PT-2017-19188 · Apache+2 · Apache Httpd+3

Published 2017-07-11 · Updated 2021-06-06 · CVE-2017-9789

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache httpd version 2.4.26

Description The HTTP/2 handling code in Apache httpd sometimes accesses memory after it has been freed when under stress and closing many connections, resulting in potentially erratic behaviour.

Recommendations For Apache httpd version 2.4.26, consider updating to a newer version to mitigate the risk of erratic behaviour due to memory access issues. As a temporary workaround, consider restricting the number of concurrent connections to minimize the risk of exploitation.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2017-1930

CVE-2017-9789

MGASA-2017-0298

SUSE-SU-2018:0261-1

Affected Products

Alt Linux

Apache Http Server

Apache Httpd

Suse

References · 47

• https://osv.dev/vulnerability/CVE-2017-9789 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9788 · Security Note
• https://errata.altlinux.org/ALT-PU-2017-1930 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2017-9789 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-9789 · Security Note
• https://httpd.apache.org/security/vulnerabilities_24.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9789 · Security Note
• https://bdu.fstec.ru/vul/2018-00102 · Security Note
• https://security.gentoo.org/glsa/201710-32 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0298 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0298.html · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2018:0261-1 · Vendor Advisory
• https://bugzilla.suse.com/1045160 · Note
• http://apache.org/dist/httpd/Announcement2.4.html · Note
• https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E · Note