CVE-2017-12171
published 2018-07-26CVE-2017-12171: A regression was found in the Red Hat Enterprise Linux 6.9 version of httpd 2.2.15-60, causing comments in the "Allow" and "Deny" configuration lines to be…
PriorityP340medium6.5CVSS 3.0
AVNACLPRNUINSUCLILAN
EPSS
8.08%
94.8th percentile
A regression was found in the Red Hat Enterprise Linux 6.9 version of httpd 2.2.15-60, causing comments in the "Allow" and "Deny" configuration lines to be parsed incorrectly. A web administrator could unintentionally allow any client to access a restricted HTTP resource.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | — | — |
| debian | apache2 | — | — |
| red_hat | httpd | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_workstation | — | — |
CVSS provenance
nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
vendor_debian6.5LOW
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
httpd: # character matches all IPs
vendor_redhat·2017-10-19·CVSS 6.5
CVE-2017-12171 [MEDIUM] CWE-284 httpd: # character matches all IPs
httpd: # character matches all IPs
A regression was found in the Red Hat Enterprise Linux 6.9 version of httpd 2.2.15-60, causing comments in the "Allow" and "Deny" configuration lines to be parsed incorrectly. A web administrator could unintentionally allow any client to access a restricted HTTP resource.
A regression was found in the Red Hat Enterprise Linux 6.9 version of httpd, causing comments in the "Allow" and "Deny" configuration lines to be parsed incorrectly. A web administrator could unintentionally allow any client to access a restricted HTTP resource.
Package: httpd (Red Hat Enterprise Linux 5) - Not affected
Package: httpd (Red Hat Enterprise Linux 7) - Not affected
Package: httpd (Red Hat JBoss Core Services) - Not affected
Package: httpd (Red Hat JBoss Enterprise Appl
Debian
CVE-2017-12171: apache2 - A regression was found in the Red Hat Enterprise Linux 6.9 version of httpd 2.2....
vendor_debian·2017·CVSS 6.5
CVE-2017-12171 [MEDIUM] CVE-2017-12171: apache2 - A regression was found in the Red Hat Enterprise Linux 6.9 version of httpd 2.2....
A regression was found in the Red Hat Enterprise Linux 6.9 version of httpd 2.2.15-60, causing comments in the "Allow" and "Deny" configuration lines to be parsed incorrectly. A web administrator could unintentionally allow any client to access a restricted HTTP resource.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
GHSA
GHSA-c8w6-x7h9-gq97: A regression was found in the Red Hat Enterprise Linux 6
ghsa_unreviewed·2022-05-13
CVE-2017-12171 [MEDIUM] CWE-20 GHSA-c8w6-x7h9-gq97: A regression was found in the Red Hat Enterprise Linux 6
A regression was found in the Red Hat Enterprise Linux 6.9 version of httpd 2.2.15-60, causing comments in the "Allow" and "Deny" configuration lines to be parsed incorrectly. A web administrator could unintentionally allow any client to access a restricted HTTP resource.
No detection rules found.
No public exploits indexed.
http://www.securityfocus.com/bid/101516http://www.securitytracker.com/id/1039633https://access.redhat.com/errata/RHSA-2017:2972https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12171http://www.securityfocus.com/bid/101516http://www.securitytracker.com/id/1039633https://access.redhat.com/errata/RHSA-2017:2972https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12171
2018-07-26
Published