{"id":"CVE-2003-1418","aliases":["EUVD-2003-1408","GHSA-w76w-v64m-qrv5","SUSE-SU-2015:0689-1"],"status":"published","title":"Apache HTTP Server 1.3.22 through 1.3.27 on OpenBSD allows remote attackers to obtain sensitive...","description":"Apache HTTP Server 1.3.22 through 1.3.27 on OpenBSD allows remote attackers to obtain sensitive information via (1) the ETag header, which reveals the inode number, or (2) multipart MIME boundary, which reveals child process IDs (PID).","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.06859,"percentile":0.94089,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2003-12-31T05:00:00Z","modified":"2026-06-16T22:04:24Z","products":[{"vendor":"apache","product":"http_server"}],"references":[{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.openbsd.org/errata32.html","tags":["vendor-advisory","x_refsource_OPENBSD","x_transferred"]},{"url":"http://www.securityfocus.com/bid/6939","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.securityfocus.com/bid/6943","tags":["vdb-entry","x_refsource_BID","x_transferred","Patch"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/11438","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2003-1418"},{"url":"https://github.com/advisories/GHSA-w76w-v64m-qrv5"},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150689-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/713970","tags":["report"]},{"url":"https://bugzilla.suse.com/791794","tags":["report"]},{"url":"https://bugzilla.suse.com/815621","tags":["report"]},{"url":"https://bugzilla.suse.com/829056","tags":["report"]},{"url":"https://bugzilla.suse.com/829057","tags":["report"]},{"url":"https://bugzilla.suse.com/844212","tags":["report"]},{"url":"https://bugzilla.suse.com/852401","tags":["report"]},{"url":"https://bugzilla.suse.com/859916","tags":["report"]},{"url":"https://bugzilla.suse.com/869105","tags":["report"]},{"url":"https://bugzilla.suse.com/869106","tags":["report"]},{"url":"https://bugzilla.suse.com/871310","tags":["report"]},{"url":"https://bugzilla.suse.com/887765","tags":["report"]},{"url":"https://bugzilla.suse.com/887768","tags":["report"]},{"url":"https://bugzilla.suse.com/894225","tags":["report"]},{"url":"https://bugzilla.suse.com/899836","tags":["report"]},{"url":"https://bugzilla.suse.com/904427","tags":["report"]},{"url":"https://bugzilla.suse.com/907339","tags":["report"]},{"url":"https://bugzilla.suse.com/907477","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2003-1418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0226","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3581","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2003-1418","description":"Apache HTTP Server 1.3.22 through 1.3.27 on OpenBSD allows remote attackers to obtain sensitive information via (1) the ETag header, which reveals the inode number, or (2) multipart MIME boundary, which reveals child process IDs (PID).","status":"published","published":"2007-10-20T10:00:00Z","modified":"2024-08-08T02:28:03.601Z","updated_at":"2026-11-02T14:20:16.072351Z"}],"euvd":[{"id":"EUVD-2003-1408","description":"Apache HTTP Server 1.3.22 through 1.3.27 on OpenBSD allows remote attackers to obtain sensitive information via (1) the ETag header, which reveals the inode number, or (2) multipart MIME boundary, which reveals child process IDs (PID).","status":"published","published":"2007-10-20T10:00:00Z","modified":"2024-08-08T02:28:03Z","updated_at":"2026-11-03T01:15:03.384433Z"}],"ghsa":[{"id":"GHSA-w76w-v64m-qrv5","title":"Apache HTTP Server 1.3.22 through 1.3.27 on OpenBSD allows remote attackers to obtain sensitive...","description":"Apache HTTP Server 1.3.22 through 1.3.27 on OpenBSD allows remote attackers to obtain sensitive information via (1) the ETag header, which reveals the inode number, or (2) multipart MIME boundary, which reveals child process IDs (PID).","status":"published","published":"2022-04-29T01:28:02Z","modified":"2023-01-30T05:02:19Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:46:36.658869Z"}],"nvd":[{"id":"CVE-2003-1418","description":"Apache HTTP Server 1.3.22 through 1.3.27 on OpenBSD allows remote attackers to obtain sensitive information via (1) the ETag header, which reveals the inode number, or (2) multipart MIME boundary, which reveals child process IDs (PID).","status":"published","published":"2003-12-31T05:00:00Z","modified":"2026-06-16T22:04:24.07Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:00:48.212104Z"}],"osv":[{"id":"SUSE-SU-2015:0689-1","title":"Recommended update for apache2","description":"\nThis update for the Apache Web Server introduces directives to control two \nprotocol options:\n\n    * HttpContentLengthHeadZero: Allow responses to HEAD request with\n      Content-Length of 0\n    * HttpExpectStrict: Allow the administrator to control whether clients\n      must send '100-continue'\n\nMODULE_MAGIC_NUMBER_MINOR has been increased to 24, as this change is not \nforward-compatible. Modules built against this release might not work \ncorrectly with older releases of the Apache Web Server.\n\n","status":"published","published":"2014-09-11T22:20:05Z","modified":"2026-02-04T02:34:16.49726Z","updated_at":"2026-11-02T15:53:41.276824Z"}]}}