NetSight
IP …
critical9.8

CVE-2017-3167

In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may l…

Impact

In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.

Affected products

VendorProductAffected versions
ApacheHttp Server
from 2.2.0 before 2.2.33
from 2.4.0 before 2.4.26
NetappClustered Data Ontap
All versions
NetappOncommand Unified Manager
All versions
NetappStoragegrid
All versions
RedhatEnterprise Linux Desktop
Versions 6.0, 7.0
RedhatEnterprise Linux Eus
Versions 6.7, 7.2, 7.3, 7.4, 7.5, 7.6
RedhatEnterprise Linux Server
Versions 6.0, 7.0
RedhatEnterprise Linux Server Aus
Versions 7.2, 7.3, 7.4, 7.6, 7.7
RedhatEnterprise Linux Server Tus
Versions 7.2, 7.3, 7.4, 7.6, 7.7
RedhatEnterprise Linux Workstation
Versions 6.0, 7.0
RedhatJboss Core Services
Version 1.0
AppleMac Os X
before 10.13.1

Weakness classification

CWE-287

References