Apache httpd mod_ssl NULL Pointer Dereference Vulnerability (CVE-2017-3169)
Summary
CVE-2017-3169: In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port. Affects apache2 across 35 version ranges.
< 1c7da70e72d96fa72244bd032d89769c1399b5f7
< 2.4.26-r0
< 2d1deb10cfafe25ade7f30307e13b6d0c21a5473
< 6e65a7f3dadcade4274ae53f734d4c35188e3786
< 7b5870f6ce45d2a1baef173e8a634e6044434943
< 9b121e157581e2e40983cdf89727e8f424544f99
< 015ab81d44c1f6def12fdbb7dc8d8241bf8e3ef5
< 34ea1cee78449ff1081267cd2348a01099b04ac9
< 47a9d8e8abf5697b4580c3ee2ade302b5c058fa6
< 60fa04727910859b5512f7bbb36c53c4652cff2c
< 79f35160c372de1e867542e1705962fb0880a647
< 82b0da5c50d9e1c226b1eaa2e7780921be1386b3
< 647bc6a13a11ae7772391170fd176ad8b8846b87
< 777e5a254758046a13ebeaf09fa4af6467bf8910
< 803b3cbae02b4f7562bbcdf5f9d7fd82f4cf48cf
< 954dfbe8a95dac3b93e12761f65754104f1696ea
< 1287b680fbde78d9289029b6a6b63a3f9e58d704
< 3614ebd12db5e555ac7f2975afa530116d204335
< 67578c0315accbca1bba22d695c59d51197c99cc
< 87777f4289970214d3fcf2885dbf01188371b738
< 810842a1dc70b67ac82fd53e09250b8bb7dbe27d
< 926546a5bb798796aec1135994c6c242529e1d94
< 43559342e30402bbca6ca84ab88a533f118bf444
< 79399902e001e6edac9a0314f2e2e6dc580640a0
< 886787685c97f9c392adca5ac29d3e8bd3aef7c5
< a5fd1e3e9921e87e9c5526198e8bdc8db6b75061
< b7ef32c4957883ab17105fa82e6331bf48bed78a
< c684028456799362df0aa6adac45f3d0d5e4e3be
< cad4926fd376fd483859ab4b1871b3e9473cae01
< cd3e5a83cd5765d12b3237631c829eaff80f8425
< cef6805cb18886c5454a38f3501c5e3c990c0b3d
< ea2107f62fec7368c0d07294626d92921cffa794
< ef07cb031c6f8f7ac483c26fc858aad68c365fd9
< f54aa3b08da564fb8e1664f770ce2c083b8a0c69
< f6204293872d3345bea724149b9d9cc3878e61be
Fixed in 2.4.26-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache httpd is a widely used open-source web server software. It provides a secure and efficient platform for hosting websites and applications. The mod_ssl module in Apache httpd enables secure communication over HTTPS. However, a vulnerability in mod_ssl can lead to a NULL pointer dereference, potentially causing a denial-of-service (DoS) condition or arbitrary code execution.
Vulnerability Detail
The vulnerability (CVE-2017-3169) exists in Apache httpd versions 2.2.x before 2.2.33 and 2.4.x before 2.4.26. When third-party modules call the ap_hook_process_connection() function during an HTTP request to an HTTPS port, mod_ssl may dereference a NULL pointer. This can occur due to improper handling of the connection process, leading to a crash or potential execution of arbitrary code by an attacker.
How To Fix
Minimum fixed version
2.4.26-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official patch or upgrade to a fixed version of Apache httpd.
Conclusion
The Apache httpd mod_ssl NULL Pointer Dereference Vulnerability (CVE-2017-3169) poses a significant risk to systems running affected versions of Apache httpd. It is crucial to promptly upgrade to a fixed version or apply the official patch to mitigate the vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache2 →
FAQ
Apache httpd is an open-source web server software widely used for hosting websites and applications.
mod_ssl is an Apache httpd module that enables secure communication over HTTPS.
A NULL pointer dereference occurs when a program attempts to access or dereference a memory address that has a NULL (empty) value. This can lead to crashes or potential code execution vulnerabilities.
The vulnerability can result in a denial-of-service (DoS) condition or arbitrary code execution, depending on how it is exploited.
To protect your system, it is crucial to upgrade Apache httpd to version 2.4.26 or later, which includes a fix for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
