Vulnerability CVE-2017-9789
Published: 2017-07-13

Description:
When under stress, closing many connections, the HTTP/2 handling code in Apache httpd 2.4.26 would sometimes access memory after it has been freed, resulting in potentially erratic behaviour.

Type:

CWE-416

 (Use After Free)

CVSS2 => (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5/10
2.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
None
None
Partial
Affected software
Apache -> Httpd 
Apache -> Http server 

 References:
http://www.securityfocus.com/bid/99568
http://www.securitytracker.com/id/1038907
https://httpd.apache.org/security/vulnerabilities_24.html
https://lists.apache.org/thread.html/9d0098775bd83cf7c33ac5a077ef412c14ce939198921e639c734e20@%3Cannounce.httpd.apache.org%3E
https://security.gentoo.org/glsa/201710-32
https://security.netapp.com/advisory/ntap-20170911-0002/
https://support.apple.com/HT208221
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us
Copyright 2024, cxsecurity.com

 

Back to Top