The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value.
References
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: apache
Published: 2017-06-20T01:00:00
Updated: 2021-06-06T10:12:02
Reserved: 2017-04-11T00:00:00
Link: CVE-2017-7668
JSON object: View
NVD Information
Status : Modified
Published: 2017-06-20T01:29:00.390
Modified: 2023-11-07T02:50:14.337
Link: CVE-2017-7668
JSON object: View
Redhat Information
No data.