Описание
The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | released | 2.4.27-2ubuntu2 |
| esm-infra-legacy/trusty | released | 2.4.7-1ubuntu4.16 |
| esm-infra/xenial | released | 2.4.18-2ubuntu3.3 |
| precise/esm | not-affected | 2.2.22-1ubuntu1.12 |
| trusty | released | 2.4.7-1ubuntu4.16 |
| trusty/esm | released | 2.4.7-1ubuntu4.16 |
| upstream | pending | 2.2.33, 2.4.26 |
| vivid/ubuntu-core | DNE | |
| xenial | released | 2.4.18-2ubuntu3.3 |
| yakkety | released | 2.4.18-2ubuntu4.2 |
Показывать по
EPSS
5 Medium
CVSS2
7.5 High
CVSS3
Связанные уязвимости
The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value.
The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value.
The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.2 ...
The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value.
Уязвимость функции ap_find_token веб-сервера Apache HTTP Server, позволяющая нарушителю вызвать ошибку сегментации
EPSS
5 Medium
CVSS2
7.5 High
CVSS3