Vulnerability Description
In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could be exploited in environments where uploads of some files are are externally blocked, but only by matching the trailing portion of the filename.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Http Server | >= 2.4.0, <= 2.4.29 |
| Debian | Debian Linux | 8.0 |
| Canonical | Ubuntu Linux | 14.04 |
| Netapp | Santricity Cloud Connector | - |
| Netapp | Storage Automation Store | - |
| Netapp | Storagegrid | - |
| Netapp | Clustered Data Ontap | - |
| Redhat | Enterprise Linux | 6.0 |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2018/03/24/6Mailing ListThird Party Advisory
- http://www.securityfocus.com/bid/103525Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1040570Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2018:3558Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:0366Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:0367Third Party Advisory
- https://httpd.apache.org/security/vulnerabilities_24.htmlVendor Advisory
- https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cd
- https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e10
- https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7
- https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda
- https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d9784
- https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37
- https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f8
- https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa
FAQ
What is CVE-2017-15715?
CVE-2017-15715 is a vulnerability with a CVSS score of 8.1 (HIGH). In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a malicious filename, rather than matching only the end of the filename. This could ...
How severe is CVE-2017-15715?
CVE-2017-15715 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-15715?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Http Server, Debian Debian Linux, Canonical Ubuntu Linux, Netapp Santricity Cloud Connector, Netapp Storage Automation Store.