Apache2 - Authorization Digest Header Value Placeholder Initialization Vulnerability
Summary
DLA-1028-1: apache2 - security update. Affects apache2 versions < 2.2.22-13+deb7u10. Fixed in 2.2.22-13+deb7u10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache2 is a widely used open-source web server software. It provides a secure and efficient platform for hosting websites and applications. The mod_auth_digest module in Apache2 handles Digest authentication, which is a method for verifying the identity of clients accessing protected resources. This module allows users to authenticate using a username and password combination. However, a vulnerability has been discovered in the way Apache2 handles the value placeholder in [Proxy-]Authorization Digest headers. This vulnerability could lead to the leakage of potentially confidential information and even cause a segfault.
Vulnerability Detail
The vulnerability in Apache2's mod_auth_digest module arises from the uninitialized or reset state of the value placeholder in [Proxy-]Authorization Digest headers. When a key=value assignment is made, the value placeholder is not properly initialized or reset, which can result in the reflection of stale values from uninitialized pool memory used by previous requests. This can lead to the disclosure of sensitive information and potentially cause a segfault, resulting in a denial of service. An attacker could exploit this vulnerability to gain unauthorized access or disrupt the functioning of the web server.
How To Fix
Minimum fixed version
2.2.22-13+deb7u10
This is the first release that contains the fix.
sudo apt-get install --only-upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading the Apache2 package to the patched version.
Conclusion
The Apache2 - Authorization Digest Header Value Placeholder Initialization Vulnerability in the mod_auth_digest module can lead to the leakage of sensitive information and a denial of service. It is crucial to upgrade the Apache2 package to the patched version to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache2 →
FAQ
Apache2 is an open-source web server software widely used for hosting websites and applications.
mod_auth_digest is an Apache module that handles Digest authentication, allowing users to authenticate using a username and password combination.
This vulnerability can lead to the leakage of potentially confidential information and cause a denial of service by triggering a segfault.
To fix this vulnerability, upgrade the Apache2 package to version 2.2.22-13+deb7u10 or later.
No, there is no known workaround for this vulnerability. Upgrading the Apache2 package is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
