Lucene search

K
suseSuseOPENSUSE-SU-2018:2856-1
HistorySep 25, 2018 - 3:13 p.m.

Security update for apache2 (moderate)

2018-09-2515:13:20
lists.opensuse.org
58

0.004 Low

EPSS

Percentile

71.5%

This update for apache2 fixes the following issues:

Security issues fixed:

  • CVE-2016-8743: Fixed liberal whitespace interpretation accepted from
    requests and sent in response lines and headers. Accepting these
    different behaviors represented a security concern when httpd
    participates in any chain of proxies or interacts with back-end
    application servers, either through mod_proxy or using conventional CGI
    mechanisms, and may result in request smuggling, response splitting and
    cache pollution. (bsc#1016715)
  • CVE-2016-4975: Fixed possible CRLF injection allowing HTTP response
    splitting attacks for sites which use mod_userdir. This issue was
    mitigated by changes which prohibit CR or LF injection into the
    "Location" or other outbound header key or value. (bsc#1104826)

This update was imported from the SUSE:SLE-12-SP2:Update update project.