Vulnerability Details : CVE-2017-7443
apt-cacher before 1.7.15 and apt-cacher-ng before 3.4 allow HTTP response splitting via encoded newline characters, related to lack of blocking for the %0[ad] regular expression.
Products affected by CVE-2017-7443
- cpe:2.3:a:apt-cacher_project:apt-cacher:*:*:*:*:*:*:*:*
- cpe:2.3:a:apt-cacher-ng_project:apt-cacher-ng:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-7443
0.08%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 34 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-7443
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST | |
6.1
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
2.8
|
2.7
|
NIST |
CWE ids for CVE-2017-7443
-
The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-7443
-
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=858833
#858833 - apt-cacher-ng: CVE-2017-7443: HTTP response splitting - Debian Bug report logsPatch;Third Party Advisory
-
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=858739
#858739 - apt-cacher: CVE-2017-7443: HTTP response splitting - Debian Bug report logsPatch;Third Party Advisory
Jump to