CVE-2015-3183: Input Validation
Apache HTTP Server 2.4.16 release fixes the following issue:
) SECURITY: CVE-2015-3183 (cve.mitre.org) core: Fix chunk header parsing defect. Remove aprbrigadeflatten(), buffering and duplicated code from the HTTPIN filter, parse chunks in a single pass with zero copy. Limit accepted chunk-size to 2^63-1 and be strict about chunk-ext authorized characters. [Graham Leggett, Yann Ylavic]
External References:
http://www.apache.org/dist/httpd/CHANGES2.4.16
Other sources
The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid chunk-extension characters in modules/http/httpfilters.c.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-3183?
CVE-2015-3183 is classified as a medium severity vulnerability that affects chunk header parsing in Apache HTTP Server.
How do I fix CVE-2015-3183?
To fix CVE-2015-3183, update your Apache HTTP Server to version 2.4.16 or later, or version 2.2.31 or later.
Which versions of Apache HTTP Server are affected by CVE-2015-3183?
CVE-2015-3183 affects Apache HTTP Server versions prior to 2.4.16 and versions prior to 2.2.31.
What type of security issue is represented by CVE-2015-3183?
CVE-2015-3183 represents a core security issue related to defect in chunk header parsing.
Is there a known workaround for CVE-2015-3183?
There are no known workarounds for CVE-2015-3183, and the recommended action is to update to a secure version.