Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade apache2 | Aug 22, 2024 | Sep 18, 2017 |
| Amazon_linux | — | Upgrade httpdUpgrade httpd24 | Dec 20, 2017 | Sep 18, 2017 |
| Apache Httpd | — | Upgrade to the latest version of Apache HTTPD | Sep 22, 2017 | Sep 18, 2017 |
| Apple Osx Apache | — | Apply OS X security update 2017-002 SierraUpgrade macOS to the latest versionApply OS X security update 2017-005 El Capitan | Dec 7, 2017 | Sep 18, 2017 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Sep 18, 2017 |
| Centos_linux | — | Upgrade httpdUpgrade mod_ldapUpgrade httpd-toolsUpgrade httpd-manualUpgrade mod_sslUpgrade mod_proxy_htmlUpgrade httpd-develUpgrade httpd-debuginfoUpgrade mod_session | Oct 12, 2017 | Sep 18, 2017 |
| Debian | — | Upgrade apache2 | Sep 25, 2017 | Sep 18, 2017 |
| Freebsd | — | Upgrade apache22Upgrade apache24 | Sep 19, 2017 | Sep 19, 2017 |
| Gentoo Linux | — | Upgrade www-servers/apache. | Oct 30, 2017 | Sep 18, 2017 |
| Hpux | — | Update hpuxwsAPACHE to the latest version | Mar 28, 2022 | Sep 18, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade httpd-toolsUpgrade httpdUpgrade mod_sslUpgrade httpd-manualUpgrade httpd-devel | Nov 30, 2017 | Sep 18, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade httpdUpgrade httpd-toolsUpgrade httpd-manualUpgrade httpd-develUpgrade mod_ssl | Nov 30, 2017 | Sep 18, 2017 |
| Ibm Http_server | — | Apply IBM HTTP Server version 8.0.0.15 or laterApply IBM HTTP Server version 9.0.0.6 or laterApply IBM HTTP Server version 8.5.5.13 or laterApply IBM HTTP Server Interim Fix PI87445 | Jun 22, 2018 | Sep 18, 2017 |
| Oracle Solaris | — | Upgrade web/server/apache-24/module/apache-ssl to version 2.4.29-0.175.3.28.0.1.0 on Solaris 11.3Upgrade web/server/apache-24/module/apache-ssl-fips-140 to version 2.4.29-0.175.3.28.0.1.0 on Solaris 11.3Upgrade web/server/apache-24/module/apache-dbd to version 2.4.29-0.175.3.28.0.1.0 on Solaris 11.3Upgrade web/server/apache-22 to version 2.2.34-0.175.3.28.0.1.0 on Solaris 11.3Upgrade web/server/apache-24 to version 2.4.29-0.175.3.28.0.1.0 on Solaris 11.3Upgrade web/server/apache-24/module/apache-ldap to version 2.4.29-0.175.3.28.0.1.0 on Solaris 11.3Upgrade web/server/apache-22/module/apache-sed to version 2.2.34-0.175.3.28.0.1.0 on Solaris 11.3Upgrade web/server/apache-24/module/apache-lua to version 2.4.29-0.175.3.28.0.1.0 on Solaris 11.3Upgrade web/server/apache-22/documentation to version 2.2.34-0.175.3.28.0.1.0 on Solaris 11.3 | Feb 6, 2018 | Sep 18, 2017 |
| Oracle_linux | — | Upgrade mod_proxy_htmlUpgrade httpd-develUpgrade httpdUpgrade httpd-manualUpgrade mod_sessionUpgrade mod_sslUpgrade httpd-toolsUpgrade mod_ldap | Oct 11, 2017 | Sep 18, 2017 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Sep 18, 2017 |
| Redhat_linux | — | Upgrade httpd-develUpgrade httpd-manualUpgrade mod_sslUpgrade httpd-debuginfoUpgrade mod_ldapUpgrade httpdUpgrade mod_sessionUpgrade mod_proxy_htmlNo solution existsUpgrade httpd-tools | Oct 11, 2017 | Sep 18, 2017 |
| Suse | — | Upgrade apache2-docUpgrade apache2-develUpgrade apache2-eventUpgrade apache2-utilsUpgrade apache2-workerUpgrade apache2Upgrade apache2-preforkUpgrade apache2-example-pages | Sep 25, 2017 | Sep 18, 2017 |
| Ubuntu | — | Upgrade apache2-binUpgrade apache2.2-bin | Sep 19, 2017 | Sep 18, 2017 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Sep 18, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub