CVE-2016-8743
High · 7.5CVSS
7.5
EPSS
13.3%
Published
Jul 27, 2017
CISA due date
—
The record
Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | apache2 | 0 | 2.4.25-1 |
| Debian:12 | apache2 | 0 | 2.4.25-1 |
| Debian:13 | apache2 | 0 | 2.4.25-1 |
| Debian:7 | apache2 | 0 | 2.2.22-13+deb7u8 |
| Debian:7 | apache2 | 0 | 2.2.22-13+deb7u11 |
| Debian:8 | apache2 | 0 | 2.4.10-10+deb8u8 |
| Mageia:5 | apache | 0 | 2.4.10-16.7.mga5 |
| Red Hat:enterprise_linux:6::client | httpd | 0 | 0:2.2.15-60.el6_9.4 |
| Red Hat:enterprise_linux:6::client | httpd-debuginfo | 0 | 0:2.2.15-60.el6_9.4 |
| Red Hat:enterprise_linux:6::client | httpd-devel | 0 | 0:2.2.15-60.el6_9.4 |
| Red Hat:enterprise_linux:6::client | httpd-manual | 0 | 0:2.2.15-60.el6_9.4 |
| Red Hat:enterprise_linux:6::client | httpd-tools | 0 | 0:2.2.15-60.el6_9.4 |
| Red Hat:enterprise_linux:6::client | mod_ssl | 0 | 1:2.2.15-60.el6_9.4 |
| Red Hat:enterprise_linux:6::computenode | httpd | 0 | 0:2.2.15-60.el6_9.4 |
| Red Hat:enterprise_linux:6::computenode | httpd-debuginfo | 0 | 0:2.2.15-60.el6_9.4 |
| Red Hat:enterprise_linux:6::computenode | httpd-devel | 0 | 0:2.2.15-60.el6_9.4 |
| Red Hat:enterprise_linux:6::computenode | httpd-manual | 0 | 0:2.2.15-60.el6_9.4 |
| Red Hat:enterprise_linux:6::computenode | httpd-tools | 0 | 0:2.2.15-60.el6_9.4 |
| Red Hat:enterprise_linux:6::computenode | mod_ssl | 0 | 1:2.2.15-60.el6_9.4 |
| Red Hat:enterprise_linux:6::server | httpd | 0 | 0:2.2.15-60.el6_9.4 |
| Red Hat:enterprise_linux:6::server | httpd-debuginfo | 0 | 0:2.2.15-60.el6_9.4 |
| Red Hat:enterprise_linux:6::server | httpd-devel | 0 | 0:2.2.15-60.el6_9.4 |
| Red Hat:enterprise_linux:6::server | httpd-manual | 0 | 0:2.2.15-60.el6_9.4 |
| Red Hat:enterprise_linux:6::server | httpd-tools | 0 | 0:2.2.15-60.el6_9.4 |
| Red Hat:enterprise_linux:6::server | mod_ssl | 0 | 1:2.2.15-60.el6_9.4 |
| Red Hat:enterprise_linux:6::workstation | httpd | 0 | 0:2.2.15-60.el6_9.4 |
| Red Hat:enterprise_linux:6::workstation | httpd-debuginfo | 0 | 0:2.2.15-60.el6_9.4 |
| Red Hat:enterprise_linux:6::workstation | httpd-devel | 0 | 0:2.2.15-60.el6_9.4 |
| Red Hat:enterprise_linux:6::workstation | httpd-manual | 0 | 0:2.2.15-60.el6_9.4 |
| Red Hat:enterprise_linux:6::workstation | httpd-tools | 0 | 0:2.2.15-60.el6_9.4 |
| Red Hat:enterprise_linux:6::workstation | mod_ssl | 0 | 1:2.2.15-60.el6_9.4 |
| Red Hat:enterprise_linux:7::client | httpd | 0 | 0:2.4.6-45.el7_3.4 |
| Red Hat:enterprise_linux:7::client | httpd-debuginfo | 0 | 0:2.4.6-45.el7_3.4 |
| Red Hat:enterprise_linux:7::client | httpd-devel | 0 | 0:2.4.6-45.el7_3.4 |
| Red Hat:enterprise_linux:7::client | httpd-manual | 0 | 0:2.4.6-45.el7_3.4 |
| Red Hat:enterprise_linux:7::client | httpd-tools | 0 | 0:2.4.6-45.el7_3.4 |
| Red Hat:enterprise_linux:7::client | mod_ldap | 0 | 0:2.4.6-45.el7_3.4 |
| Red Hat:enterprise_linux:7::client | mod_proxy_html | 0 | 1:2.4.6-45.el7_3.4 |
| Red Hat:enterprise_linux:7::client | mod_session | 0 | 0:2.4.6-45.el7_3.4 |
| Red Hat:enterprise_linux:7::client | mod_ssl | 0 | 1:2.4.6-45.el7_3.4 |
| Red Hat:enterprise_linux:7::computenode | httpd | 0 | 0:2.4.6-45.el7_3.4 |
| Red Hat:enterprise_linux:7::computenode | httpd-debuginfo | 0 | 0:2.4.6-45.el7_3.4 |
| Red Hat:enterprise_linux:7::computenode | httpd-devel | 0 | 0:2.4.6-45.el7_3.4 |
| Red Hat:enterprise_linux:7::computenode | httpd-manual | 0 | 0:2.4.6-45.el7_3.4 |
| Red Hat:enterprise_linux:7::computenode | httpd-tools | 0 | 0:2.4.6-45.el7_3.4 |
| Red Hat:enterprise_linux:7::computenode | mod_ldap | 0 | 0:2.4.6-45.el7_3.4 |
| Red Hat:enterprise_linux:7::computenode | mod_proxy_html | 0 | 1:2.4.6-45.el7_3.4 |
| Red Hat:enterprise_linux:7::computenode | mod_session | 0 | 0:2.4.6-45.el7_3.4 |
| Red Hat:enterprise_linux:7::computenode | mod_ssl | 0 | 1:2.4.6-45.el7_3.4 |
| Red Hat:enterprise_linux:7::server | httpd | 0 | 0:2.4.6-45.el7_3.4 |
| Red Hat:enterprise_linux:7::server | httpd-debuginfo | 0 | 0:2.4.6-45.el7_3.4 |
| Red Hat:enterprise_linux:7::server | httpd-devel | 0 | 0:2.4.6-45.el7_3.4 |
| Red Hat:enterprise_linux:7::server | httpd-manual | 0 | 0:2.4.6-45.el7_3.4 |
| Red Hat:enterprise_linux:7::server | httpd-tools | 0 | 0:2.4.6-45.el7_3.4 |
| Red Hat:enterprise_linux:7::server | mod_ldap | 0 | 0:2.4.6-45.el7_3.4 |
| Red Hat:enterprise_linux:7::server | mod_proxy_html | 0 | 1:2.4.6-45.el7_3.4 |
| Red Hat:enterprise_linux:7::server | mod_session | 0 | 0:2.4.6-45.el7_3.4 |
| Red Hat:enterprise_linux:7::server | mod_ssl | 0 | 1:2.4.6-45.el7_3.4 |
| Red Hat:enterprise_linux:7::workstation | httpd | 0 | 0:2.4.6-45.el7_3.4 |
| Red Hat:enterprise_linux:7::workstation | httpd-debuginfo | 0 | 0:2.4.6-45.el7_3.4 |
| Red Hat:enterprise_linux:7::workstation | httpd-devel | 0 | 0:2.4.6-45.el7_3.4 |
| Red Hat:enterprise_linux:7::workstation | httpd-manual | 0 | 0:2.4.6-45.el7_3.4 |
| Red Hat:enterprise_linux:7::workstation | httpd-tools | 0 | 0:2.4.6-45.el7_3.4 |
| Red Hat:enterprise_linux:7::workstation | mod_ldap | 0 | 0:2.4.6-45.el7_3.4 |
| Red Hat:enterprise_linux:7::workstation | mod_proxy_html | 0 | 1:2.4.6-45.el7_3.4 |
| Red Hat:enterprise_linux:7::workstation | mod_session | 0 | 0:2.4.6-45.el7_3.4 |
| Red Hat:enterprise_linux:7::workstation | mod_ssl | 0 | 1:2.4.6-45.el7_3.4 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-httpd | 0 | 0:2.4.23-120.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-httpd-debuginfo | 0 | 0:2.4.23-120.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-httpd-devel | 0 | 0:2.4.23-120.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-httpd-libs | 0 | 0:2.4.23-120.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-httpd-manual | 0 | 0:2.4.23-120.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-httpd-selinux | 0 | 0:2.4.23-120.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-httpd-tools | 0 | 0:2.4.23-120.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-mod_ldap | 0 | 0:2.4.23-120.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-mod_proxy_html | 0 | 1:2.4.23-120.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-mod_security | 0 | 0:2.9.1-19.GA.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-mod_security-debuginfo | 0 | 0:2.9.1-19.GA.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-mod_session | 0 | 0:2.4.23-120.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-mod_ssl | 0 | 1:2.4.23-120.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-openssl | 0 | 1:1.0.2h-13.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-openssl-debuginfo | 0 | 1:1.0.2h-13.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-openssl-devel | 0 | 1:1.0.2h-13.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-openssl-libs | 0 | 1:1.0.2h-13.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-openssl-perl | 0 | 1:1.0.2h-13.jbcs.el6 |
| Red Hat:jboss_core_services:1::el6 | jbcs-httpd24-openssl-static | 0 | 1:1.0.2h-13.jbcs.el6 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-httpd | 0 | 0:2.4.23-120.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-httpd-debuginfo | 0 | 0:2.4.23-120.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-httpd-devel | 0 | 0:2.4.23-120.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-httpd-libs | 0 | 0:2.4.23-120.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-httpd-manual | 0 | 0:2.4.23-120.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-httpd-selinux | 0 | 0:2.4.23-120.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-httpd-tools | 0 | 0:2.4.23-120.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-mod_ldap | 0 | 0:2.4.23-120.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-mod_proxy_html | 0 | 1:2.4.23-120.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-mod_security | 0 | 0:2.9.1-19.GA.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-mod_security-debuginfo | 0 | 0:2.9.1-19.GA.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-mod_session | 0 | 0:2.4.23-120.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-mod_ssl | 0 | 1:2.4.23-120.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-openssl | 0 | 1:1.0.2h-13.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-openssl-debuginfo | 0 | 1:1.0.2h-13.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-openssl-devel | 0 | 1:1.0.2h-13.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-openssl-libs | 0 | 1:1.0.2h-13.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-openssl-perl | 0 | 1:1.0.2h-13.jbcs.el7 |
| Red Hat:jboss_core_services:1::el7 | jbcs-httpd24-openssl-static | 0 | 1:1.0.2h-13.jbcs.el7 |
| Red Hat:rhel_software_collections:2::el6 | httpd24-httpd | 0 | 0:2.4.25-9.el6 |
| Red Hat:rhel_software_collections:2::el6 | httpd24-httpd-debuginfo | 0 | 0:2.4.25-9.el6 |
| Red Hat:rhel_software_collections:2::el6 | httpd24-httpd-devel | 0 | 0:2.4.25-9.el6 |
| Red Hat:rhel_software_collections:2::el6 | httpd24-httpd-manual | 0 | 0:2.4.25-9.el6 |
| Red Hat:rhel_software_collections:2::el6 | httpd24-httpd-tools | 0 | 0:2.4.25-9.el6 |
| Red Hat:rhel_software_collections:2::el6 | httpd24-mod_ldap | 0 | 0:2.4.25-9.el6 |
| Red Hat:rhel_software_collections:2::el6 | httpd24-mod_proxy_html | 0 | 1:2.4.25-9.el6 |
| Red Hat:rhel_software_collections:2::el6 | httpd24-mod_session | 0 | 0:2.4.25-9.el6 |
| Red Hat:rhel_software_collections:2::el6 | httpd24-mod_ssl | 0 | 1:2.4.25-9.el6 |
| Red Hat:rhel_software_collections:2::el7 | httpd24-httpd | 0 | 0:2.4.25-9.el7 |
| Red Hat:rhel_software_collections:2::el7 | httpd24-httpd-debuginfo | 0 | 0:2.4.25-9.el7 |
| Red Hat:rhel_software_collections:2::el7 | httpd24-httpd-devel | 0 | 0:2.4.25-9.el7 |
| Red Hat:rhel_software_collections:2::el7 | httpd24-httpd-manual | 0 | 0:2.4.25-9.el7 |
| Red Hat:rhel_software_collections:2::el7 | httpd24-httpd-tools | 0 | 0:2.4.25-9.el7 |
| Red Hat:rhel_software_collections:2::el7 | httpd24-mod_ldap | 0 | 0:2.4.25-9.el7 |
| Red Hat:rhel_software_collections:2::el7 | httpd24-mod_proxy_html | 0 | 1:2.4.25-9.el7 |
| Red Hat:rhel_software_collections:2::el7 | httpd24-mod_session | 0 | 0:2.4.25-9.el7 |
| Red Hat:rhel_software_collections:2::el7 | httpd24-mod_ssl | 0 | 1:2.4.25-9.el7 |
| SUSE:Enterprise Storage 4 | apache2 | 0 | 2.4.23-29.24.1 |
| SUSE:Linux Enterprise Server 11 SP4 | apache2 | 0 | 2.2.12-69.1 |
| SUSE:Linux Enterprise Server 12 SP1 | apache2 | 0 | 2.4.16-19.1 |
| SUSE:Linux Enterprise Server 12 SP1-LTSS | apache2 | 0 | 2.4.16-20.19.1 |
| SUSE:Linux Enterprise Server 12 SP2 | apache2 | 0 | 2.4.23-21.1 |
| SUSE:Linux Enterprise Server 12 SP2-BCL | apache2 | 0 | 2.4.23-29.24.1 |
| SUSE:Linux Enterprise Server 12 SP2-LTSS | apache2 | 0 | 2.4.23-29.24.1 |
| SUSE:Linux Enterprise Server 12 SP3 | apache2 | 0 | 2.4.23-29.24.1 |
| SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 | apache2 | 0 | 2.4.23-21.1 |
| SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | apache2 | 0 | 2.2.12-69.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | apache2 | 0 | 2.4.16-19.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | apache2 | 0 | 2.4.16-20.19.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | apache2 | 0 | 2.4.23-21.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | apache2 | 0 | 2.4.23-29.24.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | apache2 | 0 | 2.4.23-29.24.1 |
| SUSE:Linux Enterprise Software Development Kit 11 SP4 | apache2 | 0 | 2.2.12-69.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP1 | apache2 | 0 | 2.4.16-19.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP2 | apache2 | 0 | 2.4.23-21.1 |
| SUSE:Linux Enterprise Software Development Kit 12 SP3 | apache2 | 0 | 2.4.23-29.24.1 |
| SUSE:OpenStack Cloud 7 | apache2 | 0 | 2.4.23-29.24.1 |
| SUSE:Studio Onsite 1.3 | apache2 | 0 | 2.2.12-69.1 |
| Ubuntu:14.04:LTS | apache2 | 0 | 2.4.7-1ubuntu4.15 |
| Ubuntu:16.04:LTS | apache2 | 0 | 2.4.18-2ubuntu3.2 |
Related vulnerabilities
- CVE-2017-9798 Apache httpd allows remote attackers to read secret data from process memory if the Limit… Also affects apache2
- CVE-2016-0736 In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its… Also affects apache2
- CVE-2016-2161 In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can… Also affects apache2
- CVE-2017-7659 A maliciously constructed HTTP/2 request could cause mod_http2 in Apache HTTP Server… Also affects apache2
- CVE-2017-9788 In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in… Also affects apache2
- CVE-2017-7679 In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte… Also affects apache2
- CVE-2017-7668 The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug… Also affects apache2
- CVE-2017-3169 In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a… Also affects apache2