PT-2018-4923 · Apache+4 · Apache Http Server+4

Sergey Bobrov

·

Publicado

2017-04-12

·

Atualizado

2021-06-06

·

CVE-2016-4975

CVSS v3.1

6.1

Média

VetorAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.2.0 through 2.2.31 Apache HTTP Server versions 2.4.1 through 2.4.23
Description The issue allows for possible CRLF injection, enabling HTTP response splitting attacks for sites using mod userdir. This was mitigated by changes in versions 2.4.25 and 2.2.32, which prohibit CR or LF injection into the "Location" or other outbound header key or value.
Recommendations For Apache HTTP Server versions 2.2.0 through 2.2.31, update to version 2.2.32 to resolve the issue. For Apache HTTP Server versions 2.4.1 through 2.4.23, update to version 2.4.25 to resolve the issue.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-93

Identificadores relacionados

ALT-PU-2017-1655
CESA-2017_0906
CVE-2016-4975
OPENSUSE-SU-2018_2856-1
RHSA-2017:0906
RHSA-2017_0906
RHSA-2018:2185
RHSA-2018:2186
SUSE-SU-2018:2554-1
SUSE-SU-2018:2815-1
SUSE-SU-2018:2815-2
SUSE-SU-2018_2554-1
SUSE-SU-2018_2815-1
SUSE-SU-2018_2815-2
USN-3279-1

Produtos afetados

Alt Linux
Apache Http Server
Centos
Red Hat
Suse