CVE-2017-15715: Input Validation
In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked, but only by matching the trailing portion of the filename.
Other sources
The expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are externally blocked, but only by matching the trailing portion of the filename.
Versions Affected: httpd 2.4.0 to 2.4.29
External References:
https://httpd.apache.org/security/vulnerabilities24.html
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/httpdto a version that resolves this vulnerability.Fixed in 2.4.30 - Upgrade
Upgrade
debian/apache2to a version that resolves this vulnerability.Fixed in 2.4.62-1~deb11u1Fixed in 2.4.67-1~deb11u3Fixed in 2.4.68-1~deb12u1Fixed in 2.4.67-1~deb12u3Fixed in 2.4.68-1~deb13u1Fixed in 2.4.67-1~deb13u3Fixed in 2.4.68-1 - Upgrade
Upgrade
httpdto a version that resolves this vulnerability.Fixed in 2.4.30 - Compensating control
For affected Apache httpd 2.4.0 through 2.4.29 environments, tighten upload filename filtering/blocks so they are not based on a pattern that could match '$' to a newline character (e.g., ensure filename blocking logic reliably matches only the end of the filename, not newline-terminated strings).
Event History
Frequently Asked Questions
What is CVE-2017-15715?
CVE-2017-15715 is a vulnerability in Apache httpd 2.4.0 to 2.4.29 that allows a malicious filename to match '$' to a newline character.
What is the severity of CVE-2017-15715?
The severity of CVE-2017-15715 is high, with a severity value of 8.1.
Which software versions are affected by CVE-2017-15715?
Apache httpd versions 2.4.0 to 2.4.29 are affected by CVE-2017-15715.
How can I fix CVE-2017-15715?
To fix CVE-2017-15715, upgrade Apache httpd to version 2.4.30 or later.
Where can I find more information about CVE-2017-15715?
You can find more information about CVE-2017-15715 on the Apache HTTP Server website and the Red Hat Bugzilla page.