Apache httpd HTTP Strict Parsing Changes Token List Parsing Vulnerability (CVE-2017-7668)
Summary
CVE-2017-7668: The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. Affects apache2 versions < 2.4.26-r0. Fixed in 2.4.26-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache httpd is a popular open-source web server software that is widely used to serve web content. It provides a robust and flexible platform for hosting websites and applications. However, a vulnerability has been discovered in versions 2.2.32 and 2.4.24 of Apache httpd, which affects the token list parsing functionality. This vulnerability can be exploited by an attacker to cause a segmentation fault or manipulate the behavior of the ap_find_token() function.
Vulnerability Detail
The HTTP strict parsing changes introduced in Apache httpd 2.2.32 and 2.4.24 included a bug in the token list parsing mechanism. This bug allows the ap_find_token() function to search beyond the end of the input string, leading to potential memory corruption or incorrect return values. By crafting a sequence of malicious request headers, an attacker can trigger this vulnerability and potentially disrupt the server or manipulate its behavior.
How To Fix
Minimum fixed version
2.4.26-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to a patched version of Apache httpd.
Conclusion
The Apache httpd HTTP Strict Parsing Changes Token List Parsing Vulnerability (CVE-2017-7668) affects versions 2.2.32 and 2.4.24 of Apache httpd. It is crucial for users to upgrade to version 2.4.26-r0 or later to mitigate the vulnerability. No known workarounds exist, and it is recommended to follow the provided fix to ensure the security of the web server. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache2 →
FAQ
Apache httpd is an open-source web server software widely used for hosting websites and applications.
Versions 2.2.32 and 2.4.24 of Apache httpd are affected by this vulnerability.
This vulnerability can potentially cause a segmentation fault or allow an attacker to manipulate the behavior of the ap_find_token() function.
To fix this vulnerability, it is recommended to upgrade to version 2.4.26-r0 or later of the Apache httpd package.
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to a patched version of Apache httpd.
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
