PT-2017-3337 · Apache+5 · Apache Http Server+5
Publicado
2017-07-11
·
Atualizado
2021-06-06
·
CVE-2017-9788
CVSS v3.1
9.1
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Apache httpd versions 2.2.x through 2.2.33
Apache httpd versions 2.4.x through 2.4.26
Description
The issue is related to the mod auth digest module in Apache HTTP Server, where the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not properly initialized or reset. This could lead to the leakage of potentially confidential information and cause a denial of service due to a segfault. The problem occurs when an initial key with no '=' assignment is provided, reflecting the stale value of uninitialized pool memory used by the prior request.
Recommendations
For Apache httpd versions 2.2.x through 2.2.33, update to version 2.2.34 or later.
For Apache httpd versions 2.4.x through 2.4.26, update to version 2.4.27 or later.
Correção
DoS
RCE
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Apache Http Server
Centos
Red Hat
Suse
Ubuntu