CVE-2017-3169

Published: Jun 20, 2017Modified: May 13, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port.

Affected (34)

Products: Apache: Http Server

Apache

1 product

Http Server

Configuration A

34 vulnerable

Vulnerable Software	Affected Versions
Apache Http Server	Version 2.2.0
Apache Http Server	Version 2.2.11
Apache Http Server	Version 2.2.12
Apache Http Server	Version 2.2.13
Apache Http Server	Version 2.2.14
Apache Http Server	Version 2.2.15
Apache Http Server	Version 2.2.16
Apache Http Server	Version 2.2.17
Apache Http Server	Version 2.2.18
Apache Http Server	Version 2.2.19
Apache Http Server	Version 2.2.20
Apache Http Server	Version 2.2.21
Apache Http Server	Version 2.2.22
Apache Http Server	Version 2.2.23
Apache Http Server	Version 2.2.24
Apache Http Server	Version 2.2.25
Apache Http Server	Version 2.2.26
Apache Http Server	Version 2.2.27
Apache Http Server	Version 2.2.29
Apache Http Server	Version 2.2.2
Apache Http Server	Version 2.2.30
Apache Http Server	Version 2.2.31
Apache Http Server	Version 2.2.32
Apache Http Server	Version 2.2.3
Apache Http Server	Version 2.4.10
Apache Http Server	Version 2.4.12
Apache Http Server	Version 2.4.16
Apache Http Server	Version 2.4.17
Apache Http Server	Version 2.4.18
Apache Http Server	Version 2.4.1
Apache Http Server	Version 2.4.20
Apache Http Server	Version 2.4.23
Apache Http Server	Version 2.4.25
Apache Http Server	Version 2.4.2

Related CWEs

CWE-476

NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

References (84)

http://www.debian.org/security/2017/dsa-3896

Source: security@apache.org

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Source: security@apache.org

http://www.securityfocus.com/bid/99134

Source: security@apache.org

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1038711

Source: security@apache.org

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2017:2478

Source: security@apache.org

https://access.redhat.com/errata/RHSA-2017:2479

Source: security@apache.org

https://access.redhat.com/errata/RHSA-2017:2483

Source: security@apache.org

https://access.redhat.com/errata/RHSA-2017:3193

Source: security@apache.org

https://access.redhat.com/errata/RHSA-2017:3194

Source: security@apache.org

https://access.redhat.com/errata/RHSA-2017:3195

Source: security@apache.org

https://access.redhat.com/errata/RHSA-2017:3475

Source: security@apache.org

https://access.redhat.com/errata/RHSA-2017:3476

Source: security@apache.org

https://access.redhat.com/errata/RHSA-2017:3477

Source: security@apache.org

https://github.com/gottburgm/Exploits/tree/master/CVE-2017-3169

Source: security@apache.org

https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/84bf7fcc5cad35d355f11839cbdd13cbc5ffc1d34675090bff0f96ae%40%3Cdev.httpd.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rd336919f655b7ff309385e34a143e41c503e133da80414485b3abcc9%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

https://lists.apache.org/thread.html/rfcf929bd33a6833e3f0c35eebdad70d5060665f9c4e17ea467c66770%40%3Ccvs.httpd.apache.org%3E

Source: security@apache.org

https://security.gentoo.org/glsa/201710-32

Source: security@apache.org

https://security.netapp.com/advisory/ntap-20180601-0002/

Source: security@apache.org

https://support.apple.com/HT208221

Source: security@apache.org

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03908en_us

Source: security@apache.org

https://www.nomachine.com/SU08O00185

Source: security@apache.org

MitigationThird Party Advisory

https://www.tenable.com/security/tns-2019-09

Source: security@apache.org

http://www.debian.org/security/2017/dsa-3896