CVE-2017-9798
At a glance
- Severity
- Not available
- EPSS
- EPSS 95.00 % · percentile 100 (2026-10-27)
- State
- PUBLISHED
- Published
- Updated
- Assigner
- apache
- NVD status
- Modified
Description
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Weaknesses (CWE)
European references
- ENISA EUVD · EUVD-2017-18719
- GCVE · GCVE-0-2017-9798
CERT-FR advisories
- CERTFR-2019-AVI-657 — Multiples vulnérabilités dans Tenable.sc · cert.ssi.gouv.fr
- CERTFR-2018-AVI-190 — Multiples vulnérabilités dans Oracle Virtualization · cert.ssi.gouv.fr
- CERTFR-2018-AVI-026 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
- CERTFR-2017-AVI-451 — Multiples vulnérabilités dans les produits Apple · cert.ssi.gouv.fr
- CERTFR-2017-AVI-336 — Vulnérabilité dans Apache Httpd · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*≤ 2.2.34cpe:2.3:a:apache:http_server:2.4.0:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.4.1:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.4.2:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.4.3:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.4.4:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.4.6:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.4.7:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.4.9:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.4.10:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.4.12:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.4.16:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.4.17:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.4.18:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.4.20:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.4.23:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.4.25:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.4.26:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.4.27:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Apache Software Foundation · Apache HTTP Server | affected Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27 |
References
- https://access.redhat.com/errata/RHSA-2017:3113
- http://www.securityfocus.com/bid/100872
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://access.redhat.com/errata/RHSA-2017:2882
- https://access.redhat.com/errata/RHSA-2017:2972
- https://blog.fuzzing-project.org/uploads/apache-2.2-optionsbleed-backport.patch
- https://support.apple.com/HT208331
- http://www.securitytracker.com/id/1039387
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us
- https://access.redhat.com/errata/RHSA-2017:3475
- https://github.com/hannob/optionsbleed
- https://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/server/core.c?r1=1805223&r2=1807754&pathrev=1807754&view=patch
- https://access.redhat.com/errata/RHSA-2017:3240
- https://access.redhat.com/errata/RHSA-2017:3195
- https://access.redhat.com/errata/RHSA-2017:3018
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- https://access.redhat.com/errata/RHSA-2017:3239
- https://access.redhat.com/errata/RHSA-2017:3476
- http://www.securityfocus.com/bid/105598
- https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2017-9798
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://access.redhat.com/errata/RHSA-2017:3114
- https://access.redhat.com/errata/RHSA-2017:3477
- http://openwall.com/lists/oss-security/2017/09/18/2
- https://security.netapp.com/advisory/ntap-20180601-0003/
- https://access.redhat.com/errata/RHSA-2017:3194
- https://security-tracker.debian.org/tracker/CVE-2017-9798
- https://access.redhat.com/errata/RHSA-2017:3193
- http://www.debian.org/security/2017/dsa-3980
- https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html
- https://www.exploit-db.com/exploits/42745/
- https://security.gentoo.org/glsa/201710-32
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E
- https://www.tenable.com/security/tns-2019-09
- https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E
- https://github.com/apache/httpd/commit/4cc27823899e070268b906ca677ee838d07cf67a
- https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E
- +6 more
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |