The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server 2.2.17 up to and including 2.2.21, when a threaded MPM is used, does not properly handle a %{}C format string, which allows remote malicious users to cause a denial of service (daemon crash) via a cookie that lacks both a name and a value.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
apache http server 2.2.21 |
||
apache http server 2.2.17 |
||
apache http server 2.2.18 |
||
apache http server 2.2.19 |
||
apache http server 2.2.20 |
Vulmon