Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a users .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory “belongs” to the code that operates on the new pointer.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Http_server | Apache | * | 2.2.34 (including) |
| Http_server | Apache | 2.4.0 (including) | 2.4.0 (including) |
| Http_server | Apache | 2.4.1 (including) | 2.4.1 (including) |
| Http_server | Apache | 2.4.2 (including) | 2.4.2 (including) |
| Http_server | Apache | 2.4.3 (including) | 2.4.3 (including) |
| Http_server | Apache | 2.4.4 (including) | 2.4.4 (including) |
| Http_server | Apache | 2.4.6 (including) | 2.4.6 (including) |
| Http_server | Apache | 2.4.7 (including) | 2.4.7 (including) |
| Http_server | Apache | 2.4.9 (including) | 2.4.9 (including) |
| Http_server | Apache | 2.4.10 (including) | 2.4.10 (including) |
| Http_server | Apache | 2.4.12 (including) | 2.4.12 (including) |
| Http_server | Apache | 2.4.16 (including) | 2.4.16 (including) |
| Http_server | Apache | 2.4.17 (including) | 2.4.17 (including) |
| Http_server | Apache | 2.4.18 (including) | 2.4.18 (including) |
| Http_server | Apache | 2.4.20 (including) | 2.4.20 (including) |
| Http_server | Apache | 2.4.23 (including) | 2.4.23 (including) |
| Http_server | Apache | 2.4.25 (including) | 2.4.25 (including) |
| Http_server | Apache | 2.4.26 (including) | 2.4.26 (including) |
| Http_server | Apache | 2.4.27 (including) | 2.4.27 (including) |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-httpd-0:2.4.23-125.jbcs.el6 | * |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-mod_bmx-0:0.9.6-15.GA.jbcs.el6 | * |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-mod_cluster-native-0:1.3.8-1.Final_redhat_1.jbcs.el6 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-httpd-0:2.4.23-125.jbcs.el7 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-mod_bmx-0:0.9.6-15.GA.jbcs.el7 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-mod_cluster-native-0:1.3.8-1.Final_redhat_1.jbcs.el7 | * |
| Red Hat Enterprise Linux 6 | RedHat | httpd-0:2.2.15-60.el6_9.6 | * |
| Red Hat Enterprise Linux 6.7 Extended Update Support | RedHat | httpd-0:2.2.15-47.el6_7.5 | * |
| Red Hat Enterprise Linux 7 | RedHat | httpd-0:2.4.6-67.el7_4.5 | * |
| Red Hat Enterprise Linux 7.2 Extended Update Support | RedHat | httpd-0:2.4.6-40.el7_2.6 | * |
| Red Hat Enterprise Linux 7.3 Extended Update Support | RedHat | httpd-0:2.4.6-45.el7_3.5 | * |
| Red Hat JBoss Enterprise Application Platform 6.4 | RedHat | httpd | * |
| Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | httpd-0:2.2.26-57.ep6.el6 | * |
| Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | jbcs-httpd24-openssl-1:1.0.2h-14.jbcs.el6 | * |
| Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 | RedHat | mod_cluster-native-0:1.2.13-9.Final_redhat_2.ep6.el6 | * |
| Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | httpd22-0:2.2.26-58.ep6.el7 | * |
| Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | jbcs-httpd24-openssl-1:1.0.2h-14.jbcs.el7 | * |
| Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 | RedHat | mod_cluster-native-0:1.2.13-9.Final_redhat_2.ep6.el7 | * |
| Red Hat JBoss Enterprise Web Server 2 for RHEL 6 | RedHat | httpd-0:2.2.26-57.ep6.el6 | * |
| Red Hat JBoss Enterprise Web Server 2 for RHEL 6 | RedHat | jbcs-httpd24-openssl-1:1.0.2h-14.jbcs.el6 | * |
| Red Hat JBoss Enterprise Web Server 2 for RHEL 6 | RedHat | mod_cluster-native-0:1.2.13-9.Final_redhat_2.ep6.el6 | * |
| Red Hat JBoss Enterprise Web Server 2 for RHEL 6 | RedHat | tomcat6-0:6.0.41-19_patch_04.ep6.el6 | * |
| Red Hat JBoss Enterprise Web Server 2 for RHEL 6 | RedHat | tomcat7-0:7.0.54-28_patch_05.ep6.el6 | * |
| Red Hat JBoss Enterprise Web Server 2 for RHEL 7 | RedHat | httpd22-0:2.2.26-58.ep6.el7 | * |
| Red Hat JBoss Enterprise Web Server 2 for RHEL 7 | RedHat | jbcs-httpd24-openssl-1:1.0.2h-14.jbcs.el7 | * |
| Red Hat JBoss Enterprise Web Server 2 for RHEL 7 | RedHat | mod_cluster-native-0:1.2.13-9.Final_redhat_2.ep6.el7 | * |
| Red Hat JBoss Enterprise Web Server 2 for RHEL 7 | RedHat | tomcat6-0:6.0.41-19_patch_04.ep6.el7 | * |
| Red Hat JBoss Enterprise Web Server 2 for RHEL 7 | RedHat | tomcat7-0:7.0.54-28_patch_05.ep6.el7 | * |
| Red Hat JBoss Web Server 2.1 | RedHat | httpd | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 6 | RedHat | httpd24-0:1.1-18.el6 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 6 | RedHat | httpd24-httpd-0:2.4.27-8.el6 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS | RedHat | httpd24-0:1.1-18.el6 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS | RedHat | httpd24-httpd-0:2.4.27-8.el6 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | httpd24-0:1.1-18.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | httpd24-curl-0:7.47.1-4.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | httpd24-httpd-0:2.4.27-8.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | httpd24-mod_auth_kerb-0:5.4-33.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | httpd24-nghttp2-0:1.7.1-6.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS | RedHat | httpd24-0:1.1-18.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS | RedHat | httpd24-curl-0:7.47.1-4.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS | RedHat | httpd24-httpd-0:2.4.27-8.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS | RedHat | httpd24-mod_auth_kerb-0:5.4-33.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS | RedHat | httpd24-nghttp2-0:1.7.1-6.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS | RedHat | httpd24-0:1.1-18.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS | RedHat | httpd24-curl-0:7.47.1-4.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS | RedHat | httpd24-httpd-0:2.4.27-8.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS | RedHat | httpd24-mod_auth_kerb-0:5.4-33.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS | RedHat | httpd24-nghttp2-0:1.7.1-6.el7 | * |
| Text-Only JBCS | RedHat | httpd | * |
| Apache2 | Ubuntu | artful | * |
| Apache2 | Ubuntu | devel | * |
| Apache2 | Ubuntu | esm-infra-legacy/trusty | * |
| Apache2 | Ubuntu | esm-infra/xenial | * |
| Apache2 | Ubuntu | trusty | * |
| Apache2 | Ubuntu | trusty/esm | * |
| Apache2 | Ubuntu | xenial | * |
| Apache2 | Ubuntu | zesty | * |