CVE-2017-7668
High
Description
The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Apache Http Server
PublishedJun 20, 2017
First seenJun 20, 2017
Weakness typeCWE-126CWE-126
How to fix
Update
- apple mac_os_x10.13.1, 10.11.6, 10.12.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache http_server | 2.2.32, 2.4.24, 2.4.25 | — |
| netapp clustered_data_ontap | No range specified | — |
| netapp oncommand_unified_manager | No range specified | — |
| netapp storagegrid | No range specified | — |
| redhat enterprise_linux_desktop | 7.0 | — |
| redhat enterprise_linux_eus | 7.2, 7.3, 7.4, 7.5, 7.6, 7.7 | — |
| redhat enterprise_linux_server | 7.0 | — |
| redhat enterprise_linux_server_aus | 7.2, 7.3, 7.4, 7.6, 7.7 | — |
| redhat enterprise_linux_server_tus | 7.2, 7.3, 7.4, 7.6, 7.7 | — |
| redhat enterprise_linux_workstation | 7.0 | — |
| debian debian_linux | 8.0, 9.0 | — |
| oracle secure_global_desktop | 5.3 | — |
| apple mac_os_x | v < 10.13.1, 10.11.0 ≤ v < 10.11.6, 10.12.0 ≤ v < 10.12.6, 10.11.6, 10.12.6 | 10.13.1, 10.11.6, 10.12.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.