CVE-2016-8743 (retired)

Priority
Description
Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal
in the whitespace accepted from requests and sent in response lines and
headers. Accepting these different behaviors represented a security concern
when httpd participates in any chain of proxies or interacts with back-end
application servers, either through mod_proxy or using conventional CGI
mechanisms, and may result in request smuggling, response splitting and
cache pollution.
Assigned-to
mdeslaur
Notes
ratliffNotes from Debian "The fix is not fully backwards compatible so
upstream have created a new option to control this behaviour.
Affects: 2.2.0 to 2.4.23."
mdeslaurThis fix no longer allows underscores in host names. Debian
added a patch to restore the behaviour:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=851357
http://mail-archives.apache.org/mod_mbox/httpd-dev/201702.mbox/%3C20170202125319.GA15948%40redhat.com%3E

The new configuration option doesn't entirely preserve
backwards compatibility:
https://bz.apache.org/bugzilla/show_bug.cgi?id=60783
More Information

Updated: 2019-10-09 07:57:38 UTC (commit 33aea848a182c0afcd0a3f927a01a7ecd9a061ee)