CVE-2016-8743

Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
apache2	17.04 zesty	Not affected
	16.10 yakkety	Fixed 2.4.18-2ubuntu4.1
	16.04 LTS xenial	Fixed 2.4.18-2ubuntu3.2
	14.04 LTS trusty	Fixed 2.4.7-1ubuntu4.15
	12.04 LTS precise	Ignored end of life

Notes

ratliff

Notes from Debian "The fix is not fully backwards compatible so upstream have created a new option to control this behaviour. Affects: 2.2.0 to 2.4.23."

mdeslaur

This fix no longer allows underscores in host names. Debian added a patch to restore the behaviour: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851357 http://mail-archives.apache.org/mod_mbox/httpd-dev/201702.mbox/%3C20170202125319.GA15948%40redhat.com%3E The new configuration option doesn't entirely preserve backwards compatibility: https://bz.apache.org/bugzilla/show_bug.cgi?id=60783

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
apache2	Upstream: https://svn.apache.org/r1668879 Upstream: https://svn.apache.org/r1743516 Upstream: https://svn.apache.org/r1773801 Upstream: https://svn.apache.org/r1772678 Upstream: https://svn.apache.org/r1773802 Upstream: https://svn.apache.org/r1773803 Upstream: https://svn.apache.org/r1773995 Upstream: https://svn.apache.org/r1774429 Upstream: https://svn.apache.org/r1778052

Severity score breakdown

Parameter	Value
Base score	7.5 · High
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	High
Availability impact	None
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Cvss 3 Severity Score

Status

Notes

ratliff

mdeslaur

Patch details

Severity score breakdown

References

Related Ubuntu Security Notices (USN)

Other references