CVE-2016-4975
Summary
| CVE | CVE-2016-4975 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2018-08-14 12:29:00 UTC |
| Updated | 2023-11-07 02:32:00 UTC |
| Description | Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the "Location" or other outbound header key or value. Fixed in Apache HTTP Server 2.4.25 (Affected 2.4.1-2.4.23). Fixed in Apache HTTP Server 2.2.32 (Affected 2.2.0-2.2.31). |
Risk And Classification
Problem Types: CWE-93
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Apache | Http Server | 2.2.0 | All | All | All |
| Application | Apache | Http Server | 2.2.10 | All | All | All |
| Application | Apache | Http Server | 2.2.11 | All | All | All |
| Application | Apache | Http Server | 2.2.12 | All | All | All |
| Application | Apache | Http Server | 2.2.13 | All | All | All |
| Application | Apache | Http Server | 2.2.14 | All | All | All |
| Application | Apache | Http Server | 2.2.15 | All | All | All |
| Application | Apache | Http Server | 2.2.16 | All | All | All |
| Application | Apache | Http Server | 2.2.17 | All | All | All |
| Application | Apache | Http Server | 2.2.18 | All | All | All |
| Application | Apache | Http Server | 2.2.19 | All | All | All |
| Application | Apache | Http Server | 2.2.2 | All | All | All |
| Application | Apache | Http Server | 2.2.20 | All | All | All |
| Application | Apache | Http Server | 2.2.21 | All | All | All |
| Application | Apache | Http Server | 2.2.22 | All | All | All |
| Application | Apache | Http Server | 2.2.23 | All | All | All |
| Application | Apache | Http Server | 2.2.24 | All | All | All |
| Application | Apache | Http Server | 2.2.25 | All | All | All |
| Application | Apache | Http Server | 2.2.26 | All | All | All |
| Application | Apache | Http Server | 2.2.27 | All | All | All |
| Application | Apache | Http Server | 2.2.29 | All | All | All |
| Application | Apache | Http Server | 2.2.3 | All | All | All |
| Application | Apache | Http Server | 2.2.31 | All | All | All |
| Application | Apache | Http Server | 2.2.4 | All | All | All |
| Application | Apache | Http Server | 2.2.6 | All | All | All |
| Application | Apache | Http Server | 2.2.8 | All | All | All |
| Application | Apache | Http Server | 2.2.9 | All | All | All |
| Application | Apache | Http Server | 2.4.1 | All | All | All |
| Application | Apache | Http Server | 2.4.10 | All | All | All |
| Application | Apache | Http Server | 2.4.12 | All | All | All |
| Application | Apache | Http Server | 2.4.16 | All | All | All |
| Application | Apache | Http Server | 2.4.17 | All | All | All |
| Application | Apache | Http Server | 2.4.18 | All | All | All |
| Application | Apache | Http Server | 2.4.2 | All | All | All |
| Application | Apache | Http Server | 2.4.20 | All | All | All |
| Application | Apache | Http Server | 2.4.23 | All | All | All |
| Application | Apache | Http Server | 2.4.3 | All | All | All |
| Application | Apache | Http Server | 2.4.4 | All | All | All |
| Application | Apache | Http Server | 2.4.6 | All | All | All |
| Application | Apache | Http Server | 2.4.7 | All | All | All |
| Application | Apache | Http Server | 2.4.9 | All | All | All |
| Application | Apache | Http Server | 2.2.0 | All | All | All |
| Application | Apache | Http Server | 2.2.10 | All | All | All |
| Application | Apache | Http Server | 2.2.11 | All | All | All |
| Application | Apache | Http Server | 2.2.12 | All | All | All |
| Application | Apache | Http Server | 2.2.13 | All | All | All |
| Application | Apache | Http Server | 2.2.14 | All | All | All |
| Application | Apache | Http Server | 2.2.15 | All | All | All |
| Application | Apache | Http Server | 2.2.16 | All | All | All |
| Application | Apache | Http Server | 2.2.17 | All | All | All |
| Application | Apache | Http Server | 2.2.18 | All | All | All |
| Application | Apache | Http Server | 2.2.19 | All | All | All |
| Application | Apache | Http Server | 2.2.2 | All | All | All |
| Application | Apache | Http Server | 2.2.20 | All | All | All |
| Application | Apache | Http Server | 2.2.21 | All | All | All |
| Application | Apache | Http Server | 2.2.22 | All | All | All |
| Application | Apache | Http Server | 2.2.23 | All | All | All |
| Application | Apache | Http Server | 2.2.24 | All | All | All |
| Application | Apache | Http Server | 2.2.25 | All | All | All |
| Application | Apache | Http Server | 2.2.26 | All | All | All |
| Application | Apache | Http Server | 2.2.27 | All | All | All |
| Application | Apache | Http Server | 2.2.29 | All | All | All |
| Application | Apache | Http Server | 2.2.3 | All | All | All |
| Application | Apache | Http Server | 2.2.31 | All | All | All |
| Application | Apache | Http Server | 2.2.4 | All | All | All |
| Application | Apache | Http Server | 2.2.6 | All | All | All |
| Application | Apache | Http Server | 2.2.8 | All | All | All |
| Application | Apache | Http Server | 2.2.9 | All | All | All |
| Application | Apache | Http Server | 2.4.1 | All | All | All |
| Application | Apache | Http Server | 2.4.10 | All | All | All |
| Application | Apache | Http Server | 2.4.12 | All | All | All |
| Application | Apache | Http Server | 2.4.16 | All | All | All |
| Application | Apache | Http Server | 2.4.17 | All | All | All |
| Application | Apache | Http Server | 2.4.18 | All | All | All |
| Application | Apache | Http Server | 2.4.2 | All | All | All |
| Application | Apache | Http Server | 2.4.20 | All | All | All |
| Application | Apache | Http Server | 2.4.23 | All | All | All |
| Application | Apache | Http Server | 2.4.3 | All | All | All |
| Application | Apache | Http Server | 2.4.4 | All | All | All |
| Application | Apache | Http Server | 2.4.6 | All | All | All |
| Application | Apache | Http Server | 2.4.7 | All | All | All |
| Application | Apache | Http Server | 2.4.9 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | MLIST | lists.apache.org | |
| Pony Mail! | MLIST | lists.apache.org | |
| Pony Mail! | MLIST | lists.apache.org | |
| Pony Mail! | lists.apache.org | ||
| Document Display | HPE Support Center | CONFIRM | support.hpe.com | |
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | MLIST | lists.apache.org | |
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | lists.apache.org | ||
| httpd 2.2 vulnerabilities - The Apache HTTP Server Project | CONFIRM | httpd.apache.org | Vendor Advisory |
| Pony Mail! | MLIST | lists.apache.org | |
| Pony Mail! | MLIST | lists.apache.org | |
| Pony Mail! | MLIST | lists.apache.org | |
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | MLIST | lists.apache.org | |
| Malformed Request | BID | www.securityfocus.com | Third Party Advisory, VDB Entry |
| Pony Mail! | MLIST | lists.apache.org | |
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | MLIST | lists.apache.org | |
| Pony Mail! | lists.apache.org | ||
| httpd 2.4 vulnerabilities - The Apache HTTP Server Project | CONFIRM | httpd.apache.org | Vendor Advisory |
| Pony Mail! | MLIST | lists.apache.org | |
| Pony Mail! | MLIST | lists.apache.org | |
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | MLIST | lists.apache.org | |
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | MLIST | lists.apache.org | |
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | MLIST | lists.apache.org | |
| Pony Mail! | MLIST | lists.apache.org | |
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | MLIST | lists.apache.org | |
| Pony Mail! | lists.apache.org | ||
| Pony Mail! | MLIST | lists.apache.org | |
| CVE-2016-4975 Apache HTTP Server Vulnerability in NetApp Products | NetApp Product Security | CONFIRM | security.netapp.com | Third Party Advisory |
| Pony Mail! | MLIST | lists.apache.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: The issue was discovered by Sergey Bobrov