CVE-2016-8743
Description
Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution.
CWE
- (none)
Affected
- Apache Software Foundation / Apache HTTP Server — v=2.2.0 to 2.2.31, 2.4.1 to 2.4.23 [affected]
CVSS
- (none)
References
- https://support.apple.com/HT208221 x_refsource_CONFIRM
- http://www.debian.org/security/2017/dsa-3796 vendor-advisory, x_refsource_DEBIAN
- https://access.redhat.com/errata/RHSA-2017:1721 vendor-advisory, x_refsource_REDHAT
- http://www.securitytracker.com/id/1037508 vdb-entry, x_refsource_SECTRACK
- https://access.redhat.com/errata/RHSA-2017:1413 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2017:1161 vendor-advisory, x_refsource_REDHAT
- https://www.tenable.com/security/tns-2017-04 x_refsource_CONFIRM
- https://access.redhat.com/errata/RHSA-2017:1414 vendor-advisory, x_refsource_REDHAT
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbmu03753en_us x_refsource_CONFIRM
- http://www.securityfocus.com/bid/95077 vdb-entry, x_refsource_BID
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03725en_us x_refsource_CONFIRM
- http://rhn.redhat.com/errata/RHSA-2017-1415.html vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2017:0906 vendor-advisory, x_refsource_REDHAT
- https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2016-8743 x_refsource_CONFIRM
- https://security.gentoo.org/glsa/201701-36 vendor-advisory, x_refsource_GENTOO
- https://security.netapp.com/advisory/ntap-20180423-0001/ x_refsource_CONFIRM
- https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E mailing-list, x_refsource_MLIST
- https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E mailing-list, x_refsource_MLIST
- https://lists.apache.org/thread.html/8d63cb8e9100f28a99429b4328e4e7cebce861d5772ac9863ba2ae6f%40%3Ccvs.httpd.apache.org%3E mailing-list, x_refsource_MLIST
- https://lists.apache.org/thread.html/f7f95ac1cd9895db2714fa3ebaa0b94d0c6df360f742a40951384a53%40%3Ccvs.httpd.apache.org%3E mailing-list, x_refsource_MLIST
- https://lists.apache.org/thread.html/r57608dc51b79102f3952ae06f54d5277b649c86d6533dcd6a7d201f7%40%3Ccvs.httpd.apache.org%3E mailing-list, x_refsource_MLIST
- https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E mailing-list, x_refsource_MLIST
- https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E mailing-list, x_refsource_MLIST
- https://lists.apache.org/thread.html/rfbaf647d52c1cb843e726a0933f156366a806cead84fbd430951591b%40%3Ccvs.httpd.apache.org%3E mailing-list, x_refsource_MLIST
- https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E mailing-list, x_refsource_MLIST
- https://lists.apache.org/thread.html/r9ea3538f229874c80a10af473856a81fbf5f694cd7f471cc679ba70b%40%3Ccvs.httpd.apache.org%3E mailing-list, x_refsource_MLIST
- https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E mailing-list, x_refsource_MLIST
- https://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467%40%3Ccvs.httpd.apache.org%3E mailing-list, x_refsource_MLIST
- https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3Ccvs.httpd.apache.org%3E mailing-list, x_refsource_MLIST
- https://lists.apache.org/thread.html/rdca61ae990660bacb682295f2a09d34612b7bb5f457577fe17f4d064%40%3Ccvs.httpd.apache.org%3E mailing-list, x_refsource_MLIST
- https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E mailing-list, x_refsource_MLIST
- https://lists.apache.org/thread.html/r6521a7f62276340eabdb3339b2aa9a38c5f59d978497a1f794af53be%40%3Ccvs.httpd.apache.org%3E mailing-list, x_refsource_MLIST
- https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E mailing-list, x_refsource_MLIST
- https://lists.apache.org/thread.html/r94284b139540e5287ebdd3450682d3e3d187263dd6b75af8fa7d4890%40%3Ccvs.httpd.apache.org%3E mailing-list, x_refsource_MLIST
- https://lists.apache.org/thread.html/r4fe84db67fe9dc906c6185e58bbd9913f4356dd555a5c3db490694e5%40%3Ccvs.httpd.apache.org%3E mailing-list, x_refsource_MLIST
- https://lists.apache.org/thread.html/r09b8a39d1262adbab5528eea73df1b1f93e919bf004ed5a843d9cad1%40%3Ccvs.httpd.apache.org%3E mailing-list, x_refsource_MLIST
- https://lists.apache.org/thread.html/rfcb6c7b9e7ca727a7eeeb5f13f89488a03981cfa0e7c3125f18fa239%40%3Ccvs.httpd.apache.org%3E mailing-list, x_refsource_MLIST
- https://lists.apache.org/thread.html/rad01d817195e6cc871cb1d73b207ca326379a20a6e7f30febaf56d24%40%3Ccvs.httpd.apache.org%3E mailing-list, x_refsource_MLIST
- https://lists.apache.org/thread.html/r476d175be0aaf4a17680ef98c5153b4d336eaef76fb2224cc94c463a%40%3Ccvs.httpd.apache.org%3E mailing-list, x_refsource_MLIST
- https://lists.apache.org/thread.html/r75cbe9ea3e2114e4271bbeca7aff96117b50c1b6eb7c4772b0337c1f%40%3Ccvs.httpd.apache.org%3E mailing-list, x_refsource_MLIST
Source
cvelistV5-main/cves/2016/8xxx/CVE-2016-8743.json