CVE-2016-8743
Fixed in a distro release EPSS 13%
Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution.
Products: Apache Software Foundation Apache HTTP Server
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | apache2 | 2.4.25-1 |
| Debian 13 | apache2 | 2.4.25-1 |
| Debian 14 | apache2 | 2.4.25-1 |
| Debian 7 | apache2 | 2.2.22-13+deb7u8 |
| Debian 7 | apache2 | 2.2.22-13+deb7u11 |
| Debian 8 | apache2 | 2.4.10-10+deb8u8 |
| Red Hat Enterprise Linux 6 | httpd | 0:2.2.15-60.el6_9.4 |
| Red Hat Enterprise Linux 6 | httpd-debuginfo | 0:2.2.15-60.el6_9.4 |
| Red Hat Enterprise Linux 6 | httpd-devel | 0:2.2.15-60.el6_9.4 |
| Red Hat Enterprise Linux 6 | httpd-manual | 0:2.2.15-60.el6_9.4 |
| Red Hat Enterprise Linux 6 | httpd-tools | 0:2.2.15-60.el6_9.4 |
| Red Hat Enterprise Linux 6 | mod_ssl | 1:2.2.15-60.el6_9.4 |
| Red Hat Enterprise Linux 7 | httpd | 0:2.4.6-45.el7_3.4 |
| Red Hat Enterprise Linux 7 | httpd-debuginfo | 0:2.4.6-45.el7_3.4 |
| Red Hat Enterprise Linux 7 | httpd-devel | 0:2.4.6-45.el7_3.4 |
| Red Hat Enterprise Linux 7 | httpd-manual | 0:2.4.6-45.el7_3.4 |
| Red Hat Enterprise Linux 7 | httpd-tools | 0:2.4.6-45.el7_3.4 |
| Red Hat Enterprise Linux 7 | mod_ldap | 0:2.4.6-45.el7_3.4 |
| Red Hat Enterprise Linux 7 | mod_proxy_html | 1:2.4.6-45.el7_3.4 |
| Red Hat Enterprise Linux 7 | mod_session | 0:2.4.6-45.el7_3.4 |
| Red Hat Enterprise Linux 7 | mod_ssl | 1:2.4.6-45.el7_3.4 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd | 0:2.4.23-120.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd | 0:2.4.23-120.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-debuginfo | 0:2.4.23-120.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-debuginfo | 0:2.4.23-120.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-devel | 0:2.4.23-120.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-devel | 0:2.4.23-120.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-libs | 0:2.4.23-120.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-libs | 0:2.4.23-120.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-manual | 0:2.4.23-120.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-manual | 0:2.4.23-120.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-selinux | 0:2.4.23-120.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-selinux | 0:2.4.23-120.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-tools | 0:2.4.23-120.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-tools | 0:2.4.23-120.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ldap | 0:2.4.23-120.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ldap | 0:2.4.23-120.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_html | 1:2.4.23-120.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_html | 1:2.4.23-120.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_security | 0:2.9.1-19.GA.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_security | 0:2.9.1-19.GA.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_security-debuginfo | 0:2.9.1-19.GA.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_security-debuginfo | 0:2.9.1-19.GA.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_session | 0:2.4.23-120.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_session | 0:2.4.23-120.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ssl | 1:2.4.23-120.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ssl | 1:2.4.23-120.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl | 1:1.0.2h-13.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl | 1:1.0.2h-13.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-debuginfo | 1:1.0.2h-13.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-debuginfo | 1:1.0.2h-13.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-devel | 1:1.0.2h-13.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-devel | 1:1.0.2h-13.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-libs | 1:1.0.2h-13.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-libs | 1:1.0.2h-13.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-perl | 1:1.0.2h-13.jbcs.el7 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-perl | 1:1.0.2h-13.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-static | 1:1.0.2h-13.jbcs.el6 |
| Red Hat jboss core services 1 | jbcs-httpd24-openssl-static | 1:1.0.2h-13.jbcs.el7 |
| Red Hat rhel software collections 2 | httpd24-httpd | 0:2.4.25-9.el6 |
| Red Hat rhel software collections 2 | httpd24-httpd | 0:2.4.25-9.el7 |
| Red Hat rhel software collections 2 | httpd24-httpd-debuginfo | 0:2.4.25-9.el7 |
| Red Hat rhel software collections 2 | httpd24-httpd-debuginfo | 0:2.4.25-9.el6 |
| Red Hat rhel software collections 2 | httpd24-httpd-devel | 0:2.4.25-9.el6 |
| Red Hat rhel software collections 2 | httpd24-httpd-devel | 0:2.4.25-9.el7 |
| Red Hat rhel software collections 2 | httpd24-httpd-manual | 0:2.4.25-9.el7 |
| Red Hat rhel software collections 2 | httpd24-httpd-manual | 0:2.4.25-9.el6 |
| Red Hat rhel software collections 2 | httpd24-httpd-tools | 0:2.4.25-9.el6 |
| Red Hat rhel software collections 2 | httpd24-httpd-tools | 0:2.4.25-9.el7 |
| Red Hat rhel software collections 2 | httpd24-mod_ldap | 0:2.4.25-9.el6 |
| Red Hat rhel software collections 2 | httpd24-mod_ldap | 0:2.4.25-9.el7 |
| Red Hat rhel software collections 2 | httpd24-mod_proxy_html | 1:2.4.25-9.el6 |
| Red Hat rhel software collections 2 | httpd24-mod_proxy_html | 1:2.4.25-9.el7 |
| Red Hat rhel software collections 2 | httpd24-mod_session | 0:2.4.25-9.el6 |
| Red Hat rhel software collections 2 | httpd24-mod_session | 0:2.4.25-9.el7 |
| Red Hat rhel software collections 2 | httpd24-mod_ssl | 1:2.4.25-9.el6 |
| Red Hat rhel software collections 2 | httpd24-mod_ssl | 1:2.4.25-9.el7 |
| SUSE Enterprise Storage 4 | apache2 | 2.4.23-29.24.1 |
| SUSE Linux Enterprise Server 11 SP4 | apache2 | 2.2.12-69.1 |
| SUSE Linux Enterprise Server 12 SP1 | apache2 | 2.4.16-19.1 |
| SUSE Linux Enterprise Server 12 SP1-LTSS | apache2 | 2.4.16-20.19.1 |
| SUSE Linux Enterprise Server 12 SP2 | apache2 | 2.4.23-21.1 |
| SUSE Linux Enterprise Server 12 SP2-BCL | apache2 | 2.4.23-29.24.1 |
| SUSE Linux Enterprise Server 12 SP2-LTSS | apache2 | 2.4.23-29.24.1 |
| SUSE Linux Enterprise Server 12 SP3 | apache2 | 2.4.23-29.24.1 |
| SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 | apache2 | 2.4.23-21.1 |
| SUSE Linux Enterprise Server for SAP Applications 11 SP4 | apache2 | 2.2.12-69.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | apache2 | 2.4.16-20.19.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | apache2 | 2.4.16-19.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | apache2 | 2.4.23-29.24.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | apache2 | 2.4.23-21.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | apache2 | 2.4.23-29.24.1 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | apache2 | 2.2.12-69.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP1 | apache2 | 2.4.16-19.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP2 | apache2 | 2.4.23-21.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | apache2 | 2.4.23-29.24.1 |
| SUSE OpenStack Cloud 7 | apache2 | 2.4.23-29.24.1 |
| SUSE Studio Onsite 1.3 | apache2 | 2.2.12-69.1 |
| Ubuntu 14.04 LTS | apache2 | 2.4.7-1ubuntu4.15 |
| Ubuntu 16.04 LTS | apache2 | 2.4.18-2ubuntu3.2 |