CVE-2017-17663
Fixed in a distro release EPSS 3%
The htpasswd implementation of mini_httpd before v1.28 and of thttpd before v2.28 is affected by a buffer overflow that can be exploited remotely to perform code execution.
Products: acme mini_httpd, acme thttpd
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | mini_httpd | 1.29-r0 |
| Alpine 3.11 | mini_httpd | 1.29-r0 |
| Alpine 3.12 | mini_httpd | 1.29-r0 |
| Alpine 3.13 | mini_httpd | 1.29-r0 |
| Alpine 3.14 | mini_httpd | 1.29-r0 |
| Alpine 3.15 | mini_httpd | 1.29-r0 |
| Alpine 3.16 | mini_httpd | 1.29-r0 |
| Alpine 3.17 | mini_httpd | 1.29-r0 |
| Alpine 3.18 | mini_httpd | 1.29-r0 |
| Alpine 3.19 | mini_httpd | 1.29-r0 |
| Alpine 3.20 | mini_httpd | 1.29-r0 |
| Alpine 3.21 | mini_httpd | 1.29-r0 |
| Alpine 3.22 | mini_httpd | 1.29-r0 |
| Alpine 3.23 | mini_httpd | 1.29-r0 |
| Alpine 3.24 | mini_httpd | 1.29-r0 |
| Alpine 3.8 | mini_httpd | 1.29-r0 |
| Alpine 3.9 | mini_httpd | 1.29-r0 |
| Debian 12 | mini-httpd | no fix |
| Debian 13 | mini-httpd | no fix |
| Debian 14 | mini-httpd | no fix |
| Ubuntu Pro 14.04 LTS | mini-httpd | no fix |
| Ubuntu Pro 16.04 LTS | mini-httpd | no fix |
| Ubuntu Pro 18.04 LTS | mini-httpd | no fix |
| openSUSE Tumbleweed | thttpd | 2.29-3.9 |