CVE-2016-8743
High
Description
Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Apache Http Server
PublishedJul 27, 2017
First seenJul 27, 2017
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache http_server | 2.2.0 ≤ v ≤ 2.2.31, 2.4.1 ≤ v ≤ 2.4.23 | — |
| netapp clustered_data_ontap | No range specified | — |
| netapp oncommand_unified_manager | No range specified | — |
| debian debian_linux | 8.0, 9.0 | — |
| redhat enterprise_linux_desktop | 6.0, 7.0 | — |
| redhat enterprise_linux_eus | 7.3, 7.4, 7.5, 7.6, 7.7 | — |
| redhat enterprise_linux_server | 6.0, 7.0 | — |
| redhat enterprise_linux_server_aus | 7.3, 7.4, 7.6, 7.7 | — |
| redhat enterprise_linux_server_tus | 7.3, 7.6, 7.7 | — |
| redhat enterprise_linux_workstation | 6.0, 7.0 | — |
| redhat jboss_core_services | 1.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.