CVE-2017-17663 The htpasswd implementation of mini_httpd before v1.28 and of thttpd before v2.28 is affected by a buffer overflow that can be exploited remotely to perform code execution.
CriticalCVSS 9.8
EPSS 2.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The htpasswd implementation of mini_httpd before v1.28 and of thttpd before v2.28 is affected by a buffer overflow that can be exploited remotely to perform code execution.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/mini-httpd(Debian:12) | All versions | No fix listed |
| debian/mini-httpd(Debian:12) | = 1.30-10 | No fix listed |
| debian/mini-httpd(Debian:12) | = 1.30-11 | No fix listed |
| debian/mini-httpd(Debian:12) | = 1.30-12 | No fix listed |
| debian/mini-httpd(Debian:12) | = 1.30-13 | No fix listed |
| debian/mini-httpd(Debian:12) | = 1.30-14 | No fix listed |
| debian/mini-httpd(Debian:12) | = 1.30-15 | No fix listed |
| debian/mini-httpd(Debian:12) | = 1.30-16 | No fix listed |
| debian/mini-httpd(Debian:12) | = 1.30-17 | No fix listed |
| debian/mini-httpd(Debian:12) | = 1.30-18 | No fix listed |
| debian/mini-httpd(Debian:12) | = 1.30-3 | No fix listed |
| debian/mini-httpd(Debian:12) | = 1.30-4 | No fix listed |
| debian/mini-httpd(Debian:12) | = 1.30-5 | No fix listed |
| debian/mini-httpd(Debian:12) | = 1.30-6 | No fix listed |
| debian/mini-httpd(Debian:12) | = 1.30-7 | No fix listed |
| debian/mini-httpd(Debian:12) | = 1.30-8 | No fix listed |
| debian/mini-httpd(Debian:12) | = 1.30-9 | No fix listed |
| debian/mini-httpd(Debian:13) | All versions | No fix listed |
| debian/mini-httpd(Debian:13) | = 1.30-13 | No fix listed |
| debian/mini-httpd(Debian:13) | = 1.30-14 | No fix listed |
| debian/mini-httpd(Debian:13) | = 1.30-15 | No fix listed |
| debian/mini-httpd(Debian:13) | = 1.30-16 | No fix listed |
| debian/mini-httpd(Debian:13) | = 1.30-17 | No fix listed |
| debian/mini-httpd(Debian:13) | = 1.30-18 | No fix listed |
| debian/mini-httpd(Debian:14) | All versions | No fix listed |
Show 25 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/mini-httpd(Debian:14) | = 1.30-13 | No fix listed |
| debian/mini-httpd(Debian:14) | = 1.30-14 | No fix listed |
| debian/mini-httpd(Debian:14) | = 1.30-15 | No fix listed |
| debian/mini-httpd(Debian:14) | = 1.30-16 | No fix listed |
| debian/mini-httpd(Debian:14) | = 1.30-17 | No fix listed |
| debian/mini-httpd(Debian:14) | = 1.30-18 | No fix listed |
| acme mini httpd | < 1.28 | 1.28 |
| acme thttpd | < 2.28 | 2.28 |
| alpine/mini_httpd(Alpine:v3.10) | < 1.29-r0 | 1.29-r0 |
| alpine/mini_httpd(Alpine:v3.11) | < 1.29-r0 | 1.29-r0 |
| alpine/mini_httpd(Alpine:v3.12) | < 1.29-r0 | 1.29-r0 |
| alpine/mini_httpd(Alpine:v3.13) | < 1.29-r0 | 1.29-r0 |
| alpine/mini_httpd(Alpine:v3.14) | < 1.29-r0 | 1.29-r0 |
| alpine/mini_httpd(Alpine:v3.15) | < 1.29-r0 | 1.29-r0 |
| alpine/mini_httpd(Alpine:v3.16) | < 1.29-r0 | 1.29-r0 |
| alpine/mini_httpd(Alpine:v3.17) | < 1.29-r0 | 1.29-r0 |
| alpine/mini_httpd(Alpine:v3.18) | < 1.29-r0 | 1.29-r0 |
| alpine/mini_httpd(Alpine:v3.19) | < 1.29-r0 | 1.29-r0 |
| alpine/mini_httpd(Alpine:v3.20) | < 1.29-r0 | 1.29-r0 |
| alpine/mini_httpd(Alpine:v3.21) | < 1.29-r0 | 1.29-r0 |
| alpine/mini_httpd(Alpine:v3.22) | < 1.29-r0 | 1.29-r0 |
| alpine/mini_httpd(Alpine:v3.23) | < 1.29-r0 | 1.29-r0 |
| alpine/mini_httpd(Alpine:v3.24) | < 1.29-r0 | 1.29-r0 |
| alpine/mini_httpd(Alpine:v3.8) | < 1.29-r0 | 1.29-r0 |
| alpine/mini_httpd(Alpine:v3.9) | < 1.29-r0 | 1.29-r0 |
References
- Debian Security Tracker CVE-2017-17663 vendor-advisory
- acme.com third-party-advisory
- security.alpinelinux.org vendor-advisory