixed
	stretch (lts), stretch	2.4.25-3+deb9u19	fixed
	buster, buster (lts)	2.4.59-1~deb10u4	fixed
	buster (security)	2.4.59-1~deb10u1	fixed
	bullseye	2.4.62-1~deb11u1	fixed
	bullseye (security)	2.4.62-1~deb11u2	fixed
	bookworm (security), bookworm	2.4.62-1~deb12u2	fixed
	sid, trixie	2.4.62-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
apache2	source	wheezy	(not affected)
apache2	source	jessie	(not affected)
apache2	source	stretch	2.4.25-3+deb9u7		DSA-4422-1
apache2	source	(unstable)	2.4.38-1	low		920302

Notes

[jessie] - apache2 <not-affected> (Vulnerable code not present)
HTTP/2 support introduced in 2.4.17
https://www.openwall.com/lists/oss-security/2019/01/22/2
https://svn.apache.org/r1851329
[wheezy] - apache2 <not-affected> (Vulnerable code not present, HTTP/2 support introduced in 2.4.17)