Vulnerability CVE-2017-7659
Published: 2017-07-26   Modified: 2017-07-27

Description:
A maliciously constructed HTTP/2 request could cause mod_http2 in Apache HTTP Server 2.4.24, 2.4.25 to dereference a NULL pointer and crash the server process.

Type:

CWE-476

 (NULL Pointer Dereference)

CVSS2 => (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5/10
2.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
None
None
Partial
Affected software
Apache -> Http server 

 References:
http://www.debian.org/security/2017/dsa-3896
http://www.securityfocus.com/bid/99132
http://www.securitytracker.com/id/1038711
https://access.redhat.com/errata/RHSA-2017:2483
https://lists.apache.org/thread.html/1d0b746bbaa3a64890fcdab59ee9050aaa633b7143e7d412374e5a9a@%3Cannounce.httpd.apache.org%3E
https://security.gentoo.org/glsa/201710-32
https://security.netapp.com/advisory/ntap-20180601-0002/
https://support.apple.com/HT208221
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us
Copyright 2024, cxsecurity.com

 

Back to Top