Detections
Analytics
CVE-2017-7668
high
Description
The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value.
References
https://www.tenable.com/security/tns-2019-09
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03821en_us
https://support.apple.com/HT208221
https://security.netapp.com/advisory/ntap-20180601-0002/
https://security.gentoo.org/glsa/201710-32
https://access.redhat.com/errata/RHSA-2017:3194
https://access.redhat.com/errata/RHSA-2017:3193
https://access.redhat.com/errata/RHSA-2017:2483
https://access.redhat.com/errata/RHSA-2017:2479
http://www.securitytracker.com/id/1038711
http://www.securityfocus.com/bid/99137
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html