CVE-2017-9788

Name of the Vulnerable Software and Affected Versions Apache httpd versions 2.2.x through 2.2.33 Apache httpd versions 2.4.x through 2.4.26

Description The issue is related to the mod auth digest module in Apache HTTP Server, where the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not properly initialized or reset. This could lead to the leakage of potentially confidential information and cause a denial of service due to a segfault. The problem occurs when an initial key with no '=' assignment is provided, reflecting the stale value of uninitialized pool memory used by the prior request.

Recommendations For Apache httpd versions 2.2.x through 2.2.33, update to version 2.2.34 or later. For Apache httpd versions 2.4.x through 2.4.26, update to version 2.4.27 or later.