oss-security - CVE-2017-9789: Apache httpd 2.4 Read after free in mod

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CACsi251dwE_HzgX-eK9ALpTRNVF+M8ztZ3YyUm2y5yxeeWOrRQ@mail.gmail.com>
Date: Thu, 13 Jul 2017 07:58:01 -0500
From: William A Rowe Jr <wrowe@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2017-9789: Apache httpd 2.4 Read after free in mod_http2

CVE-2017-9789: Read after free in mod_http2.c

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected:
httpd 2.4.26

Description:
When under stress, closing many connections, the HTTP/2
handling code would sometimes access memory after it has
been freed, resulting in potentially erratic behaviour.

Mitigation:
2.4.26 users of mod_http2 should upgrade to 2.4.27.

Credit:
The Apache HTTP Server security team would like to thank Robert Święcki
for reporting this issue.

References:
https://httpd.apache.org/security_report.html

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.