CVE-2017-7668
Published Jun 20, 2017
Last updated a year ago
Overview
- Description
- The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value.
- Source
- security@apache.org
- NVD status
- Modified
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 7.5
- Impact score
- 3.6
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Severity
- HIGH
CVSS 2.0
- Type
- Primary
- Base score
- 5
- Impact score
- 2.9
- Exploitability score
- 10
- Vector string
- AV:N/AC:L/Au:N/C:N/I:N/A:P
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apache:http_server:2.2.32:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "020254C9-BA4E-4705-A967-ABD498722C99"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.4.24:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AD2AC773-59A1-46EB-8943-309ADF012435"
},
{
"criteria": "cpe:2.3:a:apache:http_server:2.4.25:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FB5673AB-53BB-40B2-83A7-8B82B2D0EBB8"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1FE996B1-6951-4F85-AA58-B99A379D2163"
},
{
"criteria": "cpe:2.3:a:netapp:oncommand_unified_manager:-:*:*:*:*:7-mode:*:*",
"vulnerable": true,
"matchCriteriaId": "3FA5E22C-489B-4C5F-A5F3-C03F45CA8811"
},
{
"criteria": "cpe:2.3:a:netapp:storagegrid:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8ADFF451-740F-4DBA-BD23-3881945D3E40"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "33C068A4-3780-4EAB-A937-6082DF847564"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_eus:7.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AE1D81A1-CD24-4B17-8AFD-DC95E90AD7D0"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "807C024A-F8E8-4B48-A349-4C68CD252CA1"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F96E3779-F56A-45FF-BB3D-4980527D721E"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0CF73560-2F5B-4723-A8A1-9AADBB3ADA00"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5BF3C7A5-9117-42C7-BEA1-4AA378A582EF"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "83737173-E12E-4641-BC49-0BD84A6B29D0"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "51EF4996-72F4-4FA4-814F-F5991E7A8318"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1C8D871B-AEA1-4407-AEE3-47EC782250FF"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "98381E61-F082-4302-B51F-5648884F998B"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D99A687E-EAE6-417E-A88E-D0082BC194CD"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B353CE99-D57C-465B-AAB0-73EF581127D1"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7431ABC1-9252-419E-8CC1-311B41360078"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6755B6AD-0422-467B-8115-34A60B1D1A40"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "24C0F4E1-C52C-41E0-9F14-F83ADD5CC7ED"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D5F7E11E-FB34-4467-8919-2B6BEAABF665"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B76AA310-FEC7-497F-AF04-C3EC1E76C4CC"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "17F256A9-D3B9-4C72-B013-4EFD878BFEA8"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "825ECE2D-E232-46E0-A047-074B34DB1E97"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43"
},
{
"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:oracle:secure_global_desktop:5.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8B4B4E96-1F12-4719-BDB7-4ED5D3DCF9ED"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C43CA59D-847F-4225-A7A6-02DEB1BB4F64",
"versionEndExcluding": "10.13.1"
},
{
"criteria": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "591A337B-D469-4080-BEC6-5ED9523EFC92",
"versionEndExcluding": "10.11.6",
"versionStartIncluding": "10.11.0"
},
{
"criteria": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "97AA7714-48CD-4249-9968-81C9781B1102",
"versionEndExcluding": "10.12.6",
"versionStartIncluding": "10.12.0"
},
{
"criteria": "cpe:2.3:o:apple:mac_os_x:10.11.6:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4B7FC88F-6216-480F-A27D-9A2D2D8F3034"
},
{
"criteria": "cpe:2.3:o:apple:mac_os_x:10.11.6:security_update_2016-001:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C47360D3-4390-4F31-BA82-7A4F38408E68"
},
{
"criteria": "cpe:2.3:o:apple:mac_os_x:10.11.6:security_update_2016-002:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DEB1158A-9D65-463A-A8AF-D946E95EB2D5"
},
{
"criteria": "cpe:2.3:o:apple:mac_os_x:10.11.6:security_update_2016-003:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "28B4E7A2-3022-4B23-A068-FFE58C3A449B"
},
{
"criteria": "cpe:2.3:o:apple:mac_os_x:10.11.6:security_update_2017-001:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7EE0F7C4-53B7-4554-8F4D-AAB417A1569F"
},
{
"criteria": "cpe:2.3:o:apple:mac_os_x:10.11.6:security_update_2017-002:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C03A4DED-974B-4FCE-92F7-83DA939E0847"
},
{
"criteria": "cpe:2.3:o:apple:mac_os_x:10.11.6:security_update_2017-003:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "47EF9186-8EBD-441B-B2DD-FB18C072EEBC"
},
{
"criteria": "cpe:2.3:o:apple:mac_os_x:10.12.6:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6536473A-2ECF-4806-AC02-2386552BEAB1"
}
],
"operator": "OR"
}
]
}
]