CVE-2017-7668

Published: 19 June 2017

The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value.

Priority

CVSS 3 base score: 7.5

Status

Package	Release	Status
apache2 Launchpad, Ubuntu, Debian	precise	Released (2.2.22-1ubuntu1.12)
	trusty	Released (2.4.7-1ubuntu4.16)
	upstream	Pending (2.2.33, 2.4.26)
	xenial	Released (2.4.18-2ubuntu3.3)
	yakkety	Released (2.4.18-2ubuntu4.2)
	zesty	Released (2.4.25-3ubuntu2.1)

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7668
https://lists.apache.org/thread.html/55a068b6a5eec0b3198ae7d96a7cb412352d0ffa7716612c5af3745b@%3Cdev.httpd.apache.org%3E
https://ubuntu.com/security/notices/USN-3340-1
https://ubuntu.com/security/notices/USN-3373-1
NVD
Launchpad
Debian

Bugs

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›