Apache2 - Security Update
Summary
DLA-1009-1: apache2 - security update. Affects apache2 versions < 2.2.22-13+deb7u9. Fixed in 2.2.22-13+deb7u9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache2 is a widely used open-source web server software. It provides a robust and scalable platform for hosting websites and applications. The Apache HTTPD server is a component of Apache2. It handles incoming HTTP requests and serves the requested content. However, several vulnerabilities have been discovered in the Apache HTTPD server, which could potentially compromise the security and stability of the server.
Vulnerability Detail
The Apache HTTPD server is affected by multiple vulnerabilities:
-
CVE-2017-3167: This vulnerability allows third-party modules to bypass authentication requirements by misusing the ap_get_basic_auth_pw() function.
-
CVE-2017-3169: A NULL pointer dereference issue in mod_ssl can be triggered by third-party modules calling ap_hook_process_connection() during an HTTP request to an HTTPS port, leading to a denial of service.
-
CVE-2017-7668: The HTTP strict parsing feature contains a flaw in ap_find_token() that can be exploited by a remote attacker to cause a segmentation fault or obtain incorrect values.
-
CVE-2017-7679: A buffer overread vulnerability in mod_mime allows an attacker to read one byte past the end of a buffer when sending a malicious Content-Type response header.
How To Fix
Minimum fixed version
2.2.22-13+deb7u9
This is the first release that contains the fix.
sudo apt-get install --only-upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is essential to apply the security update as soon as possible to mitigate the risks.
Conclusion
It is crucial to promptly update the apache2 package to address these vulnerabilities. Failure to do so may result in unauthorized access, denial of service, or information disclosure. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache2 →
FAQ
CVE-2017-3167 allows third-party modules to bypass authentication requirements, potentially granting unauthorized access to protected resources.
CVE-2017-3169 can be exploited by triggering a NULL pointer dereference in mod_ssl, leading to a denial of service.
CVE-2017-7668 can be exploited by a remote attacker to cause a segmentation fault or obtain incorrect values, potentially leading to server instability or information disclosure.
CVE-2017-7679 allows an attacker to read one byte past the end of a buffer in mod_mime, potentially leading to information disclosure or server instability.
Yes, upgrading the apache2 package to version 2.2.22-13+deb7u9 or later will fix these vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
