CVE-2016-8743

Published: 22 December 2016

Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution.

Priority

Medium

CVSS 3 base score: 7.5

Status

Package Release Status
apache2
Launchpad, Ubuntu, Debian
Upstream
Released (2.4.25-1)
Ubuntu 16.04 ESM (Xenial Xerus)
Released (2.4.18-2ubuntu3.2)
Ubuntu 14.04 ESM (Trusty Tahr)
Released (2.4.7-1ubuntu4.14)
Patches:
Upstream: https://svn.apache.org/r1668879 (2.4 bp, trusty)
Upstream: https://svn.apache.org/r1743516 (2.4 bp)
Upstream: https://svn.apache.org/r1773801 (2.4 bp)
Upstream: https://svn.apache.org/r1772678 (2.4)
Upstream: https://svn.apache.org/r1773802 (2.4)
Upstream: https://svn.apache.org/r1773803 (2.4)
Upstream: https://svn.apache.org/r1773995 (2.4)
Upstream: https://svn.apache.org/r1774429 (2.4)
Upstream: https://svn.apache.org/r1778052 (2.4)

Notes

AuthorNote
ratliff
Notes from Debian "The fix is not fully backwards compatible so
upstream have created a new option to control this behaviour.
Affects: 2.2.0 to 2.4.23."
mdeslaur
This fix no longer allows underscores in host names. Debian
added a patch to restore the behaviour:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851357
http://mail-archives.apache.org/mod_mbox/httpd-dev/201702.mbox/%3C20170202125319.GA15948%40redhat.com%3E

The new configuration option doesn't entirely preserve
backwards compatibility:
https://bz.apache.org/bugzilla/show_bug.cgi?id=60783

References

Bugs