Critical Vulnerability in Apache2: NULL Pointer Dereference in mod_ssl
Summary
ALPINE-CVE-2017-3169: In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port. Affects apache2 versions < 2.4.26-r0. Fixed in 2.4.26-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server, commonly referred to as Apache2, is a widely used open-source web server software that enables the hosting of websites and applications. It is known for its flexibility, security features, and extensive module support. However, certain versions of Apache2 are vulnerable to a critical issue in mod_ssl, which can lead to severe security implications if left unaddressed.
Vulnerability Detail
In Apache HTTP Server versions 2.2.x before 2.2.33 and 2.4.x before 2.4.26, a vulnerability exists in mod_ssl that may cause a NULL pointer dereference when third-party modules invoke the ap_hook_process_connection() function during an HTTP request to an HTTPS port. This flaw can lead to application crashes, denial of service, and potential exploitation by attackers, making it a critical security risk.
How To Fix
Minimum fixed version
2.4.26-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the use of third-party modules that interact with mod_ssl until the package is updated. This can help mitigate the risk of exploitation until a proper fix is applied.
Conclusion
The vulnerability in Apache2's mod_ssl presents a critical risk that can lead to severe consequences if not addressed. Updating to the patched version is crucial for maintaining the security and stability of your web applications.
See every vulnerability recorded for apache2 →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
Apache2 versions 2.2.x before 2.2.33 and 2.4.x before 2.4.26 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The vulnerability can lead to application crashes, denial of service, and exploitation by attackers, posing significant security risks.
Yes, temporarily disabling third-party modules that interact with mod_ssl can help mitigate the risk until the package is updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
