Loading vulnerability…
HTTP/2 NULL pointer dereference in Apache HTTP Server
CVE-2017-7659 is a NULL pointer dereference vulnerability in the mod_http2 module of Apache HTTP Server 2.4.24 and 2.4.25. Processing a specially crafted HTTP/2 request can trigger the dereference and crash an httpd server process, allowing remote denial of service.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote attacker can crash an httpd child process, disrupting request processing and causing denial of service. The extent and duration of service disruption are not established. Code execution, information disclosure, and privilege escalation are not established for this vulnerability.
If you can’t patch tonight, do this now.
Until patched, limit network exposure of affected servers and restrict untrusted access to HTTP/2 services where feasible. Monitor for anomalous HTTP/2 requests and unexpected httpd process crashes. No vulnerability-specific workaround is identified.
Patch, then assume compromise.
Upgrade Apache HTTP Server to a vendor-supported release incorporating the fix in version 2.4.26 or later, or install the distribution's backported security update. Fixed packages include Debian 9 apache2 2.4.25-3+deb9u1, Debian unstable apache2 2.4.25-4, and Gentoo Apache 2.4.27-r1 or later. Red Hat Software Collections fixes are available through RHSA-2017:2483 in httpd24-httpd 2.4.25-9.el7.1 and 2.4.25-9.el6.1; installation automatically restarts httpd. Debian 8 (jessie) is not affected by this specific vulnerability. For affected NetApp products, apply the vendor-supported update incorporating the Apache fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.