Summary
Robert Święcki discovered that the Apache HTTP Server mod_auth_digest
module incorrectly cleared values when processing certain requests. A
remote attacker could use this issue to cause the server to crash,
resulting in a denial or service, or possibly obtain sensitive information.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | apache2 | 2.4.7-1ubuntu4.17 |
| Ubuntu · 16.04 LTS 16.04:LTS | apache2 | 2.4.18-2ubuntu3.4 |
Vulnerabilities 1
-
Unscored —CVE-2017-9788 EPSS 57%
In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type '…
References
-
report
https://ubuntu.com/security/CVE-2017-9788