CVE-2017-9798
En bref
- Sévérité
- Non disponible
- EPSS
- EPSS 95.00 % · centile 100 (2026-10-27)
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- apache
- Statut NVD
- Modified
Description
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Faiblesses (CWE)
Références européennes
- ENISA EUVD · EUVD-2017-18719
- GCVE · GCVE-0-2017-9798
Avis du CERT-FR
- CERTFR-2019-AVI-657 — Multiples vulnérabilités dans Tenable.sc · cert.ssi.gouv.fr
- CERTFR-2018-AVI-190 — Multiples vulnérabilités dans Oracle Virtualization · cert.ssi.gouv.fr
- CERTFR-2018-AVI-026 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
- CERTFR-2017-AVI-451 — Multiples vulnérabilités dans les produits Apple · cert.ssi.gouv.fr
- CERTFR-2017-AVI-336 — Vulnérabilité dans Apache Httpd · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*≤ 2.2.34cpe:2.3:a:apache:http_server:2.4.0:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.4.1:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.4.2:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.4.3:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.4.4:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.4.6:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.4.7:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.4.9:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.4.10:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.4.12:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.4.16:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.4.17:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.4.18:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.4.20:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.4.23:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.4.25:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.4.26:*:*:*:*:*:*:*cpe:2.3:a:apache:http_server:2.4.27:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Apache Software Foundation · Apache HTTP Server | affected Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27 |
Références
- https://access.redhat.com/errata/RHSA-2017:3113
- http://www.securityfocus.com/bid/100872
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://access.redhat.com/errata/RHSA-2017:2882
- https://access.redhat.com/errata/RHSA-2017:2972
- https://blog.fuzzing-project.org/uploads/apache-2.2-optionsbleed-backport.patch
- https://support.apple.com/HT208331
- http://www.securitytracker.com/id/1039387
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03909en_us
- https://access.redhat.com/errata/RHSA-2017:3475
- https://github.com/hannob/optionsbleed
- https://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/server/core.c?r1=1805223&r2=1807754&pathrev=1807754&view=patch
- https://access.redhat.com/errata/RHSA-2017:3240
- https://access.redhat.com/errata/RHSA-2017:3195
- https://access.redhat.com/errata/RHSA-2017:3018
- http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- https://access.redhat.com/errata/RHSA-2017:3239
- https://access.redhat.com/errata/RHSA-2017:3476
- http://www.securityfocus.com/bid/105598
- https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2017-9798
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- https://access.redhat.com/errata/RHSA-2017:3114
- https://access.redhat.com/errata/RHSA-2017:3477
- http://openwall.com/lists/oss-security/2017/09/18/2
- https://security.netapp.com/advisory/ntap-20180601-0003/
- https://access.redhat.com/errata/RHSA-2017:3194
- https://security-tracker.debian.org/tracker/CVE-2017-9798
- https://access.redhat.com/errata/RHSA-2017:3193
- http://www.debian.org/security/2017/dsa-3980
- https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html
- https://www.exploit-db.com/exploits/42745/
- https://security.gentoo.org/glsa/201710-32
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
- https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E
- https://www.tenable.com/security/tns-2019-09
- https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E
- https://github.com/apache/httpd/commit/4cc27823899e070268b906ca677ee838d07cf67a
- https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E
- +6 autres
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |