CVE Vulnerabilities

CVE-2017-9798

Use After Free

Published: Sep 18, 2017 | Modified: Apr 20, 2025
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:P/I:N/A:N
RedHat/V2
RedHat/V3
5.9 MODERATE
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Ubuntu
MEDIUM

Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a users .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.

Weakness

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory “belongs” to the code that operates on the new pointer.

Affected Software

Name Vendor Start Version End Version
Http_server Apache * 2.2.34 (including)
Http_server Apache 2.4.0 (including) 2.4.0 (including)
Http_server Apache 2.4.1 (including) 2.4.1 (including)
Http_server Apache 2.4.2 (including) 2.4.2 (including)
Http_server Apache 2.4.3 (including) 2.4.3 (including)
Http_server Apache 2.4.4 (including) 2.4.4 (including)
Http_server Apache 2.4.6 (including) 2.4.6 (including)
Http_server Apache 2.4.7 (including) 2.4.7 (including)
Http_server Apache 2.4.9 (including) 2.4.9 (including)
Http_server Apache 2.4.10 (including) 2.4.10 (including)
Http_server Apache 2.4.12 (including) 2.4.12 (including)
Http_server Apache 2.4.16 (including) 2.4.16 (including)
Http_server Apache 2.4.17 (including) 2.4.17 (including)
Http_server Apache 2.4.18 (including) 2.4.18 (including)
Http_server Apache 2.4.20 (including) 2.4.20 (including)
Http_server Apache 2.4.23 (including) 2.4.23 (including)
Http_server Apache 2.4.25 (including) 2.4.25 (including)
Http_server Apache 2.4.26 (including) 2.4.26 (including)
Http_server Apache 2.4.27 (including) 2.4.27 (including)
JBoss Core Services on RHEL 6 RedHat jbcs-httpd24-httpd-0:2.4.23-125.jbcs.el6 *
JBoss Core Services on RHEL 6 RedHat jbcs-httpd24-mod_bmx-0:0.9.6-15.GA.jbcs.el6 *
JBoss Core Services on RHEL 6 RedHat jbcs-httpd24-mod_cluster-native-0:1.3.8-1.Final_redhat_1.jbcs.el6 *
JBoss Core Services on RHEL 7 RedHat jbcs-httpd24-httpd-0:2.4.23-125.jbcs.el7 *
JBoss Core Services on RHEL 7 RedHat jbcs-httpd24-mod_bmx-0:0.9.6-15.GA.jbcs.el7 *
JBoss Core Services on RHEL 7 RedHat jbcs-httpd24-mod_cluster-native-0:1.3.8-1.Final_redhat_1.jbcs.el7 *
Red Hat Enterprise Linux 6 RedHat httpd-0:2.2.15-60.el6_9.6 *
Red Hat Enterprise Linux 6.7 Extended Update Support RedHat httpd-0:2.2.15-47.el6_7.5 *
Red Hat Enterprise Linux 7 RedHat httpd-0:2.4.6-67.el7_4.5 *
Red Hat Enterprise Linux 7.2 Extended Update Support RedHat httpd-0:2.4.6-40.el7_2.6 *
Red Hat Enterprise Linux 7.3 Extended Update Support RedHat httpd-0:2.4.6-45.el7_3.5 *
Red Hat JBoss Enterprise Application Platform 6.4 RedHat httpd *
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 RedHat httpd-0:2.2.26-57.ep6.el6 *
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 RedHat jbcs-httpd24-openssl-1:1.0.2h-14.jbcs.el6 *
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 RedHat mod_cluster-native-0:1.2.13-9.Final_redhat_2.ep6.el6 *
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 RedHat httpd22-0:2.2.26-58.ep6.el7 *
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 RedHat jbcs-httpd24-openssl-1:1.0.2h-14.jbcs.el7 *
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 RedHat mod_cluster-native-0:1.2.13-9.Final_redhat_2.ep6.el7 *
Red Hat JBoss Enterprise Web Server 2 for RHEL 6 RedHat httpd-0:2.2.26-57.ep6.el6 *
Red Hat JBoss Enterprise Web Server 2 for RHEL 6 RedHat jbcs-httpd24-openssl-1:1.0.2h-14.jbcs.el6 *
Red Hat JBoss Enterprise Web Server 2 for RHEL 6 RedHat mod_cluster-native-0:1.2.13-9.Final_redhat_2.ep6.el6 *
Red Hat JBoss Enterprise Web Server 2 for RHEL 6 RedHat tomcat6-0:6.0.41-19_patch_04.ep6.el6 *
Red Hat JBoss Enterprise Web Server 2 for RHEL 6 RedHat tomcat7-0:7.0.54-28_patch_05.ep6.el6 *
Red Hat JBoss Enterprise Web Server 2 for RHEL 7 RedHat httpd22-0:2.2.26-58.ep6.el7 *
Red Hat JBoss Enterprise Web Server 2 for RHEL 7 RedHat jbcs-httpd24-openssl-1:1.0.2h-14.jbcs.el7 *
Red Hat JBoss Enterprise Web Server 2 for RHEL 7 RedHat mod_cluster-native-0:1.2.13-9.Final_redhat_2.ep6.el7 *
Red Hat JBoss Enterprise Web Server 2 for RHEL 7 RedHat tomcat6-0:6.0.41-19_patch_04.ep6.el7 *
Red Hat JBoss Enterprise Web Server 2 for RHEL 7 RedHat tomcat7-0:7.0.54-28_patch_05.ep6.el7 *
Red Hat JBoss Web Server 2.1 RedHat httpd *
Red Hat Software Collections for Red Hat Enterprise Linux 6 RedHat httpd24-0:1.1-18.el6 *
Red Hat Software Collections for Red Hat Enterprise Linux 6 RedHat httpd24-httpd-0:2.4.27-8.el6 *
Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS RedHat httpd24-0:1.1-18.el6 *
Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS RedHat httpd24-httpd-0:2.4.27-8.el6 *
Red Hat Software Collections for Red Hat Enterprise Linux 7 RedHat httpd24-0:1.1-18.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7 RedHat httpd24-curl-0:7.47.1-4.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7 RedHat httpd24-httpd-0:2.4.27-8.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7 RedHat httpd24-mod_auth_kerb-0:5.4-33.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7 RedHat httpd24-nghttp2-0:1.7.1-6.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS RedHat httpd24-0:1.1-18.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS RedHat httpd24-curl-0:7.47.1-4.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS RedHat httpd24-httpd-0:2.4.27-8.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS RedHat httpd24-mod_auth_kerb-0:5.4-33.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS RedHat httpd24-nghttp2-0:1.7.1-6.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS RedHat httpd24-0:1.1-18.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS RedHat httpd24-curl-0:7.47.1-4.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS RedHat httpd24-httpd-0:2.4.27-8.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS RedHat httpd24-mod_auth_kerb-0:5.4-33.el7 *
Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS RedHat httpd24-nghttp2-0:1.7.1-6.el7 *
Text-Only JBCS RedHat httpd *
Apache2 Ubuntu artful *
Apache2 Ubuntu devel *
Apache2 Ubuntu esm-infra-legacy/trusty *
Apache2 Ubuntu esm-infra/xenial *
Apache2 Ubuntu trusty *
Apache2 Ubuntu trusty/esm *
Apache2 Ubuntu xenial *
Apache2 Ubuntu zesty *

Potential Mitigations

References