critical
CVE-2017-9788
httpd: Uninitialized memory reflection in mod_auth_digest
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.1CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Red Hat4.8CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Red Hat (high), Amazon (high), Oracle (high), Photon OS (medium), Ubuntu (medium).
Description
In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key with no '=' assignment could reflect the stale value of uninitialized pool memory used by the prior request, leading to leakage of potentially confidential information, and a segfault in other cases resulting in denial of service.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| amazon linux 1 | httpd, httpd-debuginfo, httpd-devel and 3 more | 2.2.34-1.12.amzn1 and 1 more |
| debian 11 | apache2 | 2.4.27-1 |
| debian 12 | apache2 | 2.4.27-1 |
| debian 13 | apache2 | 2.4.27-1 |
| debian 14 | apache2 | 2.4.27-1 |
| debian 7 | apache2 | 2.2.22-13+deb7u10 |
| debian 8 | apache2 | 2.4.10-10+deb8u10 |
| debian 9 | apache2 | 2.4.25-3+deb9u2 |
| echo | apache2 | 2.4.27-1 |
| Oracle Linux 6 | httpd, httpd-devel, httpd-manual and 10 more | 2.2.15-60.0.1.el6_9.5 and 3 more |
| Oracle Linux 7 | httpd, httpd-devel, httpd-manual and 5 more | 2.4.6-67.0.1.el7_4.2 and 1 more |
| Photon OS 1.0 | httpd | 2.4.27-1.ph1 |
Show all 44 entries from 20 sources
| Source | Package | Fixed in |
|---|---|---|
| amazon linux 1 | httpd | 2.2.34-1.12.amzn1 |
| amazon linux 1 | httpd-debuginfo | 2.2.34-1.12.amzn1 |
| amazon linux 1 | httpd-devel | 2.2.34-1.12.amzn1 |
| amazon linux 1 | httpd-manual | 2.2.34-1.12.amzn1 |
| amazon linux 1 | httpd-tools | 2.2.34-1.12.amzn1 |
| amazon linux 1 | mod_ssl | 1:2.2.34-1.12.amzn1 |
| debian 11 | apache2 | 2.4.27-1 |
| debian 12 | apache2 | 2.4.27-1 |
| debian 13 | apache2 | 2.4.27-1 |
| debian 14 | apache2 | 2.4.27-1 |
| debian 7 | apache2 | 2.2.22-13+deb7u10 |
| debian 8 | apache2 | 2.4.10-10+deb8u10 |
| debian 9 | apache2 | 2.4.25-3+deb9u2 |
| echo | apache2 | 2.4.27-1 |
| Oracle Linux 6 | httpd | 2.2.15-60.0.1.el6_9.5 |
| Oracle Linux 6 | httpd-devel | 2.2.15-60.0.1.el6_9.5 |
| Oracle Linux 6 | httpd-manual | 2.2.15-60.0.1.el6_9.5 |
| Oracle Linux 6 | httpd-tools | 2.2.15-60.0.1.el6_9.5 |
| Oracle Linux 6 | httpd24-httpd | 2.4.25-9.0.1.el6.1 |
| Oracle Linux 6 | httpd24-httpd-devel | 2.4.25-9.0.1.el6.1 |
| Oracle Linux 6 | httpd24-httpd-manual | 2.4.25-9.0.1.el6.1 |
| Oracle Linux 6 | httpd24-httpd-tools | 2.4.25-9.0.1.el6.1 |
| Oracle Linux 6 | httpd24-mod_ldap | 2.4.25-9.0.1.el6.1 |
| Oracle Linux 6 | httpd24-mod_proxy_html | 1:2.4.25-9.0.1.el6.1 |
| Oracle Linux 6 | httpd24-mod_session | 2.4.25-9.0.1.el6.1 |
| Oracle Linux 6 | httpd24-mod_ssl | 1:2.4.25-9.0.1.el6.1 |
| Oracle Linux 6 | mod_ssl | 1:2.2.15-60.0.1.el6_9.5 |
| Oracle Linux 7 | httpd | 2.4.6-67.0.1.el7_4.2 |
| Oracle Linux 7 | httpd-devel | 2.4.6-67.0.1.el7_4.2 |
| Oracle Linux 7 | httpd-manual | 2.4.6-67.0.1.el7_4.2 |
| Oracle Linux 7 | httpd-tools | 2.4.6-67.0.1.el7_4.2 |
| Oracle Linux 7 | mod_ldap | 2.4.6-67.0.1.el7_4.2 |
| Oracle Linux 7 | mod_proxy_html | 1:2.4.6-67.0.1.el7_4.2 |
| Oracle Linux 7 | mod_session | 2.4.6-67.0.1.el7_4.2 |
| Oracle Linux 7 | mod_ssl | 1:2.4.6-67.0.1.el7_4.2 |
| Photon OS 1.0 | httpd | 2.4.27-1.ph1 |
| Photon OS 2.0 | httpd | 2.4.28-1.ph2 |
| root.io debian 12 | rootio-apache2 | 2.4.27-1 |
| root.io debian 13 | rootio-apache2 | 2.4.27-1 |
| ubuntu 14.04 | apache2 | 2.4.7-1ubuntu4.17 |
| ubuntu 14.04-ESM | apache2 | 2.4.7-1ubuntu4.17 |
| ubuntu 16.04 | apache2 | 2.4.18-2ubuntu3.4 |
| ubuntu 16.04-ESM | apache2 | 2.4.18-2ubuntu3.4 |
| ubuntu 17.04 | apache2 | 2.4.25-3ubuntu2.2 |
References
- http://www.debian.org/security/2017/dsa-3913
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://www.securityfocus.com/bid/99569
- http://www.securitytracker.com/id/1038906
- https://access.redhat.com/errata/RHSA-2017:2478
- https://access.redhat.com/errata/RHSA-2017:2479
- https://access.redhat.com/errata/RHSA-2017:2483
- https://access.redhat.com/errata/RHSA-2017:2708
All 55 references
- https://access.redhat.com/errata/RHSA-2017:2709
- https://access.redhat.com/errata/RHSA-2017:2710
- https://access.redhat.com/errata/RHSA-2017:3113
- https://access.redhat.com/errata/RHSA-2017:3114
- https://access.redhat.com/errata/RHSA-2017:3193
- https://access.redhat.com/errata/RHSA-2017:3194
- https://access.redhat.com/errata/RHSA-2017:3195
- https://access.redhat.com/errata/RHSA-2017:3239
- https://access.redhat.com/errata/RHSA-2017:3240
- https://access.redhat.com/security/cve/CVE-2017-9788
- https://httpd.apache.org/security/vulnerabilities_22.html
- https://httpd.apache.org/security/vulnerabilities_22.html#2.2.34
- https://httpd.apache.org/security/vulnerabilities_24.html
- https://httpd.apache.org/security/vulnerabilities_24.html#2.4.27
- https://linux-qa.oracle.com/cve/CVE-2017-9788.html
- https://linux-qa.oracle.com/errata/ELSA-2017-2483.html
- https://lists.apache.org/thread.html/0dd69204a6bd643cc4e9ccd008f07a9375525d977c6ebeb07a881afb@%3Cannounce.httpd.apache.org%3E
- https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r15f9aa4427581a1aecb4063f1b4b983511ae1c9935e2a0a6876dad3c@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r8c9983f1172a3415f915ddb7e14de632d2d0c326eb1285755a024165@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b@%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770@%3Ccvs.httpd.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2017-9788
- https://security.gentoo.org/glsa/201710-32
- https://security.netapp.com/advisory/ntap-20170911-0002/
- https://support.apple.com/HT208221
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us
- https://ubuntu.com/security/notices/USN-3370-1
- https://ubuntu.com/security/notices/USN-3370-2
- https://www.cve.org/CVERecord?id=CVE-2017-9788
- https://www.tenable.com/security/tns-2019-09