CVE-2017-12171: Input Validation
A regression was found in the Red Hat Enterprise Linux 6.9 version of httpd 2.2.15-60, causing comments in the "Allow" and "Deny" configuration lines to be parsed incorrectly. A web administrator could unintentionally allow any client to access a restricted HTTP resource.
Other sources
httpd in RHEL 6.9 does not properly parse comments, resulting in the '#' character in "Allow" statements to accidentally match all IP addresses. This can lead to a bypass of intended security restrictions.
https://bugzilla.redhat.com/showbug.cgi?id=1489849
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-12171?
CVE-2017-12171 is classified as a moderate severity vulnerability.
How do I fix CVE-2017-12171?
To fix CVE-2017-12171, update the httpd package to version 2.2.15-61 or later in Red Hat Enterprise Linux 6.9.
Who is affected by CVE-2017-12171?
CVE-2017-12171 affects users running Red Hat Enterprise Linux 6.9 with Apache HTTP Server version 2.2.15-60.
What is the impact of CVE-2017-12171?
The impact of CVE-2017-12171 allows unauthorized access to restricted HTTP resources due to incorrect parsing of comments in configuration lines.
Does CVE-2017-12171 affect newer versions of httpd?
No, CVE-2017-12171 specifically impacts the version of httpd 2.2.15-60 found in Red Hat Enterprise Linux 6.9.