CVE-2017-3167: Use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed. Third-party module writers SHOULD use ap_get_basic_auth_components(), available in 2.2.34 and 2.4.26, instead of ap_get_basic_auth_pw(). Modules which call the legacy ap_get_basic_auth_pw() during the authentication phase MUST either immediately authenticate the user after the call, or else stop the request immediately with an error response, to avoid incorrectly authenticating the current request.
Kurzinfo
Metadaten
- Original (extern): Link oeffnen
- Veroeffentlicht: 2017-06-19 00:00 UTC
- Importiert: 2026-10-15 12:54 UTC
- Quelle-ID:
apache_httpd_sec - uid_hash:
73bc8e1c811f400aead198860c5b36f23bea0a0794a6b8b3ca89514ad2023a78
Verknuepfte CVEs
| CVE-ID | Severity (Quelle) | CVSS (Quelle) | Severity (CVE.org) | CVSS (CVE.org) | EPSS | EPSS-Pctl | Veroeffentlicht (CVE.org) |
|---|---|---|---|---|---|---|---|
2017-06-20 |
Quellen-Details
| Bezeichnung | Name | Kategorie | Tags | Zielgruppe | Sprache | Feed-URL |
|---|---|---|---|---|---|---|
| Apache HTTP Server Security (httpd.org JSON) | vendor_advisory | webserver, httpd | - | de | https://httpd.apache.org/security/vulnerabilities-httpd.json |