NetSight
IP …
high7.5

CVE-2017-7668

The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the…

Impact

The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value.

Affected products

VendorProductAffected versions
ApacheHttp Server
Versions 2.2.32, 2.4.24, 2.4.25
NetappClustered Data Ontap
All versions
NetappOncommand Unified Manager
All versions
NetappStoragegrid
All versions
RedhatEnterprise Linux Desktop
Version 7.0
RedhatEnterprise Linux Eus
Versions 7.2, 7.3, 7.4, 7.5, 7.6, 7.7
RedhatEnterprise Linux Server
Version 7.0
RedhatEnterprise Linux Server Aus
Versions 7.2, 7.3, 7.4, 7.6, 7.7
RedhatEnterprise Linux Server Tus
Versions 7.2, 7.3, 7.4, 7.6, 7.7
RedhatEnterprise Linux Workstation
Version 7.0
DebianDebian Linux
Versions 8.0, 9.0
OracleSecure Global Desktop
Version 5.3

Weakness classification

CWE-126CWE-125

References