Apache HTTP Server 2.4.x Vulnerability: NULL Pointer Dereference in mod_http2
Summary
ALPINE-CVE-2017-7659: A maliciously constructed HTTP/2 request could cause mod_http2 in Apache HTTP Server 2.4.24, 2.4.25 to dereference a NULL pointer and crash the server process. Affects apache2 versions < 2.4.26-r0. Fixed in 2.4.26-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache HTTP Server, commonly referred to as Apache, is one of the most widely used web server software. It provides a robust, secure, and extensible platform for hosting websites and applications. The mod_http2 module enables HTTP/2 support, which enhances performance and user experience. However, certain versions of Apache HTTP Server (2.4.24 and 2.4.25) are vulnerable to a critical issue that can lead to server crashes, impacting availability and reliability.
Vulnerability Detail
A maliciously constructed HTTP/2 request could cause mod_http2 in Apache HTTP Server versions 2.4.24 and 2.4.25 to dereference a NULL pointer, resulting in a crash of the server process. This vulnerability, identified as CVE-2017-7659, poses a significant risk as it can be exploited by attackers to disrupt service, leading to potential downtime and loss of availability for hosted applications.
How To Fix
Minimum fixed version
2.4.26-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider disabling the mod_http2 module temporarily to mitigate the risk. This can be done by commenting out the LoadModule directive for mod_http2 in your Apache configuration file.
Conclusion
The vulnerability identified as CVE-2017-7659 in Apache HTTP Server poses a significant risk due to its potential to crash the server through malicious HTTP/2 requests. It is crucial to update to the patched version (2.4.26-r0) to ensure the security and availability of your web services. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for apache2 →
FAQ
CVE-2017-7659 is a vulnerability in Apache HTTP Server that allows a specially crafted HTTP/2 request to crash the server due to a NULL pointer dereference.
The affected versions are Apache HTTP Server 2.4.24 and 2.4.25.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
If you cannot update immediately, consider disabling the mod_http2 module as a temporary workaround to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
