Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
MIME-Version: 1.0
In-Reply-To: <CACsi250HCNHr3SYRpaZ7byt1aBowLoeig1bYK2DYpK=Q58Cb2A@mail.gmail.com>
References: <CACsi250HCNHr3SYRpaZ7byt1aBowLoeig1bYK2DYpK=Q58Cb2A@mail.gmail.com>
From: Rashmi Srinivasan <rashmisrinivasan2007@gmail.com>
Date: Mon, 17 Jul 2017 11:20:03 +0530
Message-ID: <CA+ckEMJspTCtgOn+_u8JNS1T9usM_FVroQRrpvfq6stA7vf54A@mail.gmail.com>
Subject: Re: CVE-2017-9788: Uninitialized memory reflection in mod_auth_digest
To: dev@httpd.apache.org
Cc: users@httpd.apache.org
Content-Type: multipart/alternative; boundary="089e0821eb4065334805547cf83b"
archived-at: Mon, 17 Jul 2017 05:50:11 -0000

--089e0821eb4065334805547cf83b
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi,

Please can you point us to the patch for this CVE?

regards,
Rashmi

On Thu, Jul 13, 2017 at 6:32 PM, William A Rowe Jr <wrowe@rowe-clan.net>
wrote:

> CVE-2017-9788: Uninitialized memory reflection in mod_auth_digest
>
> Severity: Important
>
> Vendor: The Apache Software Foundation
>
> Versions Affected:
> all versions through 2.2.33 and 2.4.26
>
> Description:
> The value placeholder in [Proxy-]Authorization headers
> of type 'Digest' was not initialized or reset
> before or between successive key=3Dvalue assignments.
> by mod_auth_digest
> Providing an initial key with no '=3D' assignment
> could reflect the stale value of uninitialized pool
> memory used by the prior request, leading to leakage
> of potentially confidential information, and a segfault
>
> Mitigation:
> All users of httpd should upgrade to 2.4.27 (or minimally
> 2.2.34, which will receive no further security releases.)
> Alternately, the administrator could configure httpd to
> reject requests with a header matching a complex regular
> expression identifing where =3D character does not occur
> in the first key=3Dvalue pair, as in the following syntax;
> [Proxy-]Authorization: Digest key[,key=3Dvalue]
>
> Credit:
> The Apache HTTP Server security team would like to thank Robert =C5=9Awi=
=C4=99cki
> for reporting this issue.
>
> References:
> https://httpd.apache.org/security_report.html
>

--089e0821eb4065334805547cf83b
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hi,</div><div><br></div>Please can you point us to th=
e patch for this CVE?<div><br></div><div>regards,</div><div>Rashmi</div></d=
iv><div class=3D"gmail_extra"><br><div class=3D"gmail_quote">On Thu, Jul 13=
, 2017 at 6:32 PM, William A Rowe Jr <span dir=3D"ltr">&lt;<a href=3D"mailt=
o:wrowe@rowe-clan.net" target=3D"_blank">wrowe@rowe-clan.net</a>&gt;</span>=
 wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;bor=
der-left:1px #ccc solid;padding-left:1ex">CVE-2017-9788: Uninitialized memo=
ry reflection in mod_auth_digest<br>
<br>
Severity: Important<br>
<br>
Vendor: The Apache Software Foundation<br>
<br>
Versions Affected:<br>
all versions through 2.2.33 and 2.4.26<br>
<br>
Description:<br>
The value placeholder in [Proxy-]Authorization headers<br>
of type &#39;Digest&#39; was not initialized or reset<br>
before or between successive key=3Dvalue assignments.<br>
by mod_auth_digest<br>
Providing an initial key with no &#39;=3D&#39; assignment<br>
could reflect the stale value of uninitialized pool<br>
memory used by the prior request, leading to leakage<br>
of potentially confidential information, and a segfault<br>
<br>
Mitigation:<br>
All users of httpd should upgrade to 2.4.27 (or minimally<br>
2.2.34, which will receive no further security releases.)<br>
Alternately, the administrator could configure httpd to<br>
reject requests with a header matching a complex regular<br>
expression identifing where =3D character does not occur<br>
in the first key=3Dvalue pair, as in the following syntax;<br>
[Proxy-]Authorization: Digest key[,key=3Dvalue]<br>
<br>
Credit:<br>
The Apache HTTP Server security team would like to thank Robert =C5=9Awi=C4=
=99cki<br>
for reporting this issue.<br>
<br>
References:<br>
<a href=3D"https://httpd.apache.org/security_report.html" rel=3D"noreferrer=
" target=3D"_blank">https://httpd.apache.org/<wbr>security_report.html</a><=
br>
</blockquote></div><br></div>

--089e0821eb4065334805547cf83b--