CVE-2017-3169
CriticalSummary
In Apache httpd versions 2.2.x before 2.2.33 and 2.4.x before 2.4.26, the mod_ssl module may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port.
Risk Assessment
An attacker may exploit this vulnerability to cause a server crash, potentially leading to service downtime. This could affect the availability of applications relying on the Apache server.
Recommendation
It is recommended to upgrade Apache httpd to version 2.2.33 or 2.4.26 or later to mitigate this vulnerability.
Other vulnerabilities in Apache httpd
See all- CVE-2017-9789High
The HTTP/2 handling code in Apache httpd 2.4.26 has an issue that may lead to accessing memory after it has been freed, especially when closing many connections under stress. This can result in erratic application behavior.
- CVE-2017-7668High
The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, allowing ap_find_token() to search past the end of its input string. Maliciously crafted request headers may lead to a segmentation fault or cause ap_find_token() to return an incorrect value.
- CVE-2017-9788Critical
In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_digest. This could lead to leakage of potentially confidential information and a segfault in other cases resulting in denial of service.
- CVE-2017-3167Critical
In Apache httpd versions 2.2.x before 2.2.33 and 2.4.x before 2.4.26, the use of ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.
- CVE-2000-1206Medium
Vulnerability in Apache httpd before 1.3.11, when configured for mass virtual hosting using mod_rewrite or mod_vhost_alias in Apache 1.3.9, allows remote attackers to retrieve arbitrary files.
- CVE-1999-0071High
Apache httpd versions 1.1.1 and earlier are vulnerable to cookie buffer overflow.
Original NVD description (English source)
In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port.