The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
Configuration 6 (hide)
|
History
07 Nov 2023, 02:50
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
21 Apr 2022, 14:40
Type | Values Removed | Values Added |
---|---|---|
First Time |
Debian debian Linux
Redhat enterprise Linux Desktop Redhat enterprise Linux Server Apple Oracle Oracle secure Global Desktop Redhat enterprise Linux Eus Redhat enterprise Linux Server Tus Netapp Redhat enterprise Linux Server Aus Netapp clustered Data Ontap Netapp storagegrid Debian Redhat enterprise Linux Workstation Netapp oncommand Unified Manager Apple mac Os X Redhat |
|
CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 7.5 |
References | (MLIST) https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e@%3Ccvs.httpd.apache.org%3E - Mailing List, Vendor Advisory | |
References | (MLIST) https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be@%3Ccvs.httpd.apache.org%3E - Mailing List, Vendor Advisory | |
References | (MLIST) https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E - Mailing List, Vendor Advisory | |
References | (MLIST) https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E - Mailing List, Vendor Advisory | |
References | (CONFIRM) https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us - Third Party Advisory | |
References | (CONFIRM) https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03821en_us - Third Party Advisory | |
References | (REDHAT) https://access.redhat.com/errata/RHSA-2017:2483 - Third Party Advisory | |
References | (MLIST) https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770@%3Ccvs.httpd.apache.org%3E - Mailing List, Vendor Advisory | |
References | (CONFIRM) https://www.tenable.com/security/tns-2019-09 - Third Party Advisory | |
References | (MLIST) https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E - Mailing List, Vendor Advisory | |
References | (CONFIRM) https://security.netapp.com/advisory/ntap-20180601-0002/ - Third Party Advisory | |
References | (MLIST) https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E - Mailing List, Vendor Advisory | |
References | (REDHAT) https://access.redhat.com/errata/RHSA-2017:2479 - Third Party Advisory | |
References | (MLIST) https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E - Mailing List, Vendor Advisory | |
References | (MLIST) https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c@%3Ccvs.httpd.apache.org%3E - Mailing List, Vendor Advisory | |
References | (GENTOO) https://security.gentoo.org/glsa/201710-32 - Third Party Advisory | |
References | (MLIST) https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E - Mailing List, Vendor Advisory | |
References | (MLIST) https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E - Mailing List, Vendor Advisory | |
References | (REDHAT) https://access.redhat.com/errata/RHSA-2017:3193 - Third Party Advisory | |
References | (DEBIAN) http://www.debian.org/security/2017/dsa-3896 - Third Party Advisory | |
References | (MLIST) https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E - Mailing List, Vendor Advisory | |
References | (CONFIRM) http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html - Patch, Third Party Advisory | |
References | (MLIST) https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24@%3Ccvs.httpd.apache.org%3E - Mailing List, Vendor Advisory | |
References | (MLIST) https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f@%3Ccvs.httpd.apache.org%3E - Mailing List, Vendor Advisory | |
References | (MLIST) https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E - Mailing List, Vendor Advisory | |
References | (MLIST) https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a@%3Ccvs.httpd.apache.org%3E - Mailing List, Vendor Advisory | |
References | (CONFIRM) https://support.apple.com/HT208221 - Third Party Advisory | |
References | (MLIST) https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234@%3Ccvs.httpd.apache.org%3E - Mailing List, Vendor Advisory | |
References | (MLIST) https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830@%3Ccvs.httpd.apache.org%3E - Mailing List, Vendor Advisory | |
References | (REDHAT) https://access.redhat.com/errata/RHSA-2017:3194 - Third Party Advisory | |
References | (MLIST) https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E - Mailing List, Vendor Advisory | |
References | (MLIST) https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E - Mailing List, Vendor Advisory | |
CWE | CWE-125 | |
CPE | cpe:2.3:a:apache:http_server:2.2.11:*:*:*:*:*:*:* cpe:2.3:a:apache:http_server:2.4.17:*:*:*:*:*:*:* cpe:2.3:a:apache:http_server:2.2.2:*:*:*:*:*:*:* cpe:2.3:a:apache:http_server:2.2.27:*:*:*:*:*:*:* cpe:2.3:a:apache:http_server:2.2.0:*:*:*:*:*:*:* cpe:2.3:a:apache:http_server:2.2.18:*:*:*:*:*:*:* cpe:2.3:a:apache:http_server:2.4.18:*:*:*:*:*:*:* cpe:2.3:a:apache:http_server:2.2.12:*:*:*:*:*:*:* cpe:2.3:a:apache:http_server:2.2.22:*:*:*:*:*:*:* cpe:2.3:a:apache:http_server:2.2.30:*:*:*:*:*:*:* cpe:2.3:a:apache:http_server:2.2.20:*:*:*:*:*:*:* cpe:2.3:a:apache:http_server:2.4.23:*:*:*:*:*:*:* cpe:2.3:a:apache:http_server:2.4.1:*:*:*:*:*:*:* cpe:2.3:a:apache:http_server:2.2.25:*:*:*:*:*:*:* cpe:2.3:a:apache:http_server:2.4.12:*:*:*:*:*:*:* cpe:2.3:a:apache:http_server:2.2.15:*:*:*:*:*:*:* cpe:2.3:a:apache:http_server:2.4.16:*:*:*:*:*:*:* cpe:2.3:a:apache:http_server:2.2.3:*:*:*:*:*:*:* cpe:2.3:a:apache:http_server:2.4.10:*:*:*:*:*:*:* cpe:2.3:a:apache:http_server:2.2.19:*:*:*:*:*:*:* cpe:2.3:a:apache:http_server:2.2.21:*:*:*:*:*:*:* cpe:2.3:a:apache:http_server:2.2.24:*:*:*:*:*:*:* cpe:2.3:a:apache:http_server:2.2.23:*:*:*:*:*:*:* cpe:2.3:a:apache:http_server:2.2.13:*:*:*:*:*:*:* cpe:2.3:a:apache:http_server:2.2.14:*:*:*:*:*:*:* cpe:2.3:a:apache:http_server:2.2.17:*:*:*:*:*:*:* cpe:2.3:a:apache:http_server:2.2.31:*:*:*:*:*:*:* cpe:2.3:a:apache:http_server:2.4.20:*:*:*:*:*:*:* cpe:2.3:a:apache:http_server:2.2.16:*:*:*:*:*:*:* cpe:2.3:a:apache:http_server:2.4.2:*:*:*:*:*:*:* cpe:2.3:a:apache:http_server:2.2.29:*:*:*:*:*:*:* |
cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:*:*:*:*:*:*:* cpe:2.3:a:netapp:oncommand_unified_manager:-:*:*:*:*:7-mode:*:* cpe:2.3:o:apple:mac_os_x:10.11.6:security_update_2017-003:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:* cpe:2.3:o:apple:mac_os_x:10.11.6:security_update_2016-002:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* cpe:2.3:o:apple:mac_os_x:10.11.6:security_update_2016-003:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:* cpe:2.3:o:apple:mac_os_x:10.11.6:security_update_2017-001:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* cpe:2.3:o:apple:mac_os_x:10.12.6:-:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:* cpe:2.3:a:apache:http_server:2.4.24:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:* cpe:2.3:o:apple:mac_os_x:10.11.6:security_update_2017-002:*:*:*:*:*:* cpe:2.3:o:apple:mac_os_x:10.11.6:security_update_2016-001:*:*:*:*:*:* cpe:2.3:a:oracle:secure_global_desktop:5.3:*:*:*:*:*:*:* cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:* cpe:2.3:o:apple:mac_os_x:10.11.6:-:*:*:*:*:*:* cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:7.2:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:* |
06 Jun 2021, 11:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
03 Jun 2021, 08:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
30 Mar 2021, 13:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
Information
Published : 2017-06-20 01:29
Updated : 2023-12-10 12:15
NVD link : CVE-2017-7668
Mitre link : CVE-2017-7668
CVE.ORG link : CVE-2017-7668
JSON object : View
Products Affected
redhat
- enterprise_linux_server
- enterprise_linux_eus
- enterprise_linux_desktop
- enterprise_linux_server_tus
- enterprise_linux_workstation
- enterprise_linux_server_aus
netapp
- storagegrid
- clustered_data_ontap
- oncommand_unified_manager
apple
- mac_os_x
debian
- debian_linux
oracle
- secure_global_desktop
apache
- http_server