CVE-2017-9789

CWE-416 — Use After Free10 documents9 sources

Severity

7.5HIGH

EPSS

12.2%

top 6.16%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Apache Software Foundation Apache Http Server Apache Http Server

Timeline

PublishedJul 13

Latest updateMay 13

Description

When under stress, closing many connections, the HTTP/2 handling code in Apache httpd 2.4.26 would sometimes access memory after it has been freed, resulting in potentially erratic behaviour.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶NVDapache/http_server2.4.26

▶CVEListV5apache_software_foundation/apache_http_server2.4.26

▶Alpineapache2< 2.4.27-r0+3

🔴Vulnerability Details

GHSA

GHSA-p7q7-pxmj-xgvj: When under stress, closing many connections, the HTTP/2 handling code in Apache httpd 2↗2022-05-13

▶

CVEList

CVE-2017-9789: When under stress, closing many connections, the HTTP/2 handling code in Apache httpd 2↗2017-07-13

▶

OSV

CVE-2017-9789: When under stress, closing many connections, the HTTP/2 handling code in Apache httpd 2↗2017-07-13

▶

📋Vendor Advisories

Apple

CVE-2017-9789: macOS High Sierra 10.13.1, Security Update 2017-001 Sierra, and Security Update 2017-004 El Capitan↗2017-10-31

▶

Red Hat

httpd: Read after free in mod_http2↗2017-07-11

▶

Debian

CVE-2017-9789: apache2 - When under stress, closing many connections, the HTTP/2 handling code in Apache ...↗2017

▶

Apache

Apache httpd: CVE-2017-9789↗

▶

💬Community

Bugzilla

CVE-2017-9789 httpd: Read after free in mod_http2↗2017-07-13

▶

Bugzilla

CVE-2017-9788 CVE-2017-9789 httpd: various flaws [fedora-all]↗2017-07-13

▶