Security Bulletin: Open Source Apache Tomcat Vulnerabilities (CVE-2016-6817, CVE-2016-8735, CVE-2016-6816)

Summary Issues with Apache Tomcat Vulnerabilities have been addressed. Vulnerability Details CVEID: CVE-2016-6817 DESCRIPTION: Apache Tomcat is vulnerable to a denial of service. By sending a specially crafted HTTP/2 header, a remote attacker could exploit this vulnerability to cause the...

CRLF Injection

Jetty Server is vulnerable to CRLF injection. A remote attacker is able to inject arbitrary HTTP headers into the server response to perform response splitting attacks via the reason string in AbstractGenerator.java...

MGASA-2018-0411 Updated ruby packages fix security vulnerability

Ruby before 2.2.10 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick CVE-2017-17742. Directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before 2.2.10 might allow...

Updated ruby packages fix security vulnerability

Ruby before 2.2.10 allows an HTTP Response Splitting attack. An attacker can inject a crafted key and value into an HTTP response for the HTTP server of WEBrick CVE-2017-17742. Directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library in Ruby before 2.2.10 might allow...

SUSE SLES12 Security Update : apache2 (SUSE-SU-2018:2815-2)

This update for apache2 fixes the following issues : Security issues fixed : CVE-2016-8743: Fixed liberal whitespace interpretation accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chai...

SUSE-SU-2018:2815-2 Security update for apache2

This update for apache2 fixes the following issues: Security issues fixed: - CVE-2016-8743: Fixed liberal whitespace interpretation accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chai...

openSUSE Security Update : apache2 (openSUSE-2018-1046)

This update for apache2 fixes the following issues : Security issues fixed : - CVE-2016-8743: Fixed liberal whitespace interpretation accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any...

openSUSE: Security Advisory for apache2 (openSUSE-SU-2018:2856-1)

The remote host is missing an update for the Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Security update for apache2 (moderate)

This update for apache2 fixes the following issues: Security issues fixed: - CVE-2016-8743: Fixed liberal whitespace interpretation accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chai...

SUSE SLES12 Security Update : apache2 (SUSE-SU-2018:2815-1)

This update for apache2 fixes the following issues : Security issues fixed : CVE-2016-8743: Fixed liberal whitespace interpretation accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chai...

Response Splitting

node.js is vulnerable to response splitting. The library does not handle unicode characters properly, allowing a malicious user to conduct a response splitting attack...

SUSE-SU-2018:2815-1 Security update for apache2

This update for apache2 fixes the following issues: Security issues fixed: - CVE-2016-8743: Fixed liberal whitespace interpretation accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chai...

HTTP Response Splitting

nodejs is vulnerable to HTTP response splitting. This is due to a lack of validation for permitted characters in the reason argument in ServerResponsewriteHead function. An attacker is able to inject arbitrary HTTP headers into the server response via the affected argument and perform HTTP respon...

8x8: CRLF injection agentcrm.8x8.com

The agent application was vulnerable to a response splitting attack when parsing line feed characters in a given URL...

Internet Bug Bounty: mod_userdir CRLF injection (CVE-2016-4975)

Possible CRLF injection allowing HTTP response splitting attacks for sites which use moduserdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the "Location" or other outbound header key or value. Reported to security team 24th July 2016 Issu...

undertow: HTTP header injection using CRLF with UTF-8 Encoding (incomplete fix of CVE-2016-4993)

It was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also response splitting, due to insufficient sanitization and validation of user input before the input is used as part of an HTTP header value...

SUSE-SU-2018:2554-1 Security update for apache2

This update for apache2 fixes the following issues: Security issues fixed: - CVE-2016-8743: Fixed liberal whitespace interpretation accepted from requests and sent in response lines and headers. Accepting these different behaviors represented a security concern when httpd participates in any chai...

CVE-2016-4975

It was found that Apache was vulnerable to a HTTP response splitting attack for sites which use moduserdir. An attacker could use this flaw to inject CRLF characters into the HTTP header and could possibly gain access to secure data...

httpd: CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir

It was found that Apache was vulnerable to a HTTP response splitting attack for sites which use moduserdir. An attacker could use this flaw to inject CRLF characters into the HTTP header and could possibly gain access to secure data...

Apache HTTP Server Response Splitting Vulnerability (CNVD-2018-15542)

Apache HTTP Server is the United States Apache Apache Software Foundation, an open source web server. The server is fast, reliable and can be expanded through a simple API. A response splitting vulnerability exists in Apache HTTP Server versions 2.4.1 through 2.4.23 and 2.2.0 through 2.2.31. An...