| Name | CVE-2016-8743 |
| Description | Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chain of proxies or interacts with back-end application servers, either through mod_proxy or using conventional CGI mechanisms, and may result in request smuggling, response splitting and cache pollution. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-841-1, DLA-841-2, DSA-3796-1 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| apache2 (PTS) | jessie, jessie (lts) | 2.4.10-10+deb8u29 | fixed |
| stretch (security) | 2.4.25-3+deb9u13 | fixed | |
| stretch (lts), stretch | 2.4.25-3+deb9u19 | fixed | |
| buster, buster (lts) | 2.4.59-1~deb10u4 | fixed | |
| buster (security) | 2.4.59-1~deb10u1 | fixed | |
| bullseye | 2.4.62-1~deb11u1 | fixed | |
| bullseye (security) | 2.4.62-1~deb11u2 | fixed | |
| bookworm (security), bookworm | 2.4.62-1~deb12u2 | fixed | |
| sid, trixie | 2.4.62-3 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| apache2 | source | wheezy | 2.2.22-13+deb7u11 | DLA-841-2 | ||
| apache2 | source | jessie | 2.4.10-10+deb8u8 | DSA-3796-1 | ||
| apache2 | source | (unstable) | 2.4.25-1 |
https://lists.apache.org/thread.html/139862b41c0dfd5e6e00ad89c00119f9faf0dd41a2f927da9c9a4076@%3Cannounce.httpd.apache.org%3E
https://httpd.apache.org/security/vulnerabilities_24.html
The fix is not fully backwards compatible so upstream have
created a new option to control this behaviour. This means that
if this is fixed the security advisory need to mention this.
The fix is invasive and should require some extra testing before reaching
stable and old-stable.
Affects: 2.2.0 to 2.4.23.
Fixed in 2.4.25.
For 2.2 preparation is done in http://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x-merge-http-strict/