PT-2017-3337
CVE-2017-9788
·
تاريخ النشر
2017-07-11
·
تاريخ التحديث
2021-06-06
الوصف من
CVSS 3.1
9.1
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Name of the Vulnerable Software and Affected Versions
Apache httpd versions 2.2.x through 2.2.33
Apache httpd versions 2.4.x through 2.4.26
Description
The issue is related to the mod auth digest module in Apache HTTP Server, where the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not properly initialized or reset. This could lead to the leakage of potentially confidential information and cause a denial of service due to a segfault. The problem occurs when an initial key with no '=' assignment is provided, reflecting the stale value of uninitialized pool memory used by the prior request.
Recommendations
For Apache httpd versions 2.2.x through 2.2.33, update to version 2.2.34 or later.
For Apache httpd versions 2.4.x through 2.4.26, update to version 2.4.27 or later.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾