Segmentation Fault Vulnerability in Apache2: CVE-2017-7668
Summary
ALPINE-CVE-2017-7668: The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. Affects apache2 versions < 2.4.26-r0. Fixed in 2.4.26-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache HTTP Server, commonly referred to as Apache, is a widely used open-source web server software that enables the hosting of websites and web applications. It is known for its flexibility, robust feature set, and strong community support. However, it has been identified that certain versions of Apache2 are vulnerable to a critical issue that can lead to segmentation faults when specific request headers are crafted maliciously.
Vulnerability Detail
The vulnerability, identified as CVE-2017-7668, originates from changes made to HTTP strict parsing in Apache versions 2.2.32 and 2.4.24. This bug in token list parsing allows the function ap_find_token() to search beyond the end of its input string. An attacker can exploit this flaw by crafting a sequence of request headers that may cause a segmentation fault or return an incorrect value, potentially leading to denial of service or other unexpected behaviors.
How To Fix
Minimum fixed version
2.4.26-r0
This is the first release that contains the fix.
sudo apk add --upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the types of request headers accepted by your server or implement additional validation on incoming requests to mitigate the risk of exploitation until the package can be updated.
Conclusion
CVE-2017-7668 represents a significant vulnerability in Apache HTTP Server that can lead to severe operational issues if not addressed. It is crucial for users of affected versions to update to the patched version 2.4.26-r0 to ensure the security and stability of their web applications.
See every vulnerability recorded for apache2 →
FAQ
CVE-2017-7668 is a vulnerability in Apache HTTP Server that can lead to segmentation faults due to improper parsing of request headers.
All versions of Apache2 prior to 2.4.26-r0 are affected by this vulnerability.
Exploitation of this vulnerability can lead to denial of service, causing the server to crash or behave unexpectedly.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2017-7668 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
