/[Apache-SVN]
ViewVC logotype

Revision 1800955


Jump to revision: Previous Next
Author: wrowe
Date: Thu Jul 6 00:02:54 2017 UTC (6 years, 9 months ago)
Changed paths: 3
Log Message:
SECURITY: CVE-2017-9788: Uninitialized memory reflection in mod_auth_digest.

The value placeholder in [Proxy-]Authorization headers type 'Digest' was not
initialized or reset before or between successive key=value assignments by
mod_auth_digest.  Providing an initial key with no '=' assignment could reflect
the stale value of uninitialized pool memory used by the prior request, leading
to leakage of potentially confidential information, and a segfault.

Submitted by: wrowe
Backports: r1800919
Reviewed by: wrowe, jim, jchampion



Changed paths

Path Details
Directoryhttpd/httpd/branches/2.4.x/ modified , props changed
Directoryhttpd/httpd/branches/2.4.x/STATUS modified , text changed
Directoryhttpd/httpd/branches/2.4.x/modules/aaa/mod_auth_digest.c modified , text changed

infrastructure at apache.org
ViewVC Help
Powered by ViewVC 1.1.26