p PatchFirst

CVE-2017-9798

CVE-2017-9798

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.

CVSS 7.5 · High · EPSS 95.0% · Public exploit · Fix available

Published
Updated

Stack: system · web

Affected products and versions

  • apache httpd

    Versions
    • Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27: Affected

    No fix published

  • apache2 Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.4.27-6

    Update to 2.4.27-6

  • apache2 Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.4.27-6

    Update to 2.4.27-6

  • apache2 Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.4.27-6

    Update to 2.4.27-6

  • apache2 Ubuntu:14.04:LTS

    Versions
    • 2.4.6-2ubuntu2
    • 2.4.6-2ubuntu3
    • 2.4.6-2ubuntu4
    • 2.4.7-1ubuntu1
    • 2.4.7-1ubuntu2
    • 2.4.7-1ubuntu3
    • 2.4.7-1ubuntu4
    • 2.4.7-1ubuntu4.1
    • 2.4.7-1ubuntu4.4
    • 2.4.7-1ubuntu4.5
    • 2.4.7-1ubuntu4.6
    • 2.4.7-1ubuntu4.7
    • 2.4.7-1ubuntu4.8
    • 2.4.7-1ubuntu4.9
    • 2.4.7-1ubuntu4.10
    • 2.4.7-1ubuntu4.11
    • 2.4.7-1ubuntu4.13
    • 2.4.7-1ubuntu4.15
    • 2.4.7-1ubuntu4.16
    • 2.4.7-1ubuntu4.17
    Affected ranges
    • ECOSYSTEM: < 2.4.7-1ubuntu4.18

    Update to 2.4.7-1ubuntu4.18

  • apache2 Ubuntu:16.04:LTS

    Versions
    • 2.4.12-2ubuntu2
    • 2.4.17-1ubuntu1
    • 2.4.17-2ubuntu1
    • 2.4.17-3ubuntu1
    • 2.4.18-1ubuntu1
    • 2.4.18-2ubuntu1
    • 2.4.18-2ubuntu2
    • 2.4.18-2ubuntu3
    • 2.4.18-2ubuntu3.1
    • 2.4.18-2ubuntu3.2
    • 2.4.18-2ubuntu3.3
    • 2.4.18-2ubuntu3.4
    Affected ranges
    • ECOSYSTEM: < 2.4.18-2ubuntu3.5

    Update to 2.4.18-2ubuntu3.5

Original sources

Check your server →