First published: Tue Dec 20 2016(Updated: )
Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution.
Credit: CVE-2016-0736 CVE-2016-2161 CVE-2016-5387 CVE-2016-8740 CVE-2016-8743 CVE-2017-3167 CVE-2017-3169 CVE-2017-7659 CVE-2017-7668 CVE-2017-7679 CVE-2017-9788 CVE-2017-9789 security@apache.org
Affected Software | Affected Version | How to fix |
---|---|---|
redhat/jbcs-httpd24-httpd | <0:2.4.23-120.jbcs.el6 | 0:2.4.23-120.jbcs.el6 |
redhat/jbcs-httpd24-openssl | <1:1.0.2h-13.jbcs.el6 | 1:1.0.2h-13.jbcs.el6 |
redhat/jbcs-httpd24-httpd | <0:2.4.23-120.jbcs.el7 | 0:2.4.23-120.jbcs.el7 |
redhat/jbcs-httpd24-openssl | <1:1.0.2h-13.jbcs.el7 | 1:1.0.2h-13.jbcs.el7 |
redhat/httpd | <0:2.2.15-60.el6_9.4 | 0:2.2.15-60.el6_9.4 |
redhat/httpd | <0:2.4.6-45.el7_3.4 | 0:2.4.6-45.el7_3.4 |
redhat/httpd24-httpd | <0:2.4.25-9.el6 | 0:2.4.25-9.el6 |
redhat/httpd24-httpd | <0:2.4.25-9.el7 | 0:2.4.25-9.el7 |
redhat/httpd | <2.4.25 | 2.4.25 |
macOS High Sierra | <10.13 | 10.13 |
macOS High Sierra | <10.13.1 | 10.13.1 |
macOS High Sierra | ||
Apple El Capitan | ||
Apache Http Server | >=2.2.0<=2.2.31 | |
Apache Http Server | >=2.4.1<=2.4.23 | |
IBM Data ONTAP | ||
NetApp OnCommand Unified Manager for 7-Mode | ||
Debian Linux | =8.0 | |
Debian Linux | =9.0 | |
Red Hat Enterprise Linux Desktop | =6.0 | |
Red Hat Enterprise Linux Desktop | =7.0 | |
Red Hat Enterprise Linux Server EUS | =7.3 | |
Red Hat Enterprise Linux Server EUS | =7.4 | |
Red Hat Enterprise Linux Server EUS | =7.5 | |
Red Hat Enterprise Linux Server EUS | =7.6 | |
Red Hat Enterprise Linux Server EUS | =7.7 | |
Red Hat Enterprise Linux Server | =6.0 | |
Red Hat Enterprise Linux Server | =7.0 | |
Red Hat Enterprise Linux Server | =7.3 | |
Red Hat Enterprise Linux Server | =7.4 | |
Red Hat Enterprise Linux Server | =7.6 | |
Red Hat Enterprise Linux Server | =7.7 | |
Red Hat Enterprise Linux Server | =7.3 | |
Red Hat Enterprise Linux Server | =7.6 | |
Red Hat Enterprise Linux Server | =7.7 | |
Red Hat Enterprise Linux Workstation | =6.0 | |
Red Hat Enterprise Linux Workstation | =7.0 | |
Red Hat JBoss Core Services | =1.0 | |
Red Hat Enterprise Linux | =6.0 | |
Red Hat Enterprise Linux | =7.0 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
(Appears in the following advisories)
(Found alongside the following vulnerabilities)
CVE-2016-8743 is a vulnerability in Apache HTTP Server versions prior to 2.2.32 and 2.4.25.
CVE-2016-8743 has a severity rating of 7.5 (high).
The affected software of CVE-2016-8743 includes Apache HTTP Server versions prior to 2.2.32 and 2.4.25.
To fix CVE-2016-8743, you need to update your Apache HTTP Server to version 2.4.27 or later.
You can find more information about CVE-2016-8743 on the official Apache HTTP Server website and the Red Hat Bugzilla website.