PT-2017-19188 · Apache+2 · Apache Httpd+3

Publicado 2017-07-11 · Atualizado 2021-06-06 · CVE-2017-9789

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache httpd version 2.4.26

Description The HTTP/2 handling code in Apache httpd sometimes accesses memory after it has been freed when under stress and closing many connections, resulting in potentially erratic behaviour.

Recommendations For Apache httpd version 2.4.26, consider updating to a newer version to mitigate the risk of erratic behaviour due to memory access issues. As a temporary workaround, consider restricting the number of concurrent connections to minimize the risk of exploitation.

Correção

Use After Free

Enumeração de Fraquezas

CWE-416

Identificadores relacionados

ALT-PU-2017-1930

CVE-2017-9789

MGASA-2017-0298

SUSE-SU-2018:0261-1

Produtos afetados

Alt Linux

Apache Http Server

Apache Httpd

Suse

Referências · 47

• https://bugzilla.suse.com/1045160 · Nota
• http://apache.org/dist/httpd/Announcement2.4.html · Nota
• https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E · Nota
• https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E · Nota
• https://suse.com/security/cve/CVE-2017-7659 · Nota
• https://osv.dev/vulnerability/CVE-2017-9789 · Aviso do Fabricante
• https://bugzilla.suse.com/1048575 · Nota
• https://bugzilla.suse.com/1057406 · Nota
• https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9788 · Nota de Segurança
• https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E · Nota
• https://bugzilla.suse.com/1042037 · Nota
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us · Nota
• https://errata.altlinux.org/ALT-PU-2017-1930 · Aviso do Fabricante
• https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E · Nota