CVE-2013-5704
Fixed in a distro release EPSS 58%
The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."
Products: apache http_server, redhat enterprise_linux_desktop, redhat enterprise_linux_eus, redhat enterprise_linux_server, redhat enterprise_linux_server_aus, redhat enterprise_linux_server_tus, redhat enterprise_linux_workstation, redhat jboss_enterprise_web_server, oracle enterprise_manager_ops_center, oracle http_server, oracle linux, oracle solaris, apple mac_os_x, apple mac_os_x_server, canonical ubuntu_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | apache2 | 2.4.10-2 |
| Debian 13 | apache2 | 2.4.10-2 |
| Debian 14 | apache2 | 2.4.10-2 |
| Debian 6.0 | apache2 | 2.2.16-6+squeeze14 |
| Red Hat Enterprise Linux 6 | httpd | 0:2.2.15-45.el6 |
| Red Hat Enterprise Linux 6 | httpd-debuginfo | 0:2.2.15-45.el6 |
| Red Hat Enterprise Linux 6 | httpd-devel | 0:2.2.15-45.el6 |
| Red Hat Enterprise Linux 6 | httpd-manual | 0:2.2.15-45.el6 |
| Red Hat Enterprise Linux 6 | httpd-tools | 0:2.2.15-45.el6 |
| Red Hat Enterprise Linux 6 | mod_ssl | 1:2.2.15-45.el6 |
| Red Hat Enterprise Linux 7 | httpd | 0:2.4.6-31.el7 |
| Red Hat Enterprise Linux 7 | httpd-debuginfo | 0:2.4.6-31.el7 |
| Red Hat Enterprise Linux 7 | httpd-devel | 0:2.4.6-31.el7 |
| Red Hat Enterprise Linux 7 | httpd-manual | 0:2.4.6-31.el7 |
| Red Hat Enterprise Linux 7 | httpd-tools | 0:2.4.6-31.el7 |
| Red Hat Enterprise Linux 7 | mod_ldap | 0:2.4.6-31.el7 |
| Red Hat Enterprise Linux 7 | mod_proxy_html | 1:2.4.6-31.el7 |
| Red Hat Enterprise Linux 7 | mod_session | 0:2.4.6-31.el7 |
| Red Hat Enterprise Linux 7 | mod_ssl | 1:2.4.6-31.el7 |
| Red Hat jboss enterprise web server 2 | httpd | 0:2.2.26-41.ep6.el6 |
| Red Hat jboss enterprise web server 2 | httpd | 0:2.2.26-41.ep6.el5 |
| Red Hat jboss enterprise web server 2 | httpd-debuginfo | 0:2.2.26-41.ep6.el6 |
| Red Hat jboss enterprise web server 2 | httpd-devel | 0:2.2.26-41.ep6.el6 |
| Red Hat jboss enterprise web server 2 | httpd-devel | 0:2.2.26-41.ep6.el5 |
| Red Hat jboss enterprise web server 2 | httpd-manual | 0:2.2.26-41.ep6.el6 |
| Red Hat jboss enterprise web server 2 | httpd-manual | 0:2.2.26-41.ep6.el5 |
| Red Hat jboss enterprise web server 2 | httpd-tools | 0:2.2.26-41.ep6.el6 |
| Red Hat jboss enterprise web server 2 | httpd-tools | 0:2.2.26-41.ep6.el5 |
| Red Hat jboss enterprise web server 2 | httpd22 | 0:2.2.26-42.ep6.el7 |
| Red Hat jboss enterprise web server 2 | httpd22-debuginfo | 0:2.2.26-42.ep6.el7 |
| Red Hat jboss enterprise web server 2 | httpd22-devel | 0:2.2.26-42.ep6.el7 |
| Red Hat jboss enterprise web server 2 | httpd22-manual | 0:2.2.26-42.ep6.el7 |
| Red Hat jboss enterprise web server 2 | httpd22-tools | 0:2.2.26-42.ep6.el7 |
| Red Hat jboss enterprise web server 2 | mod_cluster-native | 0:1.2.9-6.Final_redhat_2.ep6.el5 |
| Red Hat jboss enterprise web server 2 | mod_cluster-native | 0:1.2.9-6.Final_redhat_2.ep6.el7 |
| Red Hat jboss enterprise web server 2 | mod_cluster-native | 0:1.2.9-6.Final_redhat_2.ep6.el6 |
| Red Hat jboss enterprise web server 2 | mod_cluster-native-debuginfo | 0:1.2.9-6.Final_redhat_2.ep6.el7 |
| Red Hat jboss enterprise web server 2 | mod_cluster-native-debuginfo | 0:1.2.9-6.Final_redhat_2.ep6.el6 |
| Red Hat jboss enterprise web server 2 | mod_ssl | 1:2.2.26-41.ep6.el5 |
| Red Hat jboss enterprise web server 2 | mod_ssl | 1:2.2.26-41.ep6.el6 |
| Red Hat jboss enterprise web server 2 | mod_ssl22 | 1:2.2.26-42.ep6.el7 |
| Red Hat jboss enterprise web server 3.0 | apache-commons-collections-eap6 | 0:3.2.1-18.redhat_7.1.ep6.el6 |
| Red Hat jboss enterprise web server 3.0 | apache-commons-collections-eap6 | 0:3.2.1-18.redhat_7.1.ep6.el7 |
| Red Hat jboss enterprise web server 3.0 | apache-commons-collections-tomcat-eap6 | 0:3.2.1-18.redhat_7.1.ep6.el6 |
| Red Hat jboss enterprise web server 3.0 | apache-commons-collections-tomcat-eap6 | 0:3.2.1-18.redhat_7.1.ep6.el7 |
| Red Hat jboss enterprise web server 3.0 | httpd24 | 0:2.4.6-59.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | httpd24 | 0:2.4.6-59.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | httpd24-debuginfo | 0:2.4.6-59.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | httpd24-debuginfo | 0:2.4.6-59.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | httpd24-devel | 0:2.4.6-59.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | httpd24-devel | 0:2.4.6-59.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | httpd24-manual | 0:2.4.6-59.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | httpd24-manual | 0:2.4.6-59.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | httpd24-tools | 0:2.4.6-59.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | httpd24-tools | 0:2.4.6-59.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | mod_bmx | 0:0.9.5-7.GA.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | mod_bmx | 0:0.9.5-7.GA.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | mod_bmx-debuginfo | 0:0.9.5-7.GA.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | mod_bmx-debuginfo | 0:0.9.5-7.GA.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | mod_cluster-native | 0:1.3.1-6.Final_redhat_2.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | mod_cluster-native | 0:1.3.1-6.Final_redhat_2.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | mod_cluster-native-debuginfo | 0:1.3.1-6.Final_redhat_2.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | mod_cluster-native-debuginfo | 0:1.3.1-6.Final_redhat_2.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | mod_ldap24 | 0:2.4.6-59.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | mod_ldap24 | 0:2.4.6-59.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | mod_proxy24_html | 1:2.4.6-59.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | mod_proxy24_html | 1:2.4.6-59.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | mod_session24 | 0:2.4.6-59.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | mod_session24 | 0:2.4.6-59.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | mod_ssl24 | 1:2.4.6-59.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | mod_ssl24 | 1:2.4.6-59.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat-vault | 0:1.0.8-4.Final_redhat_4.1.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat-vault | 0:1.0.8-4.Final_redhat_4.1.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat7 | 0:7.0.59-42_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat7 | 0:7.0.59-42_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-admin-webapps | 0:7.0.59-42_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-admin-webapps | 0:7.0.59-42_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-docs-webapp | 0:7.0.59-42_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-docs-webapp | 0:7.0.59-42_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-el-2.2-api | 0:7.0.59-42_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-el-2.2-api | 0:7.0.59-42_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-javadoc | 0:7.0.59-42_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-javadoc | 0:7.0.59-42_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-jsp-2.2-api | 0:7.0.59-42_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-jsp-2.2-api | 0:7.0.59-42_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-lib | 0:7.0.59-42_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-lib | 0:7.0.59-42_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-log4j | 0:7.0.59-42_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-log4j | 0:7.0.59-42_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-servlet-3.0-api | 0:7.0.59-42_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-servlet-3.0-api | 0:7.0.59-42_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-webapps | 0:7.0.59-42_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat7-webapps | 0:7.0.59-42_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat8 | 0:8.0.18-52_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat8 | 0:8.0.18-52_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-admin-webapps | 0:8.0.18-52_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-admin-webapps | 0:8.0.18-52_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-docs-webapp | 0:8.0.18-52_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-docs-webapp | 0:8.0.18-52_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-el-2.2-api | 0:8.0.18-52_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-el-2.2-api | 0:8.0.18-52_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-javadoc | 0:8.0.18-52_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-javadoc | 0:8.0.18-52_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-jsp-2.3-api | 0:8.0.18-52_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-jsp-2.3-api | 0:8.0.18-52_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-lib | 0:8.0.18-52_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-lib | 0:8.0.18-52_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-log4j | 0:8.0.18-52_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-log4j | 0:8.0.18-52_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-servlet-3.1-api | 0:8.0.18-52_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-servlet-3.1-api | 0:8.0.18-52_patch_01.ep7.el7 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-webapps | 0:8.0.18-52_patch_01.ep7.el6 |
| Red Hat jboss enterprise web server 3.0 | tomcat8-webapps | 0:8.0.18-52_patch_01.ep7.el7 |
| Red Hat rhel software collections 1 | httpd24-httpd | 0:2.4.6-22.el6 |
| Red Hat rhel software collections 1 | httpd24-httpd | 0:2.4.6-25.el7 |
| Red Hat rhel software collections 1 | httpd24-httpd-debuginfo | 0:2.4.6-22.el6 |
| Red Hat rhel software collections 1 | httpd24-httpd-debuginfo | 0:2.4.6-25.el7 |
| Red Hat rhel software collections 1 | httpd24-httpd-devel | 0:2.4.6-22.el6 |
| Red Hat rhel software collections 1 | httpd24-httpd-devel | 0:2.4.6-25.el7 |
| Red Hat rhel software collections 1 | httpd24-httpd-manual | 0:2.4.6-25.el7 |
| Red Hat rhel software collections 1 | httpd24-httpd-manual | 0:2.4.6-22.el6 |
| Red Hat rhel software collections 1 | httpd24-httpd-tools | 0:2.4.6-22.el6 |
| Red Hat rhel software collections 1 | httpd24-httpd-tools | 0:2.4.6-25.el7 |
| Red Hat rhel software collections 1 | httpd24-mod_ldap | 0:2.4.6-25.el7 |
| Red Hat rhel software collections 1 | httpd24-mod_ldap | 0:2.4.6-22.el6 |
| Red Hat rhel software collections 1 | httpd24-mod_proxy_html | 1:2.4.6-22.el6 |
| Red Hat rhel software collections 1 | httpd24-mod_proxy_html | 1:2.4.6-25.el7 |
| Red Hat rhel software collections 1 | httpd24-mod_session | 0:2.4.6-22.el6 |
| Red Hat rhel software collections 1 | httpd24-mod_session | 0:2.4.6-25.el7 |
| Red Hat rhel software collections 1 | httpd24-mod_ssl | 1:2.4.6-22.el6 |
| Red Hat rhel software collections 1 | httpd24-mod_ssl | 1:2.4.6-25.el7 |
| SUSE Linux Enterprise Server 12 | apache2 | 2.4.10-12.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | apache2 | 2.4.10-12.1 |
| SUSE Linux Enterprise Software Development Kit 12 | apache2 | 2.4.10-12.1 |
| Ubuntu 14.04 LTS | apache2 | 2.4.7-1ubuntu4.4 |
| openSUSE Tumbleweed | apache2 | 2.4.23-4.1 |